{ "@context": "https://openvex.dev/ns/v0.2.0", "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "author": "daisy/embodied-ai", "role": "Project maintainer", "statements": [ { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2025-69720/libncursesw6/1", "impact_statement": "CVE-2025-69720 affects the ncurses infocmp command when parsing crafted terminfo strings. Embodied AI services never invoke infocmp, do not ingest terminfo databases, and expose no request-selected process execution. Trivy's source-package mapping includes libncursesw6, but the affected command path is absent from these exact service images. Reassess if terminal tooling, terminfo input, image digest, package version, architecture, execution path, or threat model changes.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"ncurses infocmp command-line analyzer\",\"cve\":\"CVE-2025-69720\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"libncursesw6\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2025-69720\",\"version\":\"6.5+20250216-2\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "name": "CVE-2025-69720" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2025-69720/libtinfo6/1", "impact_statement": "CVE-2025-69720 affects the ncurses infocmp command when parsing crafted terminfo strings. Embodied AI services never invoke infocmp, do not ingest terminfo databases, and expose no request-selected process execution. Trivy's source-package mapping includes libtinfo6, but the affected command path is absent from these exact service images. Reassess if terminal tooling, terminfo input, image digest, package version, architecture, execution path, or threat model changes.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"ncurses infocmp command-line analyzer\",\"cve\":\"CVE-2025-69720\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"libtinfo6\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2025-69720\",\"version\":\"6.5+20250216-2\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "name": "CVE-2025-69720" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2025-69720/ncurses-base/1", "impact_statement": "CVE-2025-69720 affects the ncurses infocmp command when parsing crafted terminfo strings. Embodied AI services never invoke infocmp, do not ingest terminfo databases, and expose no request-selected process execution. Trivy's source-package mapping includes ncurses-base, but the affected command path is absent from these exact service images. Reassess if terminal tooling, terminfo input, image digest, package version, architecture, execution path, or threat model changes.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"ncurses infocmp command-line analyzer\",\"cve\":\"CVE-2025-69720\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"ncurses-base\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2025-69720\",\"version\":\"6.5+20250216-2\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "name": "CVE-2025-69720" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2025-69720/ncurses-bin/1", "impact_statement": "CVE-2025-69720 affects the ncurses infocmp command when parsing crafted terminfo strings. Embodied AI services never invoke infocmp, do not ingest terminfo databases, and expose no request-selected process execution. Trivy's source-package mapping includes ncurses-bin, but the affected command path is absent from these exact service images. Reassess if terminal tooling, terminfo input, image digest, package version, architecture, execution path, or threat model changes.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"ncurses infocmp command-line analyzer\",\"cve\":\"CVE-2025-69720\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"ncurses-bin\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2025-69720\",\"version\":\"6.5+20250216-2\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2025-69720", "name": "CVE-2025-69720" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2026-11822/libsqlite3-0/1", "impact_statement": "CVE-2026-11822 corrupts process memory when SQLite opens a crafted database containing malformed FTS5 page data and an FTS5 MATCH query runs against it. Embodied AI services create and open only self-generated SQLite databases (nonce replay, observability, identity, and learning stores) populated from authenticated service traffic; the source audit finds no FTS5 virtual table, FTS5 MATCH query, or attacker-supplied database file anywhere in the runtime. The affected parser therefore cannot receive attacker-controlled input in these exact images. Reassess on any image digest, package version, architecture, database-source change, or threat-model change.