immich-app/immich 还好吗？

不好。

有一个攻击者正在利用的漏洞。

内部：测试和工具里有 79 个漏洞，都不会影响你的用户。

17:07 UTC检查提交 256eb55公告截至 16:51 UTC

无法读取 mobile/ios/Podfile.lock：这个答案只覆盖仓库的其余部分。

mobile/android/gradle/libs.versions.toml 没有锁文件：只检查了其中写明的版本，没有检查它们带进来的包。

发布到 X

有 13 件事要更新

更新 fastapi攻击者正在利用有人可以读到本不该看到的数据。
- starlette 0.50.05 个漏洞已在 1.3.1 中修复攻击者正在利用
  一个影响未说明的漏洞。从网上任何地方都行，不需要账号。
  - GHSA-86qp-5c8j-p5mrStarlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
  - GHSA-wqp7-x3pw-xc5rStarlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
  - GHSA-82w8-qh3p-5jfqStarlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
  - GHSA-x746-7m8f-x49cStarlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
  - GHSA-jp82-jpqv-5vv3Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
- anyio 4.2.02 个漏洞已在 4.14.2 中修复
  有人可以让它崩溃或卡死。必须能接触到这台机器。
  - GHSA-5p39-cfhj-2xmpAnyIO process-pool workers can block indefinitely on undrained stderr
  - GHSA-82r6-8w77-94w6AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
把 happy-dom 更新到 21.0.4有人可以在它运行的地方运行自己的代码。
- happy-dom 21.0.31 个漏洞已在 21.0.4 中修复
  有人可以在它运行的地方运行自己的代码。从网上任何地方都行，不需要账号。
  - GHSA-834v-8h66-3h79Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
更新 huggingface-hub有人可以在它运行的地方运行自己的代码。
- fsspec 2023.12.21 个漏洞已在 2026.6.0 中修复
  有人可以在它运行的地方运行自己的代码。从网上任何地方都行，不需要账号。
  - GHSA-27vj-qcqg-25rcfsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

