{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://broka.dev/security/vex/BROKA-SA-2026-004.json",
  "author": "Orchesta Labs",
  "role": "Software vendor",
  "timestamp": "2026-10-24T00:00:00Z",
  "last_updated": "2026-10-24T00:00:00Z",
  "version": 1,
  "tooling": "broka-site scripts/build-docs.mjs",
  "statements": [
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-77214"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3A970d84988be550d17af596a4eb1105d2bffdf6608c7b9a6c73c689fc4786c34b?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad66b43fe284880c1d59d24e882b4f391e358bd52bc0b9a6e8a866ed03ba92041?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aa8e301bffcab66b1dd3e567169c7dd5c54d9bdc30add4e3d84dcc4067d84f077?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Af59c21921345c683cd05416e17da0618edeb11865be8c08ab81947c91f88ab6a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad980ebd5c787cf16034aefe20189b72c75c3dd95f1aa809710e52ea409fe6fba?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3A6b63822397b09a54a9faa2206a752376e3e13d473d04fc6122ffda9f315db73d?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Abe312eed32f7253d798313c8b066e5f9428f500b98212e0363f260a214cf4c27?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ab6e4e89fa981b16f9d14746faa2875ec9772ed6bed7e4282092be1ce5b830179?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.8.5-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "libexpat is in the console image only as a dependency of fontconfig, which serves nginx's image-filter module (ngx_http_image_filter_module) through libgd. BROKA's nginx configuration loads no dynamic module (no load_module), so nothing in the running console ever calls libexpat; nginx itself parses no XML."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-88806"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3A970d84988be550d17af596a4eb1105d2bffdf6608c7b9a6c73c689fc4786c34b?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad66b43fe284880c1d59d24e882b4f391e358bd52bc0b9a6e8a866ed03ba92041?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aa8e301bffcab66b1dd3e567169c7dd5c54d9bdc30add4e3d84dcc4067d84f077?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Af59c21921345c683cd05416e17da0618edeb11865be8c08ab81947c91f88ab6a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad980ebd5c787cf16034aefe20189b72c75c3dd95f1aa809710e52ea409fe6fba?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3A6b63822397b09a54a9faa2206a752376e3e13d473d04fc6122ffda9f315db73d?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Abe312eed32f7253d798313c8b066e5f9428f500b98212e0363f260a214cf4c27?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ab6e4e89fa981b16f9d14746faa2875ec9772ed6bed7e4282092be1ce5b830179?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.13-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "libX11 is in the console image only as a dependency of libXpm, libXext and libXt, which serves nginx's image-filter module (ngx_http_image_filter_module) through libgd. BROKA's nginx configuration loads no dynamic module (no load_module), so nothing in the running console ever calls libX11; nginx itself parses no X protocol. The flaw also needs a malicious X server to connect to, and the console never opens an X display."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-77214"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3A33dca04650e959bad03b19d576e9ac948b497feaf3540a7757c28ae0b5dc5b03?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-88806"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3A33dca04650e959bad03b19d576e9ac948b497feaf3540a7757c28ae0b5dc5b03?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.14-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/libx11@1.8.14-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "fixed"
    }
  ]
}