Threats affecting pkg:github/ultravioletrs/cocos

CVE-2026-92701 is a critical origin validation vulnerability in Cocos AI versions 0.8.2 and earlier. The Intel TDX aTLS verifier's VerifTeeAttestation function fails to apply the expected current-session value to TdQuoteBodyPolicy.ReportData before validating TDX QuoteV4 evidence. This allows acceptance of structurally valid but mismatched or reused REPORT_DATA, potentially causing trust or authorization decisions to be made for unrelated attestation contexts. The issue was fixed in version 0.9.0 by removing the affected verifier path during migration to post-handshake attestation.

CVE-2026-92702 is a critical origin validation error in Cocos AI versions before 0.9.0. The vulnerability involves improper handling of attestation report data in the AMD SEV-SNP verifier, allowing a relying party to accept attestation evidence unrelated to the current session when empty expected report data is provided. This can lead to incorrect trust, authorization, or data release decisions. The issue was fixed in version 0.9.0 by removing the affected verification path during migration to post-handshake attestation.