Security advisories

Assessment date: September 16, 2026. Document version: 2.

These assessments explain how GrowSurf handles reported vulnerabilities in dashboard dependencies. Application controls can prevent a vulnerable path from running while the upstream package remains unpatched.

Download OpenVEX JSON · Security at GrowSurf

Assessment scope

All five statements are not affected for the assessed dashboard snapshot. Four AngularJS findings are addressed by application controls that avoid the vulnerable paths. The reported SunEditor embed-plugin code is absent. These are scoped applicability conclusions, not upstream package patches.

This assessment identifies the two dashboard bundles served from app.growsurf.com at 2026-09-16T13:44:34.649271+00:00. It does not cover later builds, infrastructure findings, hosted landing pages, or the embedded referral widget. A package version in the source review is not proof of its version in a deployed artifact.

Snapshot identifier:

urn:sha256:ea96b8d853e5cf905e31b406296b1aae7b9e8ff272d5a203c99db28c258f715f

913.feb1e4be986168c9db18.bundle.js
SHA-256: c5f0c0b25b0c5f33058e1eee036eac1e4eb2c711a4da2e77d665ef5577d3a938

main.4cb6f983797329bf9b8f.bundle.js
SHA-256: b44d3d2944cb04f64b2821e989036aa12ae2ecc8d71abbe78e7df96d094a657d

CVE-2023-26118: URL-input validation

Status: Not affected. Source-reviewed component: angular 1.8.3.

GrowSurf replaces AngularJS URL inputs with bounded validation using the native URL parser.

Evidence: The safe URL validator is present in the served application bundle. Local checks confirm HTTP/HTTPS-only validation and rejection of oversized values before parsing.

Verification: GrowSurf replaces AngularJS URL inputs with bounded native URL validation. Deployed runtime checks accept HTTPS, reject FTP, and reject values beyond the 500-character limit. Parsed strings in both captured bundles contain no URL-type input templates; source and dynamic-template review found no reachable AngularJS URL-input path.

Upstream advisory (GHSA-qwqh-hm9m-p5hr)

CVE-2025-2336: SVG sanitization

Status: Not affected. Source-reviewed component: angular-sanitize 1.8.3.

GrowSurf explicitly disables SVG support in the AngularJS sanitizer.

Evidence: The disabled-SVG setting is present in the served application bundle. The local configuration check passed.

Verification: GrowSurf disables SVG support in the AngularJS sanitizer. The captured bundle contains the setting, and the deployed sanitizer removes SVG and image elements from the representative SVG input.

Upstream advisory (GHSA-4p4w-6hg8-63wx)

CVE-2024-21490: Image source-set processing

Status: Not affected. Source-reviewed component: angular 1.8.3.

GrowSurf source checks prohibit srcset bindings in application-owned templates, scripts, and localization.

Evidence: The source check passed, and the dependency-template and dynamic-compilation review found no affected binding.

Verification: The captured application bundle contains no srcset references. Parsed template strings in both bundles contain no image or source srcset bindings. Source, dependency-template, and dynamic-compilation review found no reachable affected binding. The deployed sanitizer removes srcset attributes.

Upstream advisory (GHSA-4w4v-5hc9-xrr2)

CVE-2026-11998: Trusted resource URLs

Status: Not affected. Source-reviewed component: angular 1.8.3.

GrowSurf configures a self-only trusted resource URL policy, avoiding custom regular-expression matchers.

Evidence: The self-only policy is present in the served application bundle. Local checks confirm the application policy and enabled-SCE source contract.

Verification: GrowSurf keeps SCE enabled with a self-only trusted resource URL policy. The captured bundle contains that policy. Deployed runtime checks allow a same-origin resource and reject external origins, a lookalike host, and an origin embedded in a query string. Reviewed explicit trust calls use developer-controlled resource URLs.

Upstream advisory (GHSA-7x27-g8rg-x87w)

GHSA-w93q-cq9w-58p7: Editor embed plugin

Status: Not affected. Source-reviewed component: suneditor 2.47.12.

GrowSurf maintains a pinned SunEditor 2.x version. The internal source assessment identifies the reported embed-plugin defect as a 3.x path absent from that version.

Evidence: The captured vendor module has been inspected for the reported plugin and script-creation path.

Verification: The shipped SunEditor module does not contain the reported 3.x embed plugin. Inspection of the captured vendor module confirms the video setup_url path uses an iframe and contains no script-element creation. The source dependency is pinned to SunEditor 2.47.12; this conclusion is based on the captured code path, not a version string in the bundle.

Upstream advisory (GHSA-w93q-cq9w-58p7)

Review and contact

Assessment owner: GrowSurf maintainers. Next review is due by December 12, 2026, or sooner after a relevant release, dependency or configuration change, new advisory, or scanner feedback. Updated assessments must revise the document version and scope.

For assessment questions, contact GrowSurf and include the advisory identifier and observed asset.

Common questions

Does this mean the dependencies are patched?

No. The AngularJS controls described here are application mitigations. They do not patch the upstream dependency or change its support lifecycle.

Will scanners automatically use this file?

Only tools that support OpenVEX and consume this document can use these statements. Publication does not guarantee discovery or acceptance. A scanner must match the assessed artifacts and accept the stated justification before using a not-affected statement.

Does this cover future releases?

No. The assessment applies only to the identified dashboard snapshot. Relevant releases, dependency changes, configuration changes, or new evidence require another review.