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"Debian libsqlite3-0 FTS5 full-text-search extension\",\"cve\":\"CVE-2026-11822\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"libsqlite3-0\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2026-11822\",\"version\":\"3.46.1-7+deb13u1\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822", "name": "CVE-2026-11822" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2026-11824/libsqlite3-0/1", "impact_statement": "CVE-2026-11824 corrupts process memory when SQLite opens a crafted database containing malformed FTS5 page data and an FTS5 MATCH query runs against it. Embodied AI services create and open only self-generated SQLite databases (nonce replay, observability, identity, and learning stores) populated from authenticated service traffic; the source audit finds no FTS5 virtual table, FTS5 MATCH query, or attacker-supplied database file anywhere in the runtime. The affected parser therefore cannot receive attacker-controlled input in these exact images. Reassess on any image digest, package version, architecture, database-source change, or threat-model change.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"Debian libsqlite3-0 FTS5 full-text-search extension\",\"cve\":\"CVE-2026-11824\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"libsqlite3-0\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2026-11824\",\"version\":\"3.46.1-7+deb13u1\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824", "name": "CVE-2026-11824" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2026-13221/perl-base/1", "impact_statement": "CVE-2026-13221 affects a Perl interpreter or bundled Perl module path. Production services are implemented in Python, Node.js, or Rust; source analysis finds no Perl process invocation, and request data cannot select host commands or reach Perl regex, Archive::Tar, Storable, pack/unpack, or IO::Compress APIs. Perl is an unused base-image component for these exact images. Reassess if Perl execution, archive handling, image digest, package version, architecture, execution path, or threat model changes.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"Perl interpreter regex/archive/serialization APIs\",\"cve\":\"CVE-2026-13221\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"perl-base\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2026-13221\",\"version\":\"5.40.1-6\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "name": "CVE-2026-13221" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2026-41992/gzip/1", "impact_statement": "CVE-2026-41992 requires one gzip process to decompress crafted LZW and LZH inputs in sequence. Embodied AI application code never invokes gzip, exposes no archive-upload or request-selected process execution surface, and runs with a read-only/non-root production boundary. The executable is inherited from the base image but the affected decompression path is absent from service execution. Reassess if archive ingestion, shell tooling, image digest, package version, architecture, or the threat model changes.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"GNU gzip LZH command-line decompression path\",\"cve\":\"CVE-2026-41992\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"gzip\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2026-41992\",\"version\":\"1.13-1\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-41992", "name": "CVE-2026-41992" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2026-42496/perl-base/1", "impact_statement": "CVE-2026-42496 affects a Perl interpreter or bundled Perl module path. Production services are implemented in Python, Node.js, or Rust; source analysis finds no Perl process invocation, and request data cannot select host commands or reach Perl regex, Archive::Tar, Storable, pack/unpack, or IO::Compress APIs. Perl is an unused base-image component for these exact images. Reassess if Perl execution, archive handling, image digest, package version, architecture, execution path, or threat model changes.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"Perl interpreter regex/archive/serialization APIs\",\"cve\":\"CVE-2026-42496\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"perl-base\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2026-42496\",\"version\":\"5.40.1-6\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "name": "CVE-2026-42496" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2026-42497/perl-base/1", "impact_statement": "CVE-2026-42497 affects a Perl interpreter or bundled Perl module path. Production services are implemented in Python, Node.js, or Rust; source analysis finds no Perl process invocation, and request data cannot select host commands or reach Perl regex, Archive::Tar, Storable, pack/unpack, or IO::Compress APIs. Perl is an unused base-image component for these exact images. Reassess if Perl execution, archive handling, image digest, package version, architecture, execution path, or threat model changes.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"Perl interpreter regex/archive/serialization APIs\",\"cve\":\"CVE-2026-42497\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"perl-base\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2026-42497\",\"version\":\"5.40.1-6\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "name": "CVE-2026-42497" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2026-48962/perl-base/1", "impact_statement": "CVE-2026-48962 affects a Perl interpreter or bundled Perl module path. Production services are implemented in Python, Node.js, or Rust; source analysis finds no Perl process invocation, and request data cannot select host commands or reach Perl regex, Archive::Tar, Storable, pack/unpack, or IO::Compress APIs. Perl is an unused base-image component for these exact images. Reassess if Perl execution, archive handling, image digest, package version, architecture, execution path, or threat model changes.