Security Advisories
This page lists the security advisories Curiosity has published for Curiosity Studio. An advisory is published for every security issue that reached a released build and requires customer action — an upgrade, a configuration change, or a review of existing data.
Each advisory states the affected builds, the build that contains the fix, a CVSS v4.0 base score and vector, and what an administrator has to do.
Published advisories
| Advisory | Title | Severity | Affected | Fixed in | Published |
|---|---|---|---|---|---|
| CVE-2026-88817 | Privilege escalation via legacy access group creation endpoint | 8.7 High | 26.8.70362 and earlier |
26.8.70363 |
2026-09-10 |
Third-party advisories
Advisories published by the vendors of components that Curiosity Studio ships, with our assessment of each one for Curiosity Studio. They require no customer action unless the assessment says so.
| Advisory | Component | Title | Assessment | Patched component in | Reviewed |
|---|---|---|---|---|---|
| CVE-2026-111497 | .NET runtime | .NET Brotli decoder out-of-bounds write | Not exploitable | 72837 |
2026-10-25 |
CVE-2026-111497. We reviewed this advisory and Curiosity Studio is not exposed to it in a way that can be exploited. Build 72837 (curiosityai/curiosity:72837) and later include the patched .NET runtime. No action is required.
How advisories are published
- An advisory goes out once a build containing the fix is available as
curiosityai/curiosity:<build>on Docker Hub, so there is always an upgrade path at the time of publication. - Severity is scored with CVSS v4.0. Both the base score and the full vector string are published so you can re-score the issue for your own environment.
- Weaknesses are classified with CWE identifiers.
- Reporters are credited by name with their consent.
- Advisories are not amended silently. Material corrections are added as a dated entry at the bottom of the advisory.
Issues found and fixed internally before they shipped in a released build are not published here.
Report a vulnerability
Send reports to security@curiosity.ai. See Report a Security Issue for what to include, our response times, and the testing rules.