LowVulnerabilityGHSA-c33x-vcv4-vg3gupdated 29 Oct 2026, 16:35 UTC

Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence

Fix availableOfficial source

Severity	LowCVSS 2.1 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yescedar-policy 4.11.1, cedar-policy 3.4.3, @cedar-policy/cedar-wasm 4.11.1, @cedar-policy/cedar-wasm 3.4.3 · since 29 Oct 2026
How sure is this?	Official sourceBacked by an official source

Are you affected?

Package / product	Affected versions	Fixed in
cedar-policy · rust	>= 4.0.0, < 4.11.1	4.11.1
cedar-policy · rust	>= 3.0.0, < 3.4.3	3.4.3
@cedar-policy/cedar-wasm · npm	>= 4.0.1, < 4.11.1	4.11.1
@cedar-policy/cedar-wasm · npm	>= 3.2.0, < 3.4.3	3.4.3

Timeline

29 Oct 2026, 16:35 UTC
Publicly disclosed
29 Oct 2026, 16:35 UTC
Reported by GitHub Advisory · GitHub Advisory
29 Oct 2026, 16:35 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergenceGitHub Advisory · 29 Oct 2026, 16:35 UTC

Technical details

ID: GHSA-c33x-vcv4-vg3g
CVSS: 2.1 / 10
Disclosed: 29 Oct 2026, 16:35 UTC
On Zero Radar: 29 Oct 2026, 16:35 UTC (0 min after disclosure)
Last change: 29 Oct 2026, 16:35 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence · Zero Radar