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"Perl interpreter regex/archive/serialization APIs\",\"cve\":\"CVE-2026-48962\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"perl-base\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2026-48962\",\"version\":\"5.40.1-6\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "name": "CVE-2026-48962" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2026-54369/libacl1/1", "impact_statement": "CVE-2026-54369 requires a privileged caller to perform pathname-based ACL operations across attacker-controlled symlink components. Embodied AI service code performs no ACL operation, containers run as fixed non-root users, and no request surface selects filesystem ACL paths. The vulnerable operation is therefore not in the execution path for these exact images. Reassess if privilege, writable-path, ACL, image digest, package version, architecture, or threat-model boundaries change.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"libacl privileged pathname ACL operations\",\"cve\":\"CVE-2026-54369\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"libacl1\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2026-54369\",\"version\":\"2.3.2-2+b1\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369", "name": "CVE-2026-54369" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2026-57432/perl-base/1", "impact_statement": "CVE-2026-57432 affects a Perl interpreter or bundled Perl module path. Production services are implemented in Python, Node.js, or Rust; source analysis finds no Perl process invocation, and request data cannot select host commands or reach Perl regex, Archive::Tar, Storable, pack/unpack, or IO::Compress APIs. Perl is an unused base-image component for these exact images. Reassess if Perl execution, archive handling, image digest, package version, architecture, execution path, or threat model changes.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"Perl interpreter regex/archive/serialization APIs\",\"cve\":\"CVE-2026-57432\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"perl-base\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2026-57432\",\"version\":\"5.40.1-6\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "name": "CVE-2026-57432" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2026-57433/perl-base/1", "impact_statement": "CVE-2026-57433 affects a Perl interpreter or bundled Perl module path. Production services are implemented in Python, Node.js, or Rust; source analysis finds no Perl process invocation, and request data cannot select host commands or reach Perl regex, Archive::Tar, Storable, pack/unpack, or IO::Compress APIs. Perl is an unused base-image component for these exact images. Reassess if Perl execution, archive handling, image digest, package version, architecture, execution path, or threat model changes.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"Perl interpreter regex/archive/serialization APIs\",\"cve\":\"CVE-2026-57433\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"perl-base\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2026-57433\",\"version\":\"5.40.1-6\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "name": "CVE-2026-57433" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2026-8376/perl-base/1", "impact_statement": "CVE-2026-8376 affects a Perl interpreter or bundled Perl module path. Production services are implemented in Python, Node.js, or Rust; source analysis finds no Perl process invocation, and request data cannot select host commands or reach Perl regex, Archive::Tar, Storable, pack/unpack, or IO::Compress APIs. Perl is an unused base-image component for these exact images. Reassess if Perl execution, archive handling, image digest, package version, architecture, execution path, or threat model changes.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"Perl interpreter regex/archive/serialization APIs\",\"cve\":\"CVE-2026-8376\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"perl-base\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2026-8376\",\"version\":\"5.40.1-6\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "name": "CVE-2026-8376" } }, { "@id": "https://forge.elephanthand.com/daisy/embodied-ai/openvex/CVE-2026-9538/perl-base/1", "impact_statement": "CVE-2026-9538 affects a Perl interpreter or bundled Perl module path. Production services are implemented in Python, Node.js, or Rust; source analysis finds no Perl process invocation, and request data cannot select host commands or reach Perl regex, Archive::Tar, Storable, pack/unpack, or IO::Compress APIs. Perl is an unused base-image component for these exact images. Reassess if Perl execution, archive handling, image digest, package version, architecture, execution path, or threat model