GHSA-47w6-gwp4-w6vc

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

Published

2026-07-24

Modified

2026-07-24

Sources

github-advisory

Summary

### Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review ### Patches No ### Workarounds No

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-47w6-gwp4-w6vc