{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_base","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"Release announcement for ndaal SARIF Viewer (sarif-viewer) 1.2.18. The release fixes an open redirect in the language switcher (CWE-601, advisory ndaal-sa-2026-1104, CVSS v3.1 4.7 and v4.0 2.1 for versions 1.1.16 and 1.2.17). This announcement records the release and carries no score of its own: CVSS 0.0 (NONE)."},{"category":"description","text":"sarif-viewer 1.2.18 fixes an open redirect in the language switcher (/lang/{code}). A backslash in the Referer path made the redirect target start with a backslash, which browsers read as a protocol-relative URL to another host. The switcher now falls back to / for such a referer. The vulnerable versions are 1.1.16 and 1.2.17; details and workaround are in ndaal-sa-2026-1104. The release also bumps sha3 to 0.12, lo_core and lo_writer to 0.5 and jsonschema to 0.60; each is recorded as an informational advisory (ndaal-sa-2026-1100 to 1103)."},{"category":"details","text":"Reused from CHANGELOG.md (v1.2.18): (1) [Security] **Open redirect in the language switcher.** `routes::lang::return_path` built the post-switch redirect from the `Referer` path. `http::Uri` accepts a backslash, so a `Referer` of `https://attacker.example/\\evil.example` gave the location `/\\evil.example`, which browsers read as `//evil.example`. A backslash anywhere in the path now falls back to `/`. Found by the new property test `return_path_never_leaves_this_origin` (`tests/proptest_boundaries.rs`), which also covers `parse_query` and the sidecar digests. Advisory: ndaal-sa-2026-1104 (CWE-601, CVSS v3.1 4.7, v4.0 2.1; affects 1.1.16 and 1.2.17, fixed in 1.2.18). (2) [Changed] **`sha3` 0.11 -> 0.12 (breaking).** 0.12 moved the SHAKE types into the new `shake` crate, so `Shake256` is now imported from `shake` 0.1 (which pulls in `sponge-cursor`). The `.shake256-512` and `.sha3-512` sidecar digests are unchanged; the FIPS-202 known-answer tests still pass. (3) [Changed] **`lo_core` / `lo_writer` 0.4 -> 0.5 (breaking).** No source change was needed: the Markdown, ODT and PDF export tests pass unchanged. The release adds 13 transitive crates (`image`, `image-webp`, `moxcms`, `fontdb`, `fontconfig-parser`, `memmap2`, `subsetter` and others) and moves `lo_math`, `lo_odf` and `lo_zip` to 0.5. (4) [Changed] **`jsonschema` 0.48 -> 0.60 (breaking).** No source change was needed: the `resolve-file` feature and the `validator_for` / `Validator` API we use are unchanged, and the SARIF validation tests pass. `jsonschema-regex`, `jsonschema-value`, `referencing`, `fancy-regex` and `fraction` move with it. (5) [Added] **Boundary property tests** (`tests/proptest_boundaries.rs`): the redirect target of the language switcher stays on this origin, `parse_query` round-trips a percent-encoded value and never panics, and every checksum sidecar holds the digest an independent hash crate computes. (6) [Added] `tests/proptest_state_machine_store.rs`: a `proptest-state-machine` test of `SarifStore`. A model of ids in insertion order is driven in lock-step with the real store over 256 random sequences of up to 39 inserts, unique inserts, removes and gets; ids come from a tiny alphabet so collisions are constant. Two injected bugs (an insert that keeps duplicates, a unique-id search that skips `-2`) each fail it. New dev-dependency `proptest-state-machine` 0.9. (7) [Added] Fuzz target `fuzz_return_path` for the language switcher's redirect target. (8) [Added] **Five CSAF advisories.** `ndaal-sa-2026-1104` is the security advisory for the open redirect above. `ndaal-sa-2026-1100` (`sha3`), `1101` (`lo_writer`), `1102` (`lo_core`) and `1103` (`jsonschema`) are informational advisories (CVSS 0.0) for the breaking bumps, generated by `csaf/generate_dependency_bumps_1100_1103.py`; 1104 by `csaf/generate_advisory_1104.py`."},{"category":"general","text":"Recommended action: upgrade to sarif-viewer 1.2.18 to receive the open-redirect fix. Operators tracking the ndaal advisory feed may ingest this document as the canonical record of the sarif-viewer 1.2.18 release. Prebuilt binaries for Linux, Windows and macOS (x86_64 and aarch64) are attached to the GitLab release, and the crate is published on crates.io (cargo binstall sarif-viewer). The full change list is published in CHANGELOG.md in the repository."