{"schema_version":"1","view":"events","data":[{"id":21662,"advisory_id":"7355b7f1-2d3c-47c4-b288-1e9b4cf9b683","group_id":"advisory:7355b7f1-2d3c-47c4-b288-1e9b4cf9b683","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/march-2025-ci-incident","source_published_at":"2025-04-23T16:30:00+00:00","published_at":"2026-10-25T05:48:34.651017+00:00","extraction_method":"llm","technologies":["node-js-test-ci","nodejs"],"cve_ids":[],"event_types":["other"],"payload":{"kind":"other","title":"Node.js Test CI Security Incident","summary":"A TOCTOU vulnerability allowed code from pull requests to be executed on Node.js CI hosts. The project secured and rebuilt affected infrastructure and updated CI workflows. The incident did not affect the Node.js runtime; users do not need to take action.","evidence":"The reported issue did not impact the Node.js runtime and there is no risk to users of Node.js. No action by Node.js users is required.","products":[{"name":{"value":"Node.js Test CI","evidence":"Node.js Test CI Security Incident"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/21662"}],"next_after":21662,"next_before":21662}