Security advisories

Every security advisory we publish is listed here, permanently, including any we later withdraw. Nothing is deleted — an advisory id that stops resolving looks like a cover-up rather than a correction.

There are currently no published advisories

This page has existed since before the first one. An empty list here means exactly that: none have been published. It does not mean the channel is untested or that we have not looked.

How an advisory reaches you

You do not have to watch this page.

1. Your admin panel. Every registered installation checks for advisories that apply to the versions it is actually running, and shows a banner. Critical advisories cannot be dismissed. This is the channel that matters — it puts the notice in front of the person who can patch, wherever they happen to be in the admin.
2. Direct email, to the address on your licence, for anything serious.
3. This page, which is the public, citable record.
4. The Envato item announcement, for buyers we cannot reach any other way.

Keep a working email on your accounts and keep your installation registered, or only channels 3 and 4 can reach you.

What an advisory tells you

• Severity — critical, high, medium or low.
• Affected versions, as a range. If your version is outside it, the advisory does not apply to you and your admin panel will not show it.
• The fixed version, when there is one. An advisory may be published before a fix exists, describing a mitigation instead — waiting for a release to tell you about something you could work around today would be the wrong way round.
• What to do, first, before any technical detail.
• A CVE, where one has been assigned, and credit to the reporter unless they asked otherwise.

We do not publish exploit detail while operators are still patching.

Checking programmatically

The machine-readable feed is public and needs no authentication:

# Everything, all products
curl https://mashdiv.com/api/docs/security/advisories

# Only what affects a specific product and version
curl "https://mashdiv.com/api/docs/security/advisories?product=core&version=6.6.1"

# With the full advisory text
curl "https://mashdiv.com/api/docs/security/advisories?product=core&content=1"

product accepts an Envato item id, a product slug or a docs key. Omit version and you get everything unresolved for that product — an unknown version is treated as possibly affected, never as safe.

Useful in a monitoring check:

#!/bin/sh
# Non-zero exit when an advisory applies to this install.
VERSION=$(node -p "require('./package.json').version")
COUNT=$(curl -fsS "https://mashdiv.com/api/docs/security/advisories?product=core&version=$VERSION" \
  | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).count")
[ "$COUNT" = "0" ] || { echo "$COUNT advisory(ies) apply to $VERSION"; exit 1; }

Reporting something

See Security and vulnerability disclosure for how to report a problem to us and what we commit to in return.