更新 fastlane有人可以读到本不该看到的数据。
- rubyzip 2.3.21 个漏洞已在 3.4.0 中修复
  有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
  - GHSA-47m2-wp7j-p9vcrubyzip path traversal vulnerability
- faraday 1.10.32 个漏洞已在 1.10.6 中修复
  有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
  - GHSA-33mh-2634-fwr2Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url
  - GHSA-98m9-hrrm-r99rFaraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters
- 再显示 3 条
  - jwt 2.8.11 个漏洞已在 2.10.3 中修复
    有人可以冒充其他用户。从网上任何地方都行，不需要账号。
    GHSA-c32j-vqhx-rx3xruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
  - addressable 2.8.61 个漏洞已在 2.9.0 中修复
    有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
    GHSA-h27x-rffw-24p4Addressable has a Regular Expression Denial of Service in Addressable templates
  - rexml 3.2.85 个漏洞已在 3.3.9 中修复
    有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
    GHSA-vmwr-mc7x-5vc3REXML denial of service vulnerability
    GHSA-2rxp-v6pw-ch6mREXML ReDoS vulnerability
    GHSA-4xqq-m2hx-25v8REXML denial of service vulnerability
    GHSA-5866-49gr-22v4REXML DoS vulnerability
    GHSA-r55c-59qm-vjw6REXML DoS vulnerability
更新 rapidocr有人可以读到本不该看到的数据。
- urllib3 2.6.26 个漏洞已在 2.8.0 中修复
  有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
  - GHSA-qccp-gfcp-xxvcurllib3: Sensitive headers forwarded across origins in proxied low-level redirects
  - GHSA-38jv-5279-wg99Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
  - GHSA-mf9v-mfxr-j63jurllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
  - GHSA-vxq7-64xx-v4gwurllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
  - GHSA-gh4c-6fx4-qh6gurllib3: Chunked Deflate streaming can enter an infinite loop
  - GHSA-8988-9cw3-xx77urllib3: HTTPS proxy TLS configuration may be ignored or overridden
更新 react-email有人可以读到本不该看到的数据。
- fast-uri 3.1.411 个漏洞已在 3.1.9 中修复
  有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
  - GHSA-f65p-4m7j-42xcfast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
  - GHSA-fph4-wmhf-6fwffast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
  - GHSA-5jgf-p345-68v8fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
  - GHSA-7p8r-x3mc-p8w7fast-uri vulnerable to host confusion via backslash authority introducer
  - GHSA-jqff-g426-hqxpfast-uri vulnerable to host confusion via percent-encoded scheme normalization
  - GHSA-qw65-cvwx-89v3fast-uri vulnerable to authority injection via an unvalidated port in serialize
  - GHSA-333x-w4r6-6crpfast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
  - GHSA-hrr3-gc8f-f4qjfast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
  - GHSA-w74x-v6f9-j3xgfast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
  - GHSA-wjr9-j795-jxcrfast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
  - GHSA-xhq7-xmqj-769hfast-uri vulnerable to improper path equivalence in relative reference normalization
更新 @immich/ui有人可以让它崩溃或卡死。
- immutable 5.1.62 个漏洞已在 5.1.8 中修复
  有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
  - GHSA-v56q-mh7h-f735Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
  - GHSA-xvcm-6775-5m9rImmutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
更新 bcrypt有人可以让它崩溃或卡死。
- undici 8.11.23 个漏洞已在 8.12.2 中修复
  有人可以篡改数据或文件。从网上任何地方都行，不需要账号。
  - GHSA-f72v-6w45-q472undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
  - GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
  - GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
把 body-parser 更新到 2.4.0有人可以让它崩溃或卡死。
- body-parser 2.3.01 个漏洞已在 2.4.0 中修复
  有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
  - GHSA-27r3-jxmh-p828body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
更新 immich-model有人可以让它崩溃或卡死。
- protobuf 6.33.21 个漏洞已在 6.33.5 中修复
  有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
  - GHSA-7gcm-g887-7qv7protobuf affected by a JSON recursion depth bypass
把 multer 更新到 2.5.0有人可以让它崩溃或卡死。
- multer 2.4.01 个漏洞已在 2.5.0 中修复
  有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
  - GHSA-q7qp-rjg7-q26mmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
更新 socket.io-client有人可以让它崩溃或卡死。
- ws 8.20.11 个漏洞已在 8.21.0 中修复
  有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
  - GHSA-96hv-2xvq-fx4pws: Memory exhaustion DoS from tiny fragments and data chunks
把 zod 更新到 4.6.6有人可以让它崩溃或卡死。
- zod 4.4.31 个漏洞已在 4.6.6 中修复
  有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
  - GHSA-mrhx-c7xc-m3w5Zod can exhaust memory while validating oversized constrained collections

影响你的用户

项目发布的内容里有 56 个漏洞，最严重的在前。

可能泄露用户数据，或让人接管

fsspec 2023.12.21 个漏洞已在 2026.6.0 中修复有人可以在它运行的地方运行自己的代码。从网上任何地方都行，不需要账号。
- GHSA-27vj-qcqg-25rcfsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
happy-dom 21.0.31 个漏洞已在 21.0.4 中修复有人可以在它运行的地方运行自己的代码。从网上任何地方都行，不需要账号。
- GHSA-834v-8h66-3h79Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
rubyzip 2.3.21 个漏洞已在 3.4.0 中修复有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-47m2-wp7j-p9vcrubyzip path traversal vulnerability
fast-uri 3.1.411 个漏洞已在 3.1.9 中修复有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-f65p-4m7j-42xcfast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
- GHSA-fph4-wmhf-6fwffast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
- GHSA-5jgf-p345-68v8fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
- GHSA-7p8r-x3mc-p8w7fast-uri vulnerable to host confusion via backslash authority introducer
- GHSA-jqff-g426-hqxpfast-uri vulnerable to host confusion via percent-encoded scheme normalization
- GHSA-qw65-cvwx-89v3fast-uri vulnerable to authority injection via an unvalidated port in serialize
- GHSA-333x-w4r6-6crpfast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
- GHSA-hrr3-gc8f-f4qjfast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
- GHSA-w74x-v6f9-j3xgfast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
- GHSA-wjr9-j795-jxcrfast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
- GHSA-xhq7-xmqj-769hfast-uri vulnerable to improper path equivalence in relative reference normalization
urllib3 2.6.26 个漏洞已在 2.8.0 中修复有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-qccp-gfcp-xxvcurllib3: Sensitive headers forwarded across origins in proxied low-level redirects
- GHSA-38jv-5279-wg99Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
- GHSA-mf9v-mfxr-j63jurllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
- GHSA-vxq7-64xx-v4gwurllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
- GHSA-gh4c-6fx4-qh6gurllib3: Chunked Deflate streaming can enter an infinite loop
- GHSA-8988-9cw3-xx77urllib3: HTTPS proxy TLS configuration may be ignored or overridden

faraday 1.10.32 个漏洞已在 1.10.6 中修复有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-33mh-2634-fwr2Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url
- GHSA-98m9-hrrm-r99rFaraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters
excon 0.110.01 个漏洞已在 1.5.0 中修复有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-48rx-c7pg-q66rExcon does not redact additional sensitive/risky headers when following redirects
esbuild 0.19.121 个漏洞已在 0.25.0 中修复有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-67mh-4wv8-2f99esbuild enables any website to send any requests to the development server and read the response
jwt 2.8.11 个漏洞已在 2.10.3 中修复有人可以冒充其他用户。从网上任何地方都行，不需要账号。
- GHSA-c32j-vqhx-rx3xruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
undici 8.11.23 个漏洞已在 8.12.2 中修复有人可以篡改数据或文件。从网上任何地方都行，不需要账号。
- GHSA-f72v-6w45-q472undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
- GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
@sveltejs/kit 2.70.32 个漏洞已在 3.0.0 中修复有人可以攻击使用它的人。从网上任何地方都行，不需要账号。
- GHSA-pfhg-q3qv-9q6rSvelteKit: URL redirection to untrusted site via enhanced form submission
- GHSA-27mw-82g8-phjjSvelteKit : XSS via untrusted cache-control header in prerendered page
aws-sdk-s3 1.151.01 个漏洞已在 1.208.0 中修复某项防护比应有的弱。必须有账号。
- GHSA-2xgq-q749-89fqAWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue

可能让你的服务崩溃或变慢

starlette 0.50.05 个漏洞已在 1.3.1 中修复攻击者正在利用一个影响未说明的漏洞。从网上任何地方都行，不需要账号。
- GHSA-86qp-5c8j-p5mrStarlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
- GHSA-wqp7-x3pw-xc5rStarlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
- GHSA-82w8-qh3p-5jfqStarlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
- GHSA-x746-7m8f-x49cStarlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
- GHSA-jp82-jpqv-5vv3Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
anyio 4.2.02 个漏洞已在 4.14.2 中修复有人可以让它崩溃或卡死。必须能接触到这台机器。
- GHSA-5p39-cfhj-2xmpAnyIO process-pool workers can block indefinitely on undrained stderr
- GHSA-82r6-8w77-94w6AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
body-parser 2.3.01 个漏洞已在 2.4.0 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-27r3-jxmh-p828body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
protobuf 6.33.21 个漏洞已在 6.33.5 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-7gcm-g887-7qv7protobuf affected by a JSON recursion depth bypass
ws 8.20.11 个漏洞已在 8.21.0 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-96hv-2xvq-fx4pws: Memory exhaustion DoS from tiny fragments and data chunks

