Security follow up - maintainer attention requested - GHSA-h765-p93x-jrpv

[frentzen-siauwtama]

Please review GHSA-h765-p93x-jrpv, originally reported in June 2026.

I have followed up privately via multiple channel but have not received a response.

The technical details remain in the private GitHub Security Advisory. The issue appears to have been addressed in a later release; I’m requesting an update on advisory publication and CVE assignment.

Thank you.

[vermorag]

Security follow-up belongs in the existing private advisory. Closing this issue to keep the discussion in one place; this does not indicate that the report has been confirmed, resolved, or rejected.

Cattr is maintained on a volunteer basis, with limited availability and no guaranteed remediation or publication timeline. Current work is focused on restoring the project's build and deployment process.

Please use the private advisory for further technical evidence and questions about disclosure or CVE status.