A vulnerable version (3.0.2) of the braces package is embedded in: - openSUSE:Factory/element-web - openSUSE:Factory/element-desktop Upstream issue: https://github.com/micromatch/braces/issues/35