Package
gitlab-rails-ce-assets-fips-19.5
Component
json
Latest update
7.2
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
CVE-2020-7712 affects the json npm package (fixed in 10.0.0, https://github.com/advisories/GHSA-3c6g-pvg8-gqw2). The file matched here, /srv/gitlab/public/assets/webpack/gitlab-web-ide-vscode-workbench-0.0.1-dev-20260106142046/vscode/extensions/json/package.json, is the manifest of VS Code's built-in JSON language extension (publisher vscode, version 1.0.0). That extension contains only language configuration and syntax grammars, and no code from the json npm package; scanners match it because the names are identical.
References: https://nvd.nist.gov/vuln/detail/CVE-2020-7712 https://github.com/advisories/GHSA-3c6g-pvg8-gqw2 https://github.com/coder/code-server/issues/6332 https://gitlab.com/gitlab-org/gitlab/-/issues/416595#note_1460681285
Status