Search
Find a vulnerability
Search criteria
4 vulnerabilities found for lancet by duke-git
CVE-2026-110240 (GCVE-0-2026-110240)
Vulnerability from nvd – Published: 2026-10-13 18:50 – Updated: 2026-10-13 19:24
VLAI
EPSS
VEX
Title
Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP
Summary
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints.
Severity
4.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 19:24 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/duke-git/lancet/issues/356 | issue-trackingtechnical-description |
| https://github.com/duke-git/lancet/pull/357 | patchissue-tracking |
| https://github.com/duke-git/lancet/commit/835111c… | patch |
| https://github.com/duke-git/lancet/blob/v2.3.9/ne… | technical-description |
| https://github.com/duke-git/lancet/blob/v1.4.6/ne… | technical-description |
| https://github.com/duke-git/lancet | product |
| https://www.vulncheck.com/advisories/lancet-throu… | third-party-advisory |
Impacted products
Date Public
2026-09-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110240",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T19:24:08.615533Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:24:52.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/duke-git/lancet/issues/356"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/duke-git/lancet/v2",
"product": "lancet",
"repo": "https://github.com/duke-git/lancet",
"vendor": "duke-git",
"versions": [
{
"lessThanOrEqual": "2.3.9",
"status": "affected",
"version": "2.1.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/duke-git/lancet",
"product": "lancet",
"repo": "https://github.com/duke-git/lancet",
"vendor": "duke-git",
"versions": [
{
"lessThanOrEqual": "1.4.6",
"status": "affected",
"version": "1.3.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lancet_project:lancet:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.3.9",
"versionStartIncluding": "2.1.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lancet_project:lancet:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.4.6",
"versionStartIncluding": "1.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:50:20.046Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking",
"technical-description"
],
"url": "https://github.com/duke-git/lancet/issues/356"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/duke-git/lancet/pull/357"
},
{
"tags": [
"patch"
],
"url": "https://github.com/duke-git/lancet/commit/835111c832939a85416d686a1e99d5fe7060c9b4"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/duke-git/lancet/blob/v2.3.9/netutil/net.go#L192-L205"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/duke-git/lancet/blob/v1.4.6/netutil/net.go#L158-L170"
},
{
"tags": [
"product"
],
"url": "https://github.com/duke-git/lancet"
},
{
"name": "VulnCheck Advisory: Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lancet-through-2.3.9-ssrf-protection-bypass-via-netutil-isinternalip"
}
],
"title": "Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110240",
"datePublished": "2026-10-13T18:50:20.046Z",
"dateReserved": "2026-10-13T18:00:16.590Z",
"dateUpdated": "2026-10-13T19:24:52.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-41920 (GCVE-0-2022-41920)
Vulnerability from nvd – Published: 2022-11-17 00:00 – Updated: 2025-04-22 16:07
VLAI
EPSS
VEX
Title
Zip slip in Lancet
Summary
Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip files. This issue has been addressed and a fix will be included in versions 2.1.10 and 1.3.4. Users are advised to upgrade. There are no known workarounds for this issue.
Severity
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 15:42 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:56:38.627Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/duke-git/lancet/security/advisories/GHSA-pp3f-xrw5-q5j4"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/duke-git/lancet/issues/62"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/duke-git/lancet/commit/f133b32faa05eb93e66175d01827afa4b7094572"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/duke-git/lancet/commit/f869a0a67098e92d24ddd913e188b32404fa72c9"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41920",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:42:50.978547Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T16:07:20.445Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "lancet",
"vendor": "duke-git",
"versions": [
{
"status": "affected",
"version": "\u003c 1.3.4"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.1.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip files. This issue has been addressed and a fix will be included in versions 2.1.10 and 1.3.4. Users are advised to upgrade. There are no known workarounds for this issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-17T00:00:00.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/duke-git/lancet/security/advisories/GHSA-pp3f-xrw5-q5j4"
},
{
"url": "https://github.com/duke-git/lancet/issues/62"
},
{
"url": "https://github.com/duke-git/lancet/commit/f133b32faa05eb93e66175d01827afa4b7094572"
},
{
"url": "https://github.com/duke-git/lancet/commit/f869a0a67098e92d24ddd913e188b32404fa72c9"
}
],
"source": {
"advisory": "GHSA-pp3f-xrw5-q5j4",
"discovery": "UNKNOWN"
},
"title": "Zip slip in Lancet"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-41920",
"datePublished": "2022-11-17T00:00:00.000Z",
"dateReserved": "2022-09-30T00:00:00.000Z",
"dateUpdated": "2025-04-22T16:07:20.445Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-110240 (GCVE-0-2026-110240)
Vulnerability from cvelistv5 – Published: 2026-10-13 18:50 – Updated: 2026-10-13 19:24
VLAI
EPSS
VEX
Title
Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP
Summary
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints.