},{"category":"other","text":"CVSS applicability: this is a release announcement and carries no security impact itself, scored CVSS v3.1 0.0 (NONE) and CVSS v4.0 0.0 (NONE) with all impact metrics set to NONE. The score is intentionally zero to signal 'informational, no vulnerability' while still carrying a machine-readable metric; the real scores of the open redirect are in ndaal-sa-2026-1104. Status: final."},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/1105/ndaal-sa-2026-1105.json"},{"category":"external","summary":"CHANGELOG 1.2.18","url":"https://gitlab.com/vPierre/ndaal_public_sarif_viewer/-/raw/main/CHANGELOG.md"},{"category":"external","summary":"GitLab release v1.2.18 with prebuilt binaries and checksums","url":"https://gitlab.com/vPierre/ndaal_public_sarif_viewer/-/releases/v1.2.18"},{"category":"external","summary":"sarif-viewer 1.2.18 on crates.io","url":"https://crates.io/crates/sarif-viewer/1.2.18"},{"category":"external","summary":"ndaal_public_sarif_viewer repository","url":"https://gitlab.com/vPierre/ndaal_public_sarif_viewer"},{"category":"external","summary":"ndaal-sa-2026-1104: open redirect in the language switcher (CWE-601)","url":"https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/1104/ndaal-sa-2026-1104.json"},{"category":"external","summary":"CSAF 2.1 specification (OASIS)","url":"https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html"},{"category":"external","summary":"CVSS v4.0 specification (FIRST)","url":"https://www.first.org/cvss/v4-0/specification-document"}],"title":"ndaal SARIF Viewer (sarif-viewer) 1.2.18 — release announcement (informational, no security impact, CVSS 0.0)","tracking":{"current_release_date":"2026-10-26T17:37:04.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-1105","initial_release_date":"2026-10-26T13:33:29.000Z","revision_history":[{"date":"2026-10-26T13:33:29.000Z","number":"1.0.0","summary":"Initial release announcement for sarif-viewer 1.2.18. Informational, no security impact, CVSS v3.1 0.0 / v4.0 0.0 (NONE). Status: final."},{"date":"2026-10-26T17:37:04.000Z","number":"1.0.1","summary":"Corrected the references: removed the RustSec RUSTSEC-2026-0386 entry, which belongs to the 1.2.17 release and was copied into this announcement by mistake. No other content changed."}],"status":"final","version":"1.0.1"},"x_extensions":[{"$schema":"https://ndaal.eu/.well-known/csaf/extensions/dashboard-branding_1.0.0.json","category":"informational","content":{"dashboard_short_name":"ndaal","publisher_brand":"ndaal Advisories Database"},"critical":false}]},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"1.2.18","product":{"name":"ndaal SARIF Viewer (sarif-viewer) 1.2.18 — release announcement, no security impact.","product_id":"CSAFPID-0001","product_identification_helper":{"purls":["pkg:cargo/sarif-viewer@1.2.18"]}}}],"category":"product_name","name":"sarif-viewer"}],"category":"vendor","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG"}]},"vulnerabilities":[{"flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001"]}],"ids":[{"system_name":"ndaal Advisory ID","text":"ndaal-sa-2026-1105"}],"metrics":[{"content":{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":0.0,"baseSeverity":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"cvss_v4":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":0.0,"baseSeverity":"NONE","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"notes":[{"category":"description","text":"Release announcement for sarif-viewer 1.2.18. This announcement carries a CVSS 0.0 (NONE) score so the release is represented with a machine-readable, zero-impact metric in the CSAF feed; the open redirect it fixes is scored in ndaal-sa-2026-1104."},{"category":"details","text":"Highlights: an open-redirect fix in the language switcher (ndaal-sa-2026-1104, CWE-601); three breaking dependency bumps (sha3 0.12, lo_core and lo_writer 0.5, jsonschema 0.60) recorded as ndaal-sa-2026-1100 to 1103; CHANGELOG.md has the full list."}],"product_status":{"known_not_affected":["CSAFPID-0001"]},"threats":[{"category":"impact","details":"None. Informational release announcement with no security impact (CVSS v3.1 0.0 / v4.0 0.0, NONE).","product_ids":["CSAFPID-0001"]}],"title":"sarif-viewer 1.2.18 release — informational, no security impact (CVSS 0.0)"}]}