OpenFn / OpenFn/lightning

Update vulnerable tesla and mint

Open Beginner friendly
#4,949 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Elixir
Stars
296
Forks
86
Avg merge
1d 13h
Merged PRs (30d)
50

Description

  tesla 1.18.2 VULNERABLE!
    EEF-CVE-2026-48598 (LOW)
    aka: CVE-2026-48598, GHSA-28jh-g32x-v9v4
    CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection
    https://osv.dev/vulnerability/EEF-CVE-2026-48598

    EEF-CVE-2026-48595 (HIGH)
    aka: CVE-2026-48595, GHSA-9m9w-gxf7-rh8m
    Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects
    https://osv.dev/vulnerability/EEF-CVE-2026-48595

    EEF-CVE-2026-48597 (HIGH)
    aka: CVE-2026-48597, GHSA-h74c-q9j7-mpcm
    Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint
    https://osv.dev/vulnerability/EEF-CVE-2026-48597

    EEF-CVE-2026-48596 (LOW)
    aka: CVE-2026-48596, GHSA-q7jx-v53g-848w
    CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection
    https://osv.dev/vulnerability/EEF-CVE-2026-48596

    EEF-CVE-2026-48594 (HIGH)
    aka: CVE-2026-48594, GHSA-mc85-72gr-vm9f
    Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression
    https://osv.dev/vulnerability/EEF-CVE-2026-48594
  mint 1.9.0 VULNERABLE!
    EEF-CVE-2026-56810 (HIGH)
    aka: CVE-2026-56810, GHSA-c59h-fq4p-r36r
    mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5
    https://osv.dev/vulnerability/EEF-CVE-2026-56810

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the project's Elixir dependency declarations and lockfile entries for tesla and mint. Check the available patched versions against the listed OSV advisories, update the dependencies, and run the project's test suite or dependency checks to confirm the vulnerable versions are gone.

Written by the indexing model from the issue text.

Assessment

Tech stack
elixir
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.