addressable 2.8.61 个漏洞已在 2.9.0 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-h27x-rffw-24p4Addressable has a Regular Expression Denial of Service in Addressable templates
zod 4.4.31 个漏洞已在 4.6.6 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-mrhx-c7xc-m3w5Zod can exhaust memory while validating oversized constrained collections
multer 2.4.01 个漏洞已在 2.5.0 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-q7qp-rjg7-q26mmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
immutable 5.1.62 个漏洞已在 5.1.8 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-v56q-mh7h-f735Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
- GHSA-xvcm-6775-5m9rImmutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
rexml 3.2.85 个漏洞已在 3.3.9 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-vmwr-mc7x-5vc3REXML denial of service vulnerability
- GHSA-2rxp-v6pw-ch6mREXML ReDoS vulnerability
- GHSA-4xqq-m2hx-25v8REXML denial of service vulnerability
- GHSA-5866-49gr-22v4REXML DoS vulnerability
- GHSA-r55c-59qm-vjw6REXML DoS vulnerability
idna 3.111 个漏洞已在 3.15 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-65pc-fj4g-8rjxInternationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
postcss-selector-parser 6.1.41 个漏洞已在 7.1.6 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-rj75-hqrm-r3gfPostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
filelock 3.20.11 个漏洞已在 3.20.3 中修复有人可以让它崩溃或卡死。必须能接触到这台机器。
- GHSA-qmgc-5h2g-mvrwfilelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock
pygments 2.17.21 个漏洞已在 2.20.0 中修复有人可以让它崩溃或卡死。必须能接触到这台机器。
- GHSA-5239-wwwm-4pmqPygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching
cookie 0.6.01 个漏洞已在 0.7.0 中修复一个影响未说明的漏洞。
- GHSA-pxg6-pf52-xh8xcookie accepts cookie name, path, and domain with out of bounds characters

