# Security advisories

> GrowSurf dependency assessments, application mitigations, verification limits, and build-scoped OpenVEX statements for security reviewers.

- URL: https://growsurf.com/security/advisories/

---

*Assessment date: September 16, 2026. Document version: 2.*

These assessments explain how GrowSurf handles reported vulnerabilities in dashboard dependencies. Application controls can prevent a vulnerable path from running while the upstream package remains unpatched.

[Download OpenVEX JSON](/security/openvex.json) · [Security at GrowSurf](/security/)

## Assessment scope

All five statements are **not affected** for the assessed dashboard snapshot. Four AngularJS findings are addressed by application controls that avoid the vulnerable paths. The reported SunEditor embed-plugin code is absent. These are scoped applicability conclusions, not upstream package patches.

This assessment identifies the two dashboard bundles served from app.growsurf.com at 2026-09-16T13:44:34.649271+00:00. It does not cover later builds, infrastructure findings, hosted landing pages, or the embedded referral widget. A package version in the source review is not proof of its version in a deployed artifact.

Snapshot identifier:

`urn:sha256:ea96b8d853e5cf905e31b406296b1aae7b9e8ff272d5a203c99db28c258f715f`

[913.feb1e4be986168c9db18.bundle.js](https://app.growsurf.com/913.feb1e4be986168c9db18.bundle.js) SHA-256: `c5f0c0b25b0c5f33058e1eee036eac1e4eb2c711a4da2e77d665ef5577d3a938`

[main.4cb6f983797329bf9b8f.bundle.js](https://app.growsurf.com/main.4cb6f983797329bf9b8f.bundle.js) SHA-256: `b44d3d2944cb04f64b2821e989036aa12ae2ecc8d71abbe78e7df96d094a657d`

## CVE-2023-26118: URL-input validation

**Status:** Not affected. **Source-reviewed component:** angular 1.8.3.

GrowSurf replaces AngularJS URL inputs with bounded validation using the native URL parser.

**Evidence:** The safe URL validator is present in the served application bundle. Local checks confirm HTTP/HTTPS-only validation and rejection of oversized values before parsing.

**Verification:** GrowSurf replaces AngularJS URL inputs with bounded native URL validation. Deployed runtime checks accept HTTPS, reject FTP, and reject values beyond the 500-character limit. Parsed strings in both captured bundles contain no URL-type input templates; source and dynamic-template review found no reachable AngularJS URL-input path.

[Upstream advisory (GHSA-qwqh-hm9m-p5hr)](https://github.com/advisories/GHSA-qwqh-hm9m-p5hr)

## CVE-2025-2336: SVG sanitization

**Status:** Not affected. **Source-reviewed component:** angular-sanitize 1.8.3.

GrowSurf explicitly disables SVG support in the AngularJS sanitizer.

**Evidence:** The disabled-SVG setting is present in the served application bundle. The local configuration check passed.

**Verification:** GrowSurf disables SVG support in the AngularJS sanitizer. The captured bundle contains the setting, and the deployed sanitizer removes SVG and image elements from the representative SVG input.

[Upstream advisory (GHSA-4p4w-6hg8-63wx)](https://github.com/advisories/GHSA-4p4w-6hg8-63wx)

## CVE-2024-21490: Image source-set processing

**Status:** Not affected. **Source-reviewed component:** angular 1.8.3.

GrowSurf source checks prohibit srcset bindings in application-owned templates, scripts, and localization.

**Evidence:** The source check passed, and the dependency-template and dynamic-compilation review found no affected binding.

**Verification:** The captured application bundle contains no srcset references. Parsed template strings in both bundles contain no image or source srcset bindings. Source, dependency-template, and dynamic-compilation review found no reachable affected binding. The deployed sanitizer removes srcset attributes.

[Upstream advisory (GHSA-4w4v-5hc9-xrr2)](https://github.com/advisories/GHSA-4w4v-5hc9-xrr2)

## CVE-2026-11998: Trusted resource URLs

**Status:** Not affected. **Source-reviewed component:** angular 1.8.3.

GrowSurf configures a self-only trusted resource URL policy, avoiding custom regular-expression matchers.

**Evidence:** The self-only policy is present in the served application bundle. Local checks confirm the application policy and enabled-SCE source contract.

**Verification:** GrowSurf keeps SCE enabled with a self-only trusted resource URL policy. The captured bundle contains that policy. Deployed runtime checks allow a same-origin resource and reject external origins, a lookalike host, and an origin embedded in a query string. Reviewed explicit trust calls use developer-controlled resource URLs.

[Upstream advisory (GHSA-7x27-g8rg-x87w)](https://github.com/advisories/GHSA-7x27-g8rg-x87w)

## GHSA-w93q-cq9w-58p7: Editor embed plugin

**Status:** Not affected. **Source-reviewed component:** suneditor 2.47.12.

GrowSurf maintains a pinned SunEditor 2.x version. The internal source assessment identifies the reported embed-plugin defect as a 3.x path absent from that version.

**Evidence:** The captured vendor module has been inspected for the reported plugin and script-creation path.

**Verification:** The shipped SunEditor module does not contain the reported 3.x embed plugin. Inspection of the captured vendor module confirms the video setup\_url path uses an iframe and contains no script-element creation. The source dependency is pinned to SunEditor 2.47.12; this conclusion is based on the captured code path, not a version string in the bundle.

[Upstream advisory (GHSA-w93q-cq9w-58p7)](https://github.com/advisories/GHSA-w93q-cq9w-58p7)

## Review and contact

Assessment owner: GrowSurf maintainers. Next review is due by December 12, 2026, or sooner after a relevant release, dependency or configuration change, new advisory, or scanner feedback. Updated assessments must revise the document version and scope.

For assessment questions, [contact GrowSurf](/contact-us/) and include the advisory identifier and observed asset.

## Common questions

### Does this mean the dependencies are patched?

No. The AngularJS controls described here are application mitigations. They do not patch the upstream dependency or change its support lifecycle.

### Will scanners automatically use this file?

Only tools that support OpenVEX and consume this document can use these statements. Publication does not guarantee discovery or acceptance. A scanner must match the assessed artifacts and accept the stated justification before using a not-affected statement.

### Does this cover future releases?

No. The assessment applies only to the identified dashboard snapshot. Relevant releases, dependency changes, configuration changes, or new evidence require another review.

## Built for lean teams, scaled for category leaders

Successfully submitted!

Error! Please try again