Severity
4.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 19:24 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/duke-git/lancet/issues/356 | issue-trackingtechnical-description |
| https://github.com/duke-git/lancet/pull/357 | patchissue-tracking |
| https://github.com/duke-git/lancet/commit/835111c… | patch |
| https://github.com/duke-git/lancet/blob/v2.3.9/ne… | technical-description |
| https://github.com/duke-git/lancet/blob/v1.4.6/ne… | technical-description |
| https://github.com/duke-git/lancet | product |
| https://www.vulncheck.com/advisories/lancet-throu… | third-party-advisory |
Impacted products
Date Public
2026-09-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110240",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T19:24:08.615533Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:24:52.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/duke-git/lancet/issues/356"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/duke-git/lancet/v2",
"product": "lancet",
"repo": "https://github.com/duke-git/lancet",
"vendor": "duke-git",
"versions": [
{
"lessThanOrEqual": "2.3.9",
"status": "affected",
"version": "2.1.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/duke-git/lancet",
"product": "lancet",
"repo": "https://github.com/duke-git/lancet",
"vendor": "duke-git",
"versions": [
{
"lessThanOrEqual": "1.4.6",
"status": "affected",
"version": "1.3.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lancet_project:lancet:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.3.9",
"versionStartIncluding": "2.1.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lancet_project:lancet:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.4.6",
"versionStartIncluding": "1.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:50:20.046Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking",
"technical-description"
],
"url": "https://github.com/duke-git/lancet/issues/356"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/duke-git/lancet/pull/357"
},
{
"tags": [
"patch"
],
"url": "https://github.com/duke-git/lancet/commit/835111c832939a85416d686a1e99d5fe7060c9b4"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/duke-git/lancet/blob/v2.3.9/netutil/net.go#L192-L205"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/duke-git/lancet/blob/v1.4.6/netutil/net.go#L158-L170"
},
{
"tags": [
"product"
],
"url": "https://github.com/duke-git/lancet"
},
{
"name": "VulnCheck Advisory: Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lancet-through-2.3.9-ssrf-protection-bypass-via-netutil-isinternalip"
}
],
"title": "Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110240",
"datePublished": "2026-10-13T18:50:20.046Z",
"dateReserved": "2026-10-13T18:00:16.590Z",
"dateUpdated": "2026-10-13T19:24:52.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-41920 (GCVE-0-2022-41920)
Vulnerability from cvelistv5 – Published: 2022-11-17 00:00 – Updated: 2025-04-22 16:07
VLAI
EPSS
VEX
Title
Zip slip in Lancet
Summary
Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip files. This issue has been addressed and a fix will be included in versions 2.1.10 and 1.3.4. Users are advised to upgrade. There are no known workarounds for this issue.
Severity
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 15:42 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:56:38.627Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/duke-git/lancet/security/advisories/GHSA-pp3f-xrw5-q5j4"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/duke-git/lancet/issues/62"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/duke-git/lancet/commit/f133b32faa05eb93e66175d01827afa4b7094572"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/duke-git/lancet/commit/f869a0a67098e92d24ddd913e188b32404fa72c9"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41920",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:42:50.978547Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T16:07:20.445Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "lancet",
"vendor": "duke-git",
"versions": [
{
"status": "affected",
"version": "\u003c 1.3.4"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.1.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip files. This issue has been addressed and a fix will be included in versions 2.1.10 and 1.3.4. Users are advised to upgrade. There are no known workarounds for this issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-17T00:00:00.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/duke-git/lancet/security/advisories/GHSA-pp3f-xrw5-q5j4"
},
{
"url": "https://github.com/duke-git/lancet/issues/62"
},
{
"url": "https://github.com/duke-git/lancet/commit/f133b32faa05eb93e66175d01827afa4b7094572"
},
{
"url": "https://github.com/duke-git/lancet/commit/f869a0a67098e92d24ddd913e188b32404fa72c9"
}
],
"source": {
"advisory": "GHSA-pp3f-xrw5-q5j4",
"discovery": "UNKNOWN"
},
"title": "Zip slip in Lancet"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-41920",
"datePublished": "2022-11-17T00:00:00.000Z",
"dateReserved": "2022-09-30T00:00:00.000Z",
"dateUpdated": "2025-04-22T16:07:20.445Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}