Posit assigns CVE IDs and publishes CVE Records for vulnerabilities in its open-source and professional software.
BOSTON, Oct. 27, 2026 /PRNewswire-PRWeb/ -- Posit Software, PBC (formerly RStudio, PBC), the company behind RStudio, Positron, Shiny, and Quarto, today announced that the CVE Program has authorized it as a CVE Numbering Authority (CNA). Posit can now assign CVE IDs and publish CVE Records for vulnerabilities on the software it maintains, so customers and researchers get authoritative information from the team that builds and fixes that software.
Posit joins more than 500 CNAs in over 40 countries, including Microsoft, Google, and Apple, with MITRE as its Top-Level Root. Posit publishes advisories at trust.posit.co and CVE Records at cve.org, so anyone can check what Posit found, when it shipped the fix, and which versions the vulnerability affects.
The authorization covers all Posit products.
- Commercial software: Posit Workbench, Posit Connect, and Posit Package Manager.
- Hosted services: Posit Connect Cloud, Posit Cloud, and shinyapps.io. For hosted services, Posit assigns a CVE ID when customers must act or need the record to assess their exposure.
- Open-source software: RStudio, Positron, Quarto, Shiny, and the R and Python packages Posit maintains.
Posit assigns CVE IDs only for software it maintains. The maintainers of third-party packages that Posit Package Manager distributes handle vulnerabilities in those packages, and other CNAs handle vulnerabilities in the software they cover.
Until now, Posit has relied on other CNAs, such as MITRE and GitHub, to assign CVE IDs for its products. As a CNA, Posit has the first opportunity to assign IDs for vulnerabilities in its scope. Posit can reserve an ID before disclosure so the first public advisory includes it, and can publish a CVE Record that lists affected and fixed versions and a CVSS v4.0 severity score. Vulnerability scanners read those records, and security teams use the results to decide what to patch first.
"Many of our customers work in regulated industries and run their vulnerability programs on CVE data," said Rick Johnson, VP of Information Technology & Security at Posit. "As a CNA, we publish the CVE Record ourselves, alongside our advisory, with the affected and fixed versions that their teams need. Researchers also get a direct path to the people who fix the issue."
How do I report a security vulnerability to Posit?
Report suspected vulnerabilities to [email protected], using the PGP key on Posit's Product Security page for sensitive details, or through GitHub private vulnerability reporting for Posit's open source projects. Under Posit's Vulnerability Disclosure Policy, Posit commits to:
- Acknowledge reports within 3 business days
- Complete an initial assessment within 10 business days
- Update the reporter at least every 30 days
- Share the CVE ID within 2 business days of assignment
- Target coordinated disclosure within 90 days
Posit publishes security advisories at trust.posit.co, and CVE Records for Posit software appear in the CVE List at cve.org.
Frequently Asked Questions (FAQ)
Is Posit a CVE Numbering Authority?
Yes. The CVE Program authorized Posit as a CNA, so Posit assigns CVE IDs and publishes CVE Records for vulnerabilities in the software it maintains.
What is a CVE Numbering Authority (CNA)?
A CNA is an organization that the CVE Program authorizes to assign CVE IDs and publish CVE Records for vulnerabilities within a defined scope.
Which Posit products does the CNA authorization cover?
The authorization covers Posit's commercial software (Posit Workbench, Posit Connect, and Posit Package Manager), hosted services (Posit Connect Cloud, Posit Cloud, and shinyapps.io), and open source software (RStudio, Positron, Quarto, Shiny, and the R and Python packages Posit maintains). The maintainers of third-party packages that Posit Package Manager distributes handle vulnerabilities in those packages, and other CNAs handle vulnerabilities in the software they cover.
Does Posit offer a bug bounty program?
No. Posit does not offer a bug bounty program. Posit credits reporters in its security advisories with their permission.
Where can I find Posit's security advisories and CVE Records?
Posit publishes security advisories at https://trust.posit.co/updates, and CVE Records for Posit software appear in the CVE List at cve.org.
Who is Posit's CVE Program Root?
MITRE serves as Posit's Top-Level Root in the CVE Program.
About the CVE Program
The mission of the Common Vulnerabilities and Exposures (CVE™) Program is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. CVE is an international, community-based effort that relies on the community to discover vulnerabilities. There is one CVE Record for each vulnerability in the catalog. The vulnerabilities are discovered, then assigned and published by organizations from around the world that have partnered with the CVE Program. Partners publish CVE Records to communicate consistent descriptions of vulnerabilities. Information technology and cybersecurity professionals use CVE Records to ensure they are discussing the same issue and to coordinate their efforts to prioritize and address the vulnerabilities. CVE Numbering Authorities (CNAs) are responsible for the regular assignment of CVE IDs and for publishing the associated CVE Records within a specific scope. Learn more at www.cve.org.
About Posit
Posit, PBC (formerly RStudio) creates software that helps individuals, teams, and organizations make better decisions with data. We believe the best analyses are correct, transparent, and reproducible, and that humans and AI work best together. Posit's products, including Workbench, Connect, and Package Manager, power data science teams at thousands of organizations worldwide, from startups to the Fortune 500. Learn more at posit.co
Media Contact
Posit, Posit, 1 8444481212, [email protected], www.posit.co
SOURCE Posit
Share this article