Skip to content

Conversation

@quexten
Copy link
Contributor

@quexten quexten commented Nov 19, 2025

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-27230
https://bitwarden.atlassian.net/browse/PM-27313

📔 Objective

📸 Screenshots

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

@github-actions
Copy link
Contributor

github-actions bot commented Nov 19, 2025

Logo
Checkmarx One – Scan Summary & Details6cc6b39b-7529-401f-9dbe-28377aa04269

New Issues (7)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
HIGH CVE-2025-12727 Npm-electron-37.7.0
detailsDescription: Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: l0qiJJwYeJAHLpclYsbw0HNLdvdXKYwY49iqNWZ1aUY%3D
Vulnerable Package
HIGH CVE-2025-12907 Npm-electron-37.7.0
detailsDescription: Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: B7dENPl6SuusPCliya2yRPz67ivmq%2BHrZ%2FdeMd8wQ30%3D
Vulnerable Package
MEDIUM CVE-2025-11215 Npm-electron-37.7.0
detailsDescription: Off-by-one Error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an Out-of-bounds Memory Read via a crafted HTML...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: logkv%2Bglx6w7sOH5MVhaeqhxa%2B1q7YLlLHb2VYzsVn0%3D
Vulnerable Package
MEDIUM CVE-2025-11216 Npm-electron-37.7.0
detailsRecommended version: 39.2.0
Description: Inappropriate implementation in Storage in Google Chrome on Mac prior to 141.0.7390.54 allowed a remote attacker to perform domain spoofing via a c...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 4x8yCRXdKHAgFyZZxBeDDZiVhyv30BbUUFSVm%2FI7Mk8%3D
Vulnerable Package
MEDIUM CVE-2025-12728 Npm-electron-37.7.0
detailsDescription: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engag...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: MXBjqSdzIeqyIaWxdgUryC%2BHH97Je4LiADs%2FuAjsGRI%3D
Vulnerable Package
MEDIUM CVE-2025-12729 Npm-electron-37.7.0
detailsDescription: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engag...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: fWQxNojrvI6TOS3o%2FnKY7c39D%2B1c9nAjkweKacF5BlM%3D
Vulnerable Package
LOW CVE-2025-11219 Npm-electron-37.7.0
detailsRecommended version: 39.2.0
Description: Use After Free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform Out-of-bounds Memory Access via a cra...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: AzQVd78GoggxBuw6DIlwbDgPpgc5Nx90Jr78QWzKIr0%3D
Vulnerable Package

@quexten quexten changed the title Update account init and save signed public key [PM-27230] Resolve sdk breaking changes; update account init and save signed public key Nov 20, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants