{ "executive_summary": { "badge": "Unsafe", "security_score": 39.08, "view": "composite", "scanner_badges": { "agentshield": "Verified", "cisco-skill-scanner": "Unsafe", "agent-audit-kit": "Caution", "bearer": "Verified", "nerlo-behavioral": "Verified", "nerlo-install-instruction": "Verified", "trivy": "Unsafe", "osv-scanner": "Unsafe" }, "finding_counts": { "critical": 0, "high": 37, "medium": 79, "low": 11 }, "recommendation": "@xeroapi/xero-mcp-server is NOT recommended for integration: the scan surfaced 0 critical and 37 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering." }, "source_provenance": { "repository_url": "https://github.com/XeroAPI/xero-mcp-server", "commit_sha_scanned": null, "license": "MIT", "maintainer": "Xero (https://xero.com)", "name": "@xeroapi/xero-mcp-server", "version": "0.0.16" }, "per_scanner_detail": [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 7.6542569209996145, "status": "complete", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [ "supply_chain" ] }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 13.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "policy_violation", "file_path": "/repo", "line_number": null, "rule_identifier": "LOW_ANALYZABILITY", "title": "Critically low analyzability score", "description": "Only 9% of skill content could be analyzed. 132 of 147 files are opaque to the scanner. The safety assessment has low confidence.", "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/.", "line_number": null, "rule_identifier": "EXCESSIVE_FILE_COUNT", "title": "Skill package contains many files", "description": "Skill package contains 147 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.", "remediation": "Review file inventory and remove unnecessary files." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/clients/xero-client.ts", "line_number": 164, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "Pattern detected: axios.post(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/clients/xero-client.ts", "line_number": 178, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "Pattern detected: axios.get(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/create/create-contact.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'create-contact.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/create/create-tracking-category.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'create-tracking-category.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/create/create-tracking-options.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'create-tracking-options.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/create/index.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'index.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/list/list-aged-payables-by-contact.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'list-aged-payables-by-contact.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/list/list-aged-receivables-by-contact.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'list-aged-receivables-by-contact.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/list/list-bank-transactions.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'list-bank-transactions.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/list/list-tracking-categories.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'list-tracking-categories.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/update/update-contact.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'update-contact.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/update/update-tracking-category.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'update-tracking-category.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/update/update-tracking-options.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'update-tracking-options.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/examples/openai-agents/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/examples/openai-agents/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" } ], "execution_duration_seconds": 61.676579759980086, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo", "openai-agents" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 3, "high": 1, "medium": 13, "critical": 0, "informational": 2 } }, "display_score": 13.0, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 66.0, "scanner_badge": "Caution", "findings": [ { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "AAK-SUPPLY-005", "title": "Dependency count exceeds threshold", "description": "More than 200 direct + transitive dependencies in lockfile. Each dependency is a trust decision.", "remediation": "Audit and remove unused dependencies. Consider lighter alternatives." }, { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "SECURITY.md", "line_number": null, "rule_identifier": "AAK-SEC-MD-001", "title": "MCP server repo missing SECURITY.md or security_contact", "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.", "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "mcp-config", "file_path": "src/server/xero-mcp-server.ts", "line_number": 1, "rule_identifier": "AAK-MCP-018", "title": "Missing rate limiting on MCP endpoint", "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.", "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "mcp-config", "file_path": "src/tools/tool-factory.ts", "line_number": 1, "rule_identifier": "AAK-MCP-018", "title": "Missing rate limiting on MCP endpoint", "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.", "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "package.json", "line_number": 27, "rule_identifier": "AAK-OAUTH-3P-001", "title": "Repo depends on a third-party agent-platform SDK", "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.", "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident" }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": "src/index.ts", "line_number": null, "rule_identifier": "AAK-ANTHROPIC-SDK-001", "title": "MCP server built on the upstream SDK without STDIO sanitizer", "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L", "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`." } ], "execution_duration_seconds": 29.14182960501057, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 143, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 2, "high": 1, "medium": 3, "critical": 0, "informational": 0 } }, "display_score": 66.0, "display_badge": "Caution" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 18.176760433008894, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 90.