v2.45.2 vulnerabilities
Open
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 431
- Forks
- 179
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 71
Description
Describe the bug
CVE scanner found HIGH vulnerabilities.
To Reproduce
Pull the latest image temporalio/ui:2.45.2 from Dockerhub
Scan the image with any vulnerability scanner
I've used trivy.
14:18:00 $ trivy --version
Version: 0.69.1
Vulnerability DB:
Version: 2
UpdatedAt: 2026-02-10 18:45:00.479326566 +0000 UTC
NextUpdate: 2026-02-11 18:45:00.479326385 +0000 UTC
DownloadedAt: 2026-02-10 21:53:53.003757 +0000 UTC
14:20:58 $ trivy image temporalio/ui:2.45.2
| CVE | Severity | Package | Installed Version | Fixed Version |
|---|---|---|---|---|
| CVE-2025-61726 | HIGH | stdlib (Go) | v1.24.11 | 1.24.12, 1.25.6 |
| CVE-2025-61728 | HIGH | stdlib (Go) | v1.24.11 | 1.24.12, 1.25.6 |
| CVE-2025-61730 | HIGH | stdlib (Go) | v1.24.11 | 1.24.12, 1.25.6 |
| CVE-2025-68121 | HIGH | stdlib (Go) | v1.24.11 | 1.24.13, 1.25.7 |
| CVE-2025-22869 | HIGH | golang.org/x/crypto | v0.32.0 | 0.35.0 |
Desktop (please complete the following information):*
- OS
14:24:17 $ uname -a
Darwin KHM9DWW9MT 24.6.0 Darwin Kernel Version 24.6.0: Wed Oct 15 21:12:05 PDT 2025; root:xnu-11417.140.69.703.14~1/RELEASE_ARM64_T6030 arm64
Additional context
Thank you; I've just encountered this in a CVE scanner.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by pulling temporalio/ui:2.45.2 and reproducing the Trivy scan shown in the issue. Trace how the image's Go standard library and golang.org/x/crypto versions are selected, then verify that a replacement image no longer reports the listed high-severity CVEs with fixed versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100