From 320f0a7463ad95251842ece6cd329bba7b6b2a97 Mon Sep 17 00:00:00 2001
From: Joe Boccanfuso <109477394+jbocce@users.noreply.github.com>
Date: Wed, 21 Jan 2026 13:02:40 -0500
Subject: [PATCH] fix(security): Ignore CVE-2026-23745, CVE-2026-23950 and
 CVE-2024-28863 because they are limited to build/dev environments. (#5733)

The tar vulnerabilities affect build-time tools (lerna) and transitive dependencies, but not runtime data flow from Cornerstone3D to its dependencies.
---
 .circleci/config.yml | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 6b9df3b8d..25833015f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -119,8 +119,20 @@ jobs:
             echo "🔍 Running bun audit for security vulnerabilities..."
             echo "Checking for HIGH-RISK vulnerabilities..."
 
-            # Ignore CVE-2025-64756 (aka GHSA-5j98-mcp5-4vw2) - glob is not used on the command line
-            if bun audit --ignore=GHSA-5j98-mcp5-4vw2 --audit-level high; then
+            # Define ignored vulnerabilities with comments
+            IGNORED_VULNS=(
+              "GHSA-5j98-mcp5-4vw2"  # CVE-2025-64756 - glob is not used on the command line
+              "GHSA-8qq5-rm4j-mr97"  # CVE-2026-23745 - limited to build/dev environments
+              "GHSA-r6q2-hw4h-h46w"  # CVE-2026-23950 - limited to build/dev environments
+            )
+
+            # Build ignore flags
+            IGNORE_FLAGS=""
+            for vuln in "${IGNORED_VULNS[@]}"; do
+              IGNORE_FLAGS="$IGNORE_FLAGS --ignore=$vuln"
+            done
+
+            if bun audit $IGNORE_FLAGS --audit-level high; then
               echo "✅ No high-risk vulnerabilities found"
               echo "🎉 Security audit passed!"
             else
@@ -137,8 +149,7 @@ jobs:
               echo ""
               echo "📋 Full audit report:"
 
-              # Ignore CVE-2025-64756 (aka GHSA-5j98-mcp5-4vw2) - glob is not used on the command line
-              bun audit --ignore=GHSA-5j98-mcp5-4vw2 --audit-level low || true
+              bun audit $IGNORE_FLAGS --audit-level low || true
 
               echo ""
               echo "❌ This build cannot proceed until high-risk vulnerabilities are resolved."