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "nerlo-behavioral", "severity": "medium", "category": "undisclosed-egress", "file_path": "/repo/src/clients/xero-client.ts", "line_number": 164, "rule_identifier": "opt.nerlo-rules.nerlo-hardcoded-external-egress", "title": "opt.nerlo-rules.nerlo-hardcoded-external-egress", "description": "Network request to a hardcoded external host/URL. Undisclosed egress in an MCP server is a common exfiltration channel \u2014 confirm it is expected.", "remediation": null }, { "tool_name": "nerlo-behavioral", "severity": "medium", "category": "undisclosed-egress", "file_path": "/repo/src/clients/xero-client.ts", "line_number": 178, "rule_identifier": "opt.nerlo-rules.nerlo-hardcoded-external-egress", "title": "opt.nerlo-rules.nerlo-hardcoded-external-egress", "description": "Network request to a hardcoded external host/URL. Undisclosed egress in an MCP server is a common exfiltration channel \u2014 confirm it is expected.", "remediation": null } ], "execution_duration_seconds": 59.80976568500046, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 133, "install_command": "pip install 'semgrep==1.97.0'", "severity_counts": { "low": 0, "high": 0, "medium": 2, "critical": 0, "informational": 0 } }, "display_score": 90.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 55.85829200199805, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 2, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42033", "title": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same ", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42035", "title": "axios: Axios: Arbitrary HTTP header injection via prototype pollution", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance an", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42043", "title": "axios: Axios: NO_PROXY bypass via crafted URL", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42264", "title": "axios: Axios: Prototype pollution allows information disclosure and request manipulation", "description": "Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request.", "remediation": "Upgrade axios from 1.15.0 to 1.15.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44486", "title": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019 Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. T", "remediation": "Upgrade axios from 1.15.0 to 1.16.0, 0.32.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44487", "title": "axios: Axios: Information disclosure of proxy credentials via redirect flows", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was in", "remediation": "Upgrade axios from 1.15.0 to 1.16.0, 0.32.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44488", "title": "axios: Axios: Denial of Service due to unenforced request and response size limits", "description": "Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usag", "remediation": "Upgrade axios from 1.15.0 to 1.16.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44492", "title": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vuln", "remediation": "Upgrade axios from 1.15.0 to 1.16.0, 0.32.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44494", "title": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution", "description": "Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack \u2014 intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, whic", "remediation": "Upgrade axios from 1.15.0 to 1.16.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44495", "title": "axios: Axios: Information disclosure due to prototype pollution vulnerability", "description": "Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-p", "remediation": "Upgrade axios from 1.15.0 to 1.15.2, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44496", "title": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name", "description": "Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the", "remediation": "Upgrade axios from 1.15.0 to 1.16.0, 0.32.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42034", "title": "axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42036", "title": "axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42037", "title": "axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header", "description": "Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypa", "remediation": "Upgrade axios from 1.15.0 to 1.15.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42038", "title": "axios: Axios: Information disclosure due to `no_proxy` bypass", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching \u2014 it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42039", "title": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42041", "title": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42042", "title": "axios: Axios: XSRF token bypass leading to information disclosure", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin s", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42044", "title": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget", "description": "Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses \u2014 including privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, ", "remediation": "Upgrade axios from 1.15.0 to 1.15.2 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44490", "title": "axios: Axios: Information disclosure and denial of service due to prototype pollution", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the mer", "remediation": "Upgrade axios from 1.15.0 to 1.16.0, 0.32.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-42h9-826w-cgv3", "title": "Axios: Excessive recursion in formDataToJSON can cause denial of service", "description": "## Summary\nAxios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData is sent with an `application/json` content type.