Is askbot safe ? 1 known vulnerability, worst severity MODERATE.
// reach 43 direct dependencies
11 carry known advisories, worst CRITICAL
0 packages depend on it
an advisory here reaches each of them
// ai model usage No published models are known to use this package.
cvss CVSS v4.0 base score out of 10
epss chance of exploitation in 30 days, 29th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-r2jv-fwfr-4j8c, the advisory selected below
// 1 advisories GHSA-r2jv-fwfr-4j8c All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users. This issue affects askbot: 0.12.2. MODE All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users. This issue affects askbot: 0.12.2.
// cvss v4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Attack vector Network
Attack complexity Low
Attack requirements None
Privileges required Low
User interaction None
Confidentiality (vulnerable system) None
Integrity (vulnerable system) Low
Availability (vulnerable system) None
Confidentiality (subsequent systems) None
Integrity (subsequent systems) None
Availability (subsequent systems) None Checked 2026-11-06 at 22:03 UTC. The most recent advisory here was published 2026-01-27. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page