Security advisories

Assessment date: October 7, 2026. Document version: 3.

These assessments explain how GrowSurf handles reported vulnerabilities in dashboard dependencies. Application controls can prevent a vulnerable path from running while the upstream package remains unpatched.

Download OpenVEX JSON · Security at GrowSurf

Assessment scope

Five findings conclude that the assessed dashboard snapshot is not affected. Seven additional AngularJS findings remain under investigation, as listed below. Four AngularJS findings are addressed by application controls that avoid the vulnerable paths. The reported SunEditor embed-plugin code is absent. These are scoped applicability conclusions, not upstream package patches.

This assessment identifies two dashboard bundles and the SunEditor file loaded on demand, captured from app.growsurf.com on October 7, 2026. Runtime checks used the deployed sign-in application; the SunEditor conclusion uses captured code inspection. This is not a complete vulnerability inventory or a full dashboard workflow review. It does not cover later builds, infrastructure findings, hosted landing pages, or the embedded referral widget. A package version in the source review is not proof of its version in a deployed artifact.

Snapshot identifier:

urn:sha256:b8b1e923d9f58432d23bba4f610d7eaad6ceafd22ff680714ec1c7d39a19a379

218.bca8c87820360aad7245.bundle.js
SHA-256: 3656aa3d91d7bc0e91dec8c03dde6bf020e294d267a3e2ad3c78e012b7ebfbff

main.da34bbfe756e74ddc740.bundle.js
SHA-256: e1217834abf6726c85a1f9e2e23104dc5e669a77c90225459fd3ee09d5a4b8f4

suneditor.a21bdd3c326793cc8740.chunk.js
SHA-256: 41ecfb039d7c1c36a0471d7af70f65bd3acfedca40316216850ba6112f261a3f

CVE-2023-26118: URL-input validation

Status: Not affected. Source-reviewed component: angular 1.8.3.

GrowSurf replaces AngularJS URL inputs with bounded validation using the native URL parser.

Evidence: The safe URL validator is present in the served application bundle. Local checks confirm HTTP/HTTPS-only validation and rejection of oversized values before parsing.

Verification: GrowSurf replaces AngularJS URL inputs with bounded native URL validation. Checks of the deployed sign-in application accept HTTPS, reject FTP, and reject values beyond the 500-character limit. Parsed strings in the captured artifacts contain no URL-type input templates; source and dynamic-template review found no reachable AngularJS URL-input path.

Upstream advisory (GHSA-qwqh-hm9m-p5hr)

CVE-2025-2336: SVG sanitization

Status: Not affected. Source-reviewed component: angular-sanitize 1.8.3.

GrowSurf explicitly disables SVG support in the AngularJS sanitizer.

Evidence: The disabled-SVG setting is present in the served application bundle. The local configuration check passed.

Verification: GrowSurf disables SVG support in the AngularJS sanitizer. The captured main bundle contains the setting. The deployed sign-in application sanitizer removes SVG and image elements from the representative SVG input.

Upstream advisory (GHSA-4p4w-6hg8-63wx)

CVE-2024-21490: Image source-set processing

Status: Not affected. Source-reviewed component: angular 1.8.3.

GrowSurf source checks prohibit srcset bindings in application-owned templates, scripts, and localization.

Evidence: The source check passed, and the dependency-template and dynamic-compilation review found no affected binding.

Verification: The captured main bundle contains no srcset references. Parsed template strings in the captured artifacts contain no image or source srcset bindings. Source and dynamic-compilation review found no reachable affected binding. The deployed sign-in application sanitizer removes srcset attributes.

Upstream advisory (GHSA-4w4v-5hc9-xrr2)

CVE-2026-11998: Trusted resource URLs

Status: Not affected. Source-reviewed component: angular 1.8.3.

GrowSurf configures a self-only trusted resource URL policy, avoiding custom regular-expression matchers.

Evidence: The self-only policy is present in the served application bundle. Local checks confirm the application policy and enabled-SCE source contract.

Verification: GrowSurf keeps SCE enabled with a self-only trusted resource URL policy. The captured main bundle contains that policy. Checks of the deployed sign-in application allow a same-origin resource and reject external origins, a lookalike host, and an origin embedded in a query string. Reviewed explicit trust calls use developer-controlled resource URLs.

Upstream advisory (GHSA-7x27-g8rg-x87w)

GHSA-w93q-cq9w-58p7: Editor embed plugin

Status: Not affected. Source-reviewed component: suneditor 2.47.12.

GrowSurf maintains a pinned SunEditor 2.x version. The internal source assessment identifies the reported embed-plugin defect as a 3.x path absent from that version.

Evidence: The captured SunEditor file has been inspected for the reported plugin and script-creation path.

Verification: The captured SunEditor lazy-loaded chunk has no reported 3.x embed plugin. Its video setup_url path reads an iframe URL and creates an iframe or video element. AST inspection found no literal script-element creation in that chunk. The source dependency is pinned to SunEditor 2.47.12; this conclusion is based on captured code, not a version string or an editor interaction.

Upstream advisory (GHSA-w93q-cq9w-58p7)

Findings under investigation

These seven findings do not have a verified mitigation for every affected path. The five conclusions above do not clear them. The OpenVEX document lists each as under_investigation.

CVE-2022-25869: Internet Explorer textarea page caching

Browser applicability and mitigation have not been verified. Upstream advisory (GHSA-prc3-vjfx-vhm9)

CVE-2025-0716: SVG image attributes

The disabled-SVG sanitizer setting does not establish protection for every AngularJS compilation path. Upstream advisory (GHSA-j58c-ww9w-pwp5)

CVE-2022-25844: Locale number formatting

No application-owned locale override was found; the affected runtime boundary has not been verified. Upstream advisory (GHSA-m2h2-264f-f486)

CVE-2024-8372: Image srcset restrictions

Source checks prohibit srcset; advisory-specific runtime proof is pending. Upstream advisory (GHSA-m9gf-397r-hwpg)

CVE-2024-8373: Source srcset restrictions

Source checks prohibit srcset; advisory-specific runtime proof is pending. Upstream advisory (GHSA-mqm9-c95h-x2p6)

CVE-2023-26116: RegExp copying

The application uses angular.copy. The vulnerable library expression remains installed; deployed exploitability has not been established. Upstream advisory (GHSA-2vrf-hf26-jrp5)

CVE-2023-26117: Resource URL processing

The application uses $resource. The vulnerable library expression remains installed; deployed exploitability has not been established. Upstream advisory (GHSA-2qqx-w9hr-q5gx)

Review and contact

Assessment owner: GrowSurf maintainers. Next review is due by December 12, 2026, or sooner after a relevant release, dependency or configuration change, new advisory, or scanner feedback. Updated assessments must revise the document version and scope.

For assessment questions, contact GrowSurf and include the advisory identifier and observed asset.

Common questions

Does this mean the dependencies are patched?

No. The AngularJS controls described here are application mitigations. They do not patch the upstream dependency or change its support lifecycle.

Will scanners automatically use this file?

Only tools that support OpenVEX and consume this document can use these statements. Publication does not guarantee discovery or acceptance. A scanner must match the assessed artifacts and accept the stated justification before using a not-affected statement.

Does this cover future releases?

No. The assessment applies only to the identified dashboard snapshot. Relevant releases, dependency changes, configuration changes, or new evidence require another review.