[GHSA-q9cv-5mjc-7cjc] Add the missing affected package range for google-adk - #9436
Open
imran-siddique wants to merge 1 commit into
Conversation
The advisory has an empty affected array, so no google-adk version matches it and Dependabot has nothing to alert on. The range is already public in the CVE-2026-79696 record: >= 2.0.0, < 2.7.0.
github-actions
Bot
changed the base branch from
main
to
imran-siddique/advisory-improvement-9436
September 9, 2026 16:36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
Comments
This advisory has
"affected": [], so nogoogle-adkversion matches it.GET /advisories?ecosystem=pip&affects=google-adkreturns one record, GHSA-rg7c-g689-fr3x from April, and not this one. A CVSS 4.0 base 10.0 RCE published this morning currently has nothing for Dependabot to match against.The range is already public in the CVE record. CVE-2026-79696 carries
{"status": "affected", "version": "2.0.0", "lessThan": "2.7.0", "versionType": "custom"}withdefaultStatus: unaffected, and names v2.7.0 and commit a16f6da3 as the fix.On the upper bound, the CVE's prose and its structured range disagree, so it is worth saying which one I used. The description reads "versions 2.0.0 through 2.6.0"; the structured range is less than 2.7.0. 2.6.1, 2.6.2 and 2.6.3 were published between those two points (PyPI: 31 July, 4 August, 7 August 2026), and
src/google/adk/agents/config_agent_utils.pyis byte identical at v2.6.0 and v2.6.3, SHA-2569c39ecfc30ceb4d06727a55e23bcc9188e2a3f425ed682ddc2ce8442d0c1d295, 9988 bytes. The fix commit lands in v2.7.0. I have used< 2.7.0.The lower bound matches the code as well.
src/google/adk/cli/agent_test_runner.py, which imports pytest and definestest_agent_replay, first appears at v2.0.0 and is absent from every 1.x tag, which is consistent with the 1.x line being unaffected.The sibling advisory GHSA-gvpm-4jr8-mg34 (CVE-2026-79707, published 4 September) is in the same state,
"affected": []. Happy to open a second PR for it if that is useful.References:
🤖 Generated with Claude Code
https://claude.ai/code/session_01RNUAW6zjYjhbZaBGggTmLA