仅内部

开发工具、测试、示例、文档和基准测试：它们不会影响你的用户，所以从不计入答案。

tinypool 1.1.12 个漏洞已在 2.1.2 中修复有人可以在它运行的地方运行自己的代码。从网上任何地方都行，不需要账号。
- GHSA-85c8-ppgw-ccprTinypool: Prototype Pollution Gadget to RCE in run() options
- GHSA-5gmw-xhrv-c9v3Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
brotli 1.1.02 个漏洞已在 1.2.1 中修复有人可以在它运行的地方运行自己的代码。从网上任何地方都行，不需要账号。
- GHSA-9v8h-qqgm-4m35Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
- GHSA-2qfp-q593-8484Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation
shell-quote 1.10.01 个漏洞已在 1.11.0 中修复有人可以在它运行的地方运行自己的代码。从网上任何地方都行，不需要账号。
- GHSA-pqg4-j6r4-53mvshell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
tar 6.2.112 个漏洞已在 7.5.21 中修复有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-34x7-hfp2-rc4vnode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
- GHSA-83g3-92jg-28cxArbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
- GHSA-8qq5-rm4j-mr97node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
- GHSA-9ppj-qmqm-q256node-tar Symlink Path Traversal via Drive-Relative Linkpath
- GHSA-qffp-2rhf-9h96tar has Hardlink Path Traversal via Drive-Relative Linkpath
- GHSA-r6q2-hw4h-h46wRace Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
- GHSA-vmf3-w455-68vhnode-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
- GHSA-23hp-3jrh-7fpwnode-tar: Decompression/parse DoS via unlimited input
- GHSA-8x88-c5mf-7j5wnode-tar: Negative tar entry size causes infinite loop in archive replace
- GHSA-r292-9mhp-454mnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
- GHSA-gvwx-54wh-qm9jnode-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
- GHSA-w8wr-v893-vjvpnode-tar: Process crash via PAX numeric path type confusion
dompurify 3.4.125 个漏洞已在 3.4.17 中修复有人可以攻击使用它的人。从网上任何地方都行，不需要账号。
- GHSA-cg2g-xh64-v4q7DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
- GHSA-mrv2-3pqr-j5jrDOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
- GHSA-55q2-fjhq-7xh7DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
- GHSA-6688-9rhm-gjv2DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
- GHSA-c6gr-qvv4-5v3fDOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
launch-editor 2.14.13 个漏洞已在 2.14.2 中修复有人可以在它运行的地方运行自己的代码。从网上任何地方都行，不需要账号。
- GHSA-587h-7wmj-h5pmlaunch-editor: `fs.existsSync()` existence check can be bypassed on Windows
- GHSA-698v-4r3x-3vcvlaunch-editor: escapeCmdArgs() omits % escaping on Windows
- GHSA-r825-w8mm-5pxwlaunch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
serialize-javascript 6.0.23 个漏洞已在 7.1.3 中修复有人可以在它运行的地方运行自己的代码。从网上任何地方都行，不需要账号。
- GHSA-5c6j-r48x-rmvqSerialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
- GHSA-m5mm-p8h7-m29vSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
- GHSA-qj8w-gfj5-8c6vSerialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
mermaid 11.16.05 个漏洞已在 11.16.1 中修复有人可以在它运行的地方运行自己的代码。从网上任何地方都行，不需要账号。
- GHSA-6x64-9x62-f2gxMermaid allows CSS injection applying to sibling elements of the diagram
- GHSA-3rrr-jr9j-h3q3Mermaid Architecture diagrams are vulnerable to prototype pollution
- GHSA-c4c3-pg64-4m4vMermaid configuration APIs allow prototype pollution
- GHSA-2v8p-3f2j-5mp7Mermaid XY Charts are vulnerable to an infinite loop DoS
- GHSA-rhh3-jpg6-66xhMermaid radar diagrams are vulnerable to DoS
jinja2 3.1.43 个漏洞已在 3.1.6 中修复有人可以在它运行的地方运行自己的代码。必须能接触到这台机器。
- GHSA-cpwx-vrp4-4pq7Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
- GHSA-gmj6-6f8f-6699Jinja has a sandbox breakout through malicious filenames
- GHSA-q2x7-8rv6-6q7hJinja has a sandbox breakout through indirect reference to format method
follow-redirects 1.16.02 个漏洞已在 1.16.1 中修复有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-8r9p-f939-6h3cfollow-redirects sensitiveHeaders regex escaping can expose credential headers
- GHSA-q3jh-wrc6-jgq8follow-redirects array-form headers bypass cross-origin credential stripping
http-cache-semantics 4.2.01 个漏洞有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-ch52-4w7c-c8xphttp-cache-semantics max-stale handling can disclose cross-user cached responses
webpack-dev-middleware 7.4.51 个漏洞已在 7.4.6 中修复有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-g84c-rxfj-3j2cwebpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
wheel 0.45.11 个漏洞已在 0.46.2 中修复有人可以读到本不该看到的数据。必须能接触到这台机器。
- GHSA-8rrh-rw8j-w5fxWheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack
flask-cors 4.0.14 个漏洞已在 6.0.0 中修复有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-43qf-4rqw-9q2gFlask-CORS vulnerable to Improper Handling of Case Sensitivity
- GHSA-hxwh-jpp2-84pmFlask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default
- GHSA-7rxf-gvfg-47g4Flask-CORS improper regex path matching vulnerability
