Package Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/74541?format=api",
    "purl": "pkg:npm/%40powersync/service-sync-rules@0.33.0",
    "type": "npm",
    "namespace": "@powersync",
    "name": "service-sync-rules",
    "version": "0.33.0",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": false,
    "next_non_vulnerable_version": "0.33.0",
    "latest_non_vulnerable_version": "0.33.0",
    "affected_by_vulnerabilities": [],
    "fixing_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50750?format=api",
            "vulnerability_id": "VCID-1152-dmqv-akh4",
            "summary": "PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`\nIn version **1.20.0**, when using new sync streams with `config.edition: 3`, certain subquery filters were ignored when determining which data to sync to users.\n\nDepending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted.\n\nOnly queries that gate synchronization using subqueries without partitioning the result set are affected.\n\nNot affected:\n* Sync rules (bucket_definitions)\n* Sync streams using `config.edition: 2`\n* No data is exposed without authenticating",
            "references": [
                {
                    "reference_url": "https://github.com/powersync-ja/powersync-service",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/powersync-ja/powersync-service"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30870",
                    "reference_id": "CVE-2026-30870",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30870"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-q6wc-xx4m-92fj",
                    "reference_id": "GHSA-q6wc-xx4m-92fj",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-q6wc-xx4m-92fj"
                },
                {
                    "reference_url": "https://github.com/powersync-ja/powersync-service/security/advisories/GHSA-q6wc-xx4m-92fj",
                    "reference_id": "GHSA-q6wc-xx4m-92fj",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/powersync-ja/powersync-service/security/advisories/GHSA-q6wc-xx4m-92fj"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/74541?format=api",
                    "purl": "pkg:npm/%40powersync/service-sync-rules@0.33.0",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/%2540powersync/service-sync-rules@0.33.0"
                }
            ],
            "aliases": [
                "CVE-2026-30870",
                "GHSA-q6wc-xx4m-92fj"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1152-dmqv-akh4"
        }
    ],
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/%2540powersync/service-sync-rules@0.33.0"
}