[zachariah-mithani]

Adds a credits entry crediting Zachariah Mithani (@zachariah-mithani) as FINDER, adds the affected PyPI range for babeldoc (introduced 0.3.61, fixed 0.7.0, as stated in the CVE record), and adds the CVE record JSON as a supporting WEB reference.

Public evidence supporting this change:

• The CVE record published by the VulnCheck CNA lists the credit "Zachariah Mithani (AploSec)" as finder and the affected range ">= 0.3.61, < 0.7.0": https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/124xxx/CVE-2026-124553.json
• The maintainers' repository advisory for the same issue, GHSA-wrv8-h9rp-6fqq (already referenced in this advisory), credits @zachariah-mithani as reporter: GHSA-wrv8-h9rp-6fqq
• The fix commit is already referenced: funstory-ai/BabelDOC@39a6e9e (release notes: v0.7.0).

The credits structure follows the OSV schema and the convention used in this repository (e.g. merged PR #9645).

Per CONTRIBUTING.md this PR touches exactly one advisory.

[Copilot]

🟢 Approval recommended

No active review issues are identified in the advisory update, which adds the affected-version range, CVE reference, and finder attribution.

No open issues 🎉

What changed in this PR

Updates the BabelDOC security advisory with affected package versions, finder attribution, and the published CVE record.

Changes:

• Adds the affected babeldoc range from 0.3.61 through before 0.7.0.
• Credits Zachariah Mithani as the finder.
• Adds the CVE-2026-124553 record as a supporting web reference.

This pull request is ready to be approved.

File	Description
advisories/​unreviewed/​2026/​11/​GHSA-2w74-49x3-cmf5/​GHSA-2w74-49x3-cmf5.json	Adds PyPI affected-version metadata, CVE evidence, and finder credit.

_{Review effort: Lite (auto)}