{
  "schema_version": "1.9.1",
  "id": "x_status-page-DRILL-CVE-2026-48710",
  "modified": "2026-10-13T13:29:06Z",
  "published": "2026-10-13T12:24:13Z",
  "upstream": [
    "CVE-2026-48710",
    "GHSA-86qp-5c8j-p5mr",
    "PYSEC-2026-161",
    "EUVD-2026-32016"
  ],
  "summary": "[DRILL] status-page 1.0.0: actively exploited CVE-2026-48710 in starlette 1.0.0",
  "details": "status-page release 1.0.0 shipped starlette 1.0.0, named in GHSA-86qp-5c8j-p5mr (https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr) and CVE-2026-48710 (https://www.cve.org/CVERecord?id=CVE-2026-48710), which CISA KEV and EUVD list as actively exploited. The advisory describes the weakness; this report refers to it by id and URL.\n\nActively exploited: listed by CISA KEV (added 2026-09-02) and by EUVD (EUVD-2026-32016). The severity rating is the one given at https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr and https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32016.\n\nstatus-page release 1.0.0 shipped the affected starlette 1.0.0; 1.0.1 ships 1.0.1. The hosted edition runs release 1.1.0, which is not among the affected releases. The impact of the weakness is as the advisory states it (https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr).",
  "affected": [
    {
      "package": {
        "ecosystem": "GIT",
        "name": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn"
      },
      "ranges": [
        {
          "type": "GIT",
          "repo": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "606ecb63982179ad2168463c4d0a5c7657f33a9c"
            }
          ]
        }
      ],
      "versions": [
        "v1.0.0"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-86qp-5c8j-p5mr"
    },
    {
      "type": "ADVISORY",
      "url": "https://osv.dev/vulnerability/PYSEC-2026-161"
    },
    {
      "type": "ADVISORY",
      "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32016"
    },
    {
      "type": "REPORT",
      "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/issues/37"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/releases/v1.0.1"
    }
  ],
  "database_specific": {
    "drill": true,
    "product": "status-page",
    "component": [
      "pkg:pypi/starlette@1.0.0"
    ],
    "affected_releases": [
      "1.0.0"
    ],
    "fixed_releases": [
      "1.0.1"
    ],
    "user_action": "Set TRUSTED_HOSTS to the host names status-page is served on (product/README.md), and upgrade to a release whose SBOM names starlette 1.0.1 or later once one is published.",
    "measures_for_users": "Upgrade to status-page 1.0.1 or later on the 1.0 line (https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/releases/v1.0.1). Until then, set TRUSTED_HOSTS to the host names the service is served on (product/README.md).",
    "aware_at": "2026-10-13T12:21:59Z",
    "incident": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/issues/37"
  }
}