\n\nApplications are affected when they pass attacker-controlled `FormData` field names into this functionality. A field name with thousands of nested bracket segments can exhaust the JavaScript call stack and throw `RangeError: ", "remediation": "Upgrade axios from 1.15.0 to 0.33.0, 1.18.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-7q8q-rj6j-mhjq", "title": "Axios: Nested axios option objects can consume polluted prototype values", "description": "## Summary\n\nAxios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.\n\nThe top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound re", "remediation": "Upgrade axios from 1.15.0 to 0.33.0, 1.18.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-f4gw-2p7v-4548", "title": "Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios", "description": "## Summary\n\nAxios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when evaluating `NO_PROXY` rules. In Node.js applications that use `HTTP_PROXY` or `HTTPS_PROXY` together with `NO_PROXY=localhost,127.0.0.1,::1` or similar, a request to `http://0.0.0.0:/` can be routed through the configured proxy instead of bypassing it.\n\nThe issue is exploitable when an attacker can influence the axios request URL or a followed redirect target, and when th", "remediation": "Upgrade axios from 1.15.0 to 1.18.0, 0.33.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-jqh4-m9w3-8hp9", "title": "Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`", "description": "## Summary\n\naxios\u2019 fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose size cannot be determined before dispatch. Applications that use `adapter: \"fetch\"` and rely on `maxBodyLength` to cap untrusted upload/proxy streams can send the full stream even when it exceeds the configured limit.\n\nThis affects fetch-adapter usage in edge runtimes where fetch is selected, and in Node.js or browser environments where the fetch adapter is explicitly selected.", "remediation": "Upgrade axios from 1.15.0 to 1.18.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-mmx7-hfxf-jppx", "title": "Axios: Prototype pollution gadgets can alter axios request construction", "description": "## Summary\n\naxios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: `axios.get()`, `axios.delete()`, `axios.head()`, and `axios.options()` read inherited `data` before config normalization, causing attacker-controlled body data to be sent on requests that did not explicitly set a body.\n\nAdditional low-level paths affect consumers that ", "remediation": "Upgrade axios from 1.15.0 to 1.18.0, 0.33.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-mwf2-3pr3-8698", "title": "Axios: HTTP/2 streamed uploads bypass `maxBodyLength`", "description": "## Summary\n\nAxios versions with Node.js HTTP/2 support allow streamed request bodies to bypass `maxBodyLength` enforcement when requests are sent with `httpVersion: 2`.\n\nThis affects applications that rely on `maxBodyLength` as a hard cap while forwarding attacker-controlled streams, such as upload endpoints proxying user data to an upstream HTTP/2 service. Buffered request bodies are still checked before the request is sent.\n\n## Impact\n\nAn attacker who can control a stream passed to axios can c", "remediation": "Upgrade axios from 1.15.0 to 1.18.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-pmv8-rq9r-6j72", "title": "Axios: Deep formToJSON Key Recursion Can Cause Denial of Service", "description": "## Summary\n\nAxios versions starting with `0.28.0` contain uncontrolled recursion in `formDataToJSON`, which is exposed as `axios.formToJSON()` and used internally when axios serialises `FormData` with `Content-Type: application/json`.\n\nIf an application passes attacker-controlled `FormData` field names to this functionality, a field name with thousands of nested bracket segments can exhaust the JavaScript call stack and cause denial of service for that request or, in applications without appropr", "remediation": "Upgrade axios from 1.15.0 to 0.33.0, 1.18.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42040", "title": "axios: Axios: Incorrect null byte handling can lead to data integrity issues", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerab", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-12590", "title": "body-parser: body-parser: Denial of Service via invalid limit option", "description": "Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars", "remediation": "Upgrade body-parser from 2.2.2 to 1.20.6, 2.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-6321", "title": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies", "description": "fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Version", "remediation": "Upgrade fast-uri from 3.1.0 to 3.1.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-6322", "title": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling", "description": "fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a differ", "remediation": "Upgrade fast-uri from 3.1.0 to 3.1.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-12143", "title": "form-data: form-data: Form field override via CRLF injection", "description": "form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the atta", "remediation": "Upgrade form-data from 4.0.5 to 2.5.6, 3.0.5, 4.0.6 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54290", "title": "hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44455", "title": "hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4", "remediation": "Upgrade hono from 4.12.14 to 4.12.16 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44456", "title": "Hono: bodyLimit() can be bypassed for chunked / unknown-length requests", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.", "remediation": "Upgrade hono from 4.12.14 to 4.12.16 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44457", "title": "Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.", "remediation": "Upgrade hono from 4.12.14 to 4.12.18 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44458", "title": "Hono has CSS Declaration Injection via Style Object Values in JSX SSR", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18.", "remediation": "Upgrade hono from 4.12.14 to 4.12.18 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47673", "title": "Hono: JWT middleware accepts any Authorization