Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
langfuse-worker may run unauthorized code
published 28 days ago
Summary
The langfuse-worker package includes an outdated version of the source-map-js library that could let an attacker run code they shouldn't be able to. This could lead to data exposure or service disruption. Update the package to a newer version that contains the corrected library or apply the vendor's recommended fix.
What to do
- Update cleanstart langfuse-worker to version 3.225.9-r5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | langfuse-worker |
< 3.225.9-r5 Fix: upgrade to 3.225.9-r5
|
Original advisory text
source-map-js through 1
Security vulnerability affects the langfuse-worker package. source-map-js through 1.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published8 Oct 2026
Updated8 Oct 2026
First seen8 Oct 2026
Sources
CLEANSTART-2026-VU21760 · OSV
Track software like this
Free during beta