# Security Policy

## Reporting a Vulnerability

If you think you've found a potential vulnerability in MaterialX, please report
it by emailing <materialx-tsc-private@lists.aswf.io>.  Only Technical Steering
Committee members and Academy Software Foundation project management have
access to these messages.  Include detailed steps to reproduce the issue, and
any other information that could aid an investigation.  Our policy is to
respond to vulnerability reports within 14 days.

## Outstanding Security Issues

None

## Addressed Security Issues

The following MaterialX versions addressed the security issues listed within their section:

### 1.39.3

- [CVE-2025-53009](https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-wx6g-fm6f-w822)
- [CVE-2025-53010](https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-3jhf-gxhr-q4cx)
- [CVE-2025-53011](https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-7qw8-3vmf-gj32)
- [CVE-2025-53012](https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-qc2h-74x3-4v3w)