- GHSA-8vgw-p6qm-5gr7Flask-CORS allows for inconsistent CORS matching
werkzeug 3.0.36 个漏洞已在 3.1.9 中修复有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-f9vj-2wh5-fj8jWerkzeug safe_join not safe on Windows
- GHSA-q34m-jh98-gwm2Werkzeug possible resource exhaustion when parsing file data in forms
- GHSA-29vq-49wr-vm6x Werkzeug safe_join() allows Windows special device names
- GHSA-87hc-h4r5-73f7 Werkzeug safe_join() allows Windows special device names with compound extensions
- GHSA-g6x2-hccm-hh4mWerkzeug safe_join() allows Windows special device names
- GHSA-hgf8-39gv-g3f2Werkzeug safe_join() allows Windows special device names
setuptools 80.9.02 个漏洞已在 84.1.0 中修复有人可以读到本不该看到的数据。必须能接触到这台机器。
- GHSA-h35f-9h28-mq5csetuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
- GHSA-xmj3-9gf7-h52wsetuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
joi 17.13.44 个漏洞已在 17.13.8 中修复有人可以篡改数据或文件。从网上任何地方都行，不需要账号。
- GHSA-wr44-6hxh-3jwqjoi messages compilation allows prototype replacement through __proto__ error codes
- GHSA-6w3j-5fw6-r9vrjoi: Prototype pollution via a `__proto__` language key in custom messages
- GHSA-gg4h-3hg2-grpcjoi: object().rename() with a template target can set the validated object's prototype
- GHSA-6h2x-m376-mqjqjoi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
katex 0.16.471 个漏洞已在 0.18.2 中修复有人可以篡改数据或文件。从网上任何地方都行，不需要账号。
- GHSA-238p-pmpm-9mq7KaTeX: Existing prototype pollution can bypass trust restrictions
svgo 3.3.42 个漏洞已在 3.3.5 中修复有人可以攻击使用它的人。从网上任何地方都行，不需要账号。
- GHSA-w27v-7q3p-w38rSVGO: removeScripts allows executable links through namespace and control-character bypasses
- GHSA-4vpr-x523-8j87SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
body-parser 1.20.61 个漏洞已在 1.20.9 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-27r3-jxmh-p828body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
brace-expansion 1.1.156 个漏洞已在 1.1.21 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-3jxr-9vmj-r5cpbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
- GHSA-6j4f-fj2g-mc7pbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
- GHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
- GHSA-qhr7-859c-m2p7brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
- GHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
- GHSA-q2hr-2g5m-vwhrbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
image-size 2.0.22 个漏洞已在 2.0.3 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-5p2g-fcmc-qvqqimage-size: JXL and HEIF parsers allow denial of service through infinite loops
- GHSA-w3rx-r6r6-pgprimage-size: ICNS parser allows denial of service through an infinite loop
python-socketio 5.16.01 个漏洞已在 5.16.2 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-5w7q-77mv-v69fpython-socketio: Binary attachment accumulation can cause denial of service
msgpack 1.1.21 个漏洞已在 1.2.1 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-6v7p-g79w-8964MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
python-engineio 4.12.22 个漏洞已在 4.13.2 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-cgwc-pv48-fhj5python-engineio has unbound thread allocation that can cause denial of service
- GHSA-m9gh-vj53-gvh9python-engineio has possible denial of service due to maximum payload size sometimes not being enforced
colord 2.9.31 个漏洞已在 2.9.4 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-2wm5-q62r-hmrvColord: Slow rejection of oversized malformed color strings
qs 6.15.32 个漏洞已在 6.16.0 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-4mjr-xmp4-gh2gqs: Denial of Service via Attacker Controlled isBuffer
- GHSA-x5fp-wj9c-mxmxqs array-limit bypass via bracket-key comma parsing
postcss-selector-parser 7.1.51 个漏洞已在 7.1.6 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-rj75-hqrm-r3gfPostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
uuid 8.3.21 个漏洞已在 11.1.1 中修复一个影响未说明的漏洞。从网上任何地方都行，不需要账号。
- GHSA-w5hq-g745-h8pquuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
flask 3.0.01 个漏洞已在 3.1.3 中修复一个影响未说明的漏洞。从网上任何地方都行，不需要账号。
- GHSA-68rp-wp8r-4726Flask session does not add `Vary: Cookie` header when accessed in some ways

有变化时发邮件给我

先发一封邮件请你确认，之后只在结论变差或出现新的严重漏洞时才发：每天最多一封，若攻击者正在利用则立即发送。一键退订。

把徽章放进你的 README

它显示这个答案，并随答案变化。

[![immich-app/immich 还好吗？](https://istheinternetok.com/r/immich-app/immich/badge.svg)](https://istheinternetok.com/r/immich-app/immich/)

读取自 machine-learning/uv.lock, mobile/android/Gemfile.lock, mobile/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved, mobile/ios/Runner.xcworkspace/xcshareddata/swiftpm/Package.resolved, mobile/packages/ui/pubspec.lock, mobile/pubspec.lock, native/Cargo.lock, pnpm-lock.yaml, mobile/android/gradle/libs.versions.toml。