How severe is GHSA-7ww3-xvf5-cxwm?

GHSA-7ww3-xvf5-cxwm has a CVSS score of 4.3/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by GHSA-7ww3-xvf5-cxwm?

GHSA-7ww3-xvf5-cxwm affects the following packages: ciguard (PyPI). Ecosystems affected: PyPI.

How do I fix GHSA-7ww3-xvf5-cxwm?

Update ciguard to 0.8.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7ww3-xvf5-cxwm is resolved across your whole dependency graph.

How do I detect GHSA-7ww3-xvf5-cxwm in my PyPI dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ciguard, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-7ww3-xvf5-cxwm if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-7ww3-xvf5-cxwm?

O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-7ww3-xvf5-cxwm can be triaged on real exposure rather than presence alone.

Is GHSA-7ww3-xvf5-cxwm actively exploited in the wild?

No public exploit code has been indexed for GHSA-7ww3-xvf5-cxwm yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-7ww3-xvf5-cxwm published, and has it been updated?

GHSA-7ww3-xvf5-cxwm was published on May 5, 2026 and was last updated on May 5, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐍

🐍 PyPI

Not in CISA KEV

MEDIUM severity

GHSA-7ww3-xvf5-cxwm — ciguard

MEDIUM

GHSA-7ww3-xvf5-cxwm is a medium-severity (CVSS 4.3) vulnerability in ciguard. A fix is available for ciguard — see the affected versions and patch details below.

ciguard: Web UI is missing HTTP defence-in-depth headers

Published

May 5, 2026

Updated

May 5, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of May 5, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐍ciguard

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

ciguard's FastAPI Web UI (src/ciguard/web/app.py) does not set HTTP defence-in-depth headers. OWASP ZAP baseline scan flagged 11 alerts: missing Content-Security-Policy (Medium), X-Frame-Options (Medium), Sub-Resource-Integrity on /api/docs (Medium), COOP / COEP / CORP (Low), Permissions-Policy (Low), X-Content-Type-Options (Low).

Threat scenario

For local-only deployment (current intent): minimal — there's no untrusted browser context, no third-party hosting, no auth surface to protect.

For public hosting (PRD Slice 9 GitHub App or hosted dashboard, future): each missing header reduces a defence layer:

Missing CSP → injected XSS would have no second-line defence (first-line Jinja autoescape remains intact)
Missing X-Frame-Options → clickjacking against any UI button would be possible
Missing SRI on jsdelivr-hosted Swagger UI → if jsdelivr were compromised, attacker JS would run in the docs page context

Patch

New SecurityHeadersMiddleware at src/ciguard/web/security_headers.py injecting: X-Content-Type-Options nosniff, X-Frame-Options DENY, Referrer-Policy no-referrer, Permissions-Policy interest-cohort=(), Cross-Origin-Opener-Policy same-origin, Cross-Origin-Resource-Policy same-origin, plus per-path CSP with /api/docs + /api/redoc carve-out for cdn.jsdelivr.net (Swagger UI / ReDoc dependency).
COEP intentionally NOT set: would break Swagger UI's cross-origin assets, and ciguard makes no SharedArrayBuffer use that would benefit.
Registered via app.add_middleware(SecurityHeadersMiddleware).
6 regression tests in tests/test_web.py::TestSecurityHeaders.

Discovery

Found by OWASP ZAP baseline scan during ciguard's first self-conducted pentest cycle, 2026-04-26.

CVSS Scoring

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N — 4.3 (Medium per v3.1 thresholds)
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N — first.org calc 4.3 (Low); GitHub's calc 2.1 (Low). All consistent at Low/borderline.

Verification

$ curl -sI http://127.0.0.1:8080/ | grep -E '^(X-Frame|X-Content|Referrer|Permissions|Cross-Origin|Content-Security):'
# Pre-fix: empty
# Post-fix: 7 headers present

Resources

Fix released in v0.8.2
CI regression gate added in v0.8.3

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐍PyPI	`ciguard`	≥ 0.1.0&&< 0.8.2	0.8.2`pip install --upgrade 'ciguard==0.8.2'`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ciguard, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update ciguard to 0.8.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7ww3-xvf5-cxwm is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-7ww3-xvf5-cxwm can be triaged on real exposure rather than presence alone.

Tailored to GHSA-7ww3-xvf5-cxwm. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary ciguard's FastAPI Web UI (`src/ciguard/web/app.py`) does not set HTTP defence-in-depth headers. OWASP ZAP baseline scan flagged 11 alerts: missing Content-Security-Policy (Medium), X-Frame-Options (Medium), Sub-Resource-Integrity on `/api/docs` (Medium), COOP / COEP / CORP (Low), Permissions-Policy (Low), X-Content-Type-Options (Low). ## Threat scenario For local-only deployment (current intent): minimal — there's no untrusted browser context, no third-party hosting, no auth surface to protect. For public hosting (PRD Slice 9 GitHub App or hosted dashboard, future): each missing

O3 Security · Impact-Aware SCA

Is GHSA-7ww3-xvf5-cxwm in your dependencies?

O3 Security finds GHSA-7ww3-xvf5-cxwm across PyPI dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works