Ten out of ten, no login

Ten out of ten on the severity scale, and it needs no account at all.

A headline tells you a tool you run is vulnerable. It rarely tells you whether the version you actually have is affected.

The advisory database answers that directly, and you can ask it from a terminal.

Fetch the record for the identifier. The score comes back as ten point zero.

Then look at the affected entry. It names the package, the range that is vulnerable, and the first version that is not.

Here it runs from one point sixty-five up to, but not including, one point one twenty-one. Inside that window you are exposed. On the fixed version or newer you are not.

That is a definite answer about your own machine, and the same query works for anything you self-host.

Ask the advisory database for the range. Then check your version.