changes.", "justification": "vulnerable_code_not_in_execute_path", "products": [ { "@id": "https://forge.elephanthand.com/daisy/airplay-module@sha256:c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c", "hashes": { "sha-256": "c5dcd2ae52261c39cdfd183ef8e887d4b366b099a1c714786a4f6ce56de3839c" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-module@sha256:9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257", "hashes": { "sha-256": "9da88f030d75ea050a68552a7969c1ce14e1e57cdea116f74cab85d892383257" } }, { "@id": "https://forge.elephanthand.com/daisy/automaticity-training-module@sha256:16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f", "hashes": { "sha-256": "16014957080157df3563277741040597b943676579fcdcdf50a68df80150fc7f" } }, { "@id": "https://forge.elephanthand.com/daisy/body-mcp@sha256:79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf", "hashes": { "sha-256": "79437a466fae9fc666c7c3a64862e024d84b959d83e1846ce11d199b53c3b3bf" } }, { "@id": "https://forge.elephanthand.com/daisy/body@sha256:0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef", "hashes": { "sha-256": "0fca8b14650e097fc5f5b87cd487040ea297750a1037209a851b1c2875f60bef" } }, { "@id": "https://forge.elephanthand.com/daisy/brain@sha256:4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14", "hashes": { "sha-256": "4d8d0913956d31ad2a52850ac35037d87cf4ff5ec73fdf4fab0ee745e16d1d14" } }, { "@id": "https://forge.elephanthand.com/daisy/daisy-memory@sha256:5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3", "hashes": { "sha-256": "5a31b2f69263e6a98ca1c84035f441e0ae0817c43cfb0cabdc59db707997f1d3" } }, { "@id": "https://forge.elephanthand.com/daisy/ears-module@sha256:53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853", "hashes": { "sha-256": "53115ad2708ae04b58450e94491e6e85c743407ed73ee4f73529a5ee5942a853" } }, { "@id": "https://forge.elephanthand.com/daisy/eyes-module@sha256:d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454", "hashes": { "sha-256": "d41650de035c0c4ca6318256815845e819f3d6220b5e79543c028d5bfdc77454" } }, { "@id": "https://forge.elephanthand.com/daisy/flower-module@sha256:5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c", "hashes": { "sha-256": "5a3e88d91ed6546c01873d7c2bba5913f5d0587ff2e21cce70f7e189280f154c" } }, { "@id": "https://forge.elephanthand.com/daisy/hud-module@sha256:f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd", "hashes": { "sha-256": "f3ba13612c69b25d2757ac3c0f680167c66ff36e6a9ca69cf8def0dadcc7bcfd" } }, { "@id": "https://forge.elephanthand.com/daisy/mood-module@sha256:2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9", "hashes": { "sha-256": "2a3f81c503c7ba3b576f09f8bed0c49cf1d01411f4fc79d73c4aa9283834c1e9" } }, { "@id": "https://forge.elephanthand.com/daisy/network-presence-module@sha256:9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f", "hashes": { "sha-256": "9706a6697d3af2957b82d1b631a0bce160d73b8d9243183b42ea2d018d5f6a5f" } }, { "@id": "https://forge.elephanthand.com/daisy/pi-harness@sha256:96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6", "hashes": { "sha-256": "96695d786bf5111cc8535c884f559f01f9d85b5964244fb5ee38ce06906597f6" } }, { "@id": "https://forge.elephanthand.com/daisy/rss-module@sha256:17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0", "hashes": { "sha-256": "17facb571a2dfe9f0e838dc99e8245be3c2397f31e187d7c58cdfcc3afe111e0" } }, { "@id": "https://forge.elephanthand.com/daisy/tapo-c200-module@sha256:43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b", "hashes": { "sha-256": "43cc3ed5ef116957eae878d64595d42a5319a284573c2693c44b4bc2be5dba1b" } }, { "@id": "https://forge.elephanthand.com/daisy/voice-module@sha256:08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2", "hashes": { "sha-256": "08685da1780d92789f63a78e727641fd97d278013fce33fea3e54a2c1f9d57c2" } }, { "@id": "https://forge.elephanthand.com/daisy/weather-module@sha256:fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf", "hashes": { "sha-256": "fa6388be2d346afd88c125883733836af00399396db6e7fa590a7e38fa2552bf" } } ], "status": "not_affected", "status_notes": "Embodied-AI-Exception-Metadata: {\"architecture\":\"amd64\",\"component\":\"Perl interpreter regex/archive/serialization APIs\",\"cve\":\"CVE-2026-9538\",\"expires\":\"2026-09-30\",\"invalidation_conditions\":[\"architecture\",\"execution_path\",\"image_digest\",\"package_version\",\"threat_model\"],\"owner\":\"daisy/embodied-ai maintainer\",\"package\":\"perl-base\",\"reviewed\":\"2026-08-31\",\"upstream\":\"https://avd.aquasec.com/nvd/cve-2026-9538\",\"version\":\"5.40.1-6\"}\nReviewed 2026-08-31 for exact amd64 image digests; expires 2026-09-30. Evidence: release reachability JSON, raw Trivy reports, source command-execution audit, non-root image configuration, and app-owned Compose hardening. This statement does not claim the installed package version fixes the vulnerability.", "timestamp": "2026-08-31T00:00:00Z", "version": 1, "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-9538", "name": "CVE-2026-9538" } } ], "timestamp": "2026-08-31T00:00:00Z", "tooling": "scripts/audit_container_reachability.py and scripts/generate_container_vex.py", "version": 1 }