scheme, not only Bearer", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value \u2014 regardless of the scheme name in the first position \u2014 proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is", "remediation": "Upgrade hono from 4.12.14 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47674", "title": "Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 ", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule \u2014 such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses \u2014 do not match the normalized rule entry, causing the ", "remediation": "Upgrade hono from 4.12.14 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47675", "title": "Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \\r, \\n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed ", "remediation": "Upgrade hono from 4.12.14 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47676", "title": "Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed", "remediation": "Upgrade hono from 4.12.14 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54286", "title": "hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54287", "title": "hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54288", "title": "hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54289", "title": "hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request mid", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44459", "title": "Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() \u2014 typically when the application itself issues such tokens, or when the signing key is otherwise unde", "remediation": "Upgrade hono from 4.12.14 to 4.12.18 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42338", "title": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input", "description": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods,", "remediation": "Upgrade ip-address from 10.1.0 to 10.1.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-8723", "title": "### Summary `qs.stringify` throws `TypeError` when called with `arr ...", "description": "### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti", "remediation": "Upgrade qs from 6.14.2 to 6.15.2 or later" } ], "execution_duration_seconds": 1.8013843370135874, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "severity_counts": { "low": 3, "high": 15, "medium": 30, "critical": 0, "informational": 0 }, "manifests_scanned": [ "package-lock.json" ] }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-35jp-ww65-95wh", "title": "GHSA-35jp-ww65-95wh \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44494, GHSA-35jp-ww65-95wh | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3g43-6gmg-66jw", "title": "GHSA-3g43-6gmg-66jw \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44495, GHSA-3g43-6gmg-66jw | CVSS: 7.0", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3w6x-2g7m-8v23", "title": "GHSA-3w6x-2g7m-8v23 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42044, GHSA-3w6x-2g7m-8v23 | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-42h9-826w-cgv3", "title": "GHSA-42h9-826w-cgv3 \u2014 npm axios@1.15.0", "description": "aliases: GHSA-42h9-826w-cgv3 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-445q-vr5w-6q77", "title": "GHSA-445q-vr5w-6q77 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42037, GHSA-445q-vr5w-6q77 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-5c9x-8gcm-mpgx", "title": "GHSA-5c9x-8gcm-mpgx \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42034, GHSA-5c9x-8gcm-mpgx | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-62hf-57xw-28j9", "title": "GHSA-62hf-57xw-28j9 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42039, GHSA-62hf-57xw-28j9 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-6chq-wfr3-2hj9", "title": "GHSA-6chq-wfr3-2hj9 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42035, GHSA-6chq-wfr3-2hj9 | CVSS: 7.4", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-777c-7fjr-54vf", "title": "GHSA-777c-7fjr-54vf \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44488, GHSA-777c-7fjr-54vf | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-7q8q-rj6j-mhjq", "title": "GHSA-7q8q-rj6j-mhjq \u2014 npm axios@1.15.0", "description": "aliases: GHSA-7q8q-rj6j-mhjq | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-898c-q2cr-xwhg", "title": "GHSA-898c-q2cr-xwhg \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44490, GHSA-898c-q2cr-xwhg | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-f4gw-2p7v-4548", "title": "GHSA-f4gw-2p7v-4548 \u2014 npm axios@1.15.0", "description": "aliases: GHSA-f4gw-2p7v-4548 | CVSS: 6.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-hfxv-24rg-xrqf", "title": "GHSA-hfxv-24rg-xrqf \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44496, GHSA-hfxv-24rg-xrqf | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-j5f8-grm9-p9fc", "title": "GHSA-j5f8-grm9-p9fc \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44486, GHSA-j5f8-grm9-p9fc | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-jqh4-m9w3-8hp9", "title": "GHSA-jqh4-m9w3-8hp9 \u2014 npm axios@1.15.0", "description": "aliases: GHSA-jqh4-m9w3-8hp9 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-m7pr-hjqh-92cm", "title": "GHSA-m7pr-hjqh-92cm \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42038, GHSA-m7pr-hjqh-92cm | CVSS: 6.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-mmx7-hfxf-jppx", "title": "GHSA-mmx7-hfxf-jppx \u2014 npm axios@1.15.0", "description": "aliases: GHSA-mmx7-hfxf-jppx | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-mwf2-3pr3-8698", "title": "GHSA-mwf2-3pr3-8698 \u2014 npm axios@1.15.0", "description": "aliases: GHSA-mwf2-3pr3-8698 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-p92q-9vqr-4j8v", "title": "GHSA-p92q-9vqr-4j8v \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44487, GHSA-p92q-9vqr-4j8v | CVSS: 8.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-pf86-5x62-jrwf", "title": "GHSA-pf86-5x62-jrwf \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42033, GHSA-pf86-5x62-jrwf | CVSS: 7.4", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-pjwm-pj3p-43mv", "title": "GHSA-pjwm-pj3p-43mv \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44492, GHSA-pjwm-pj3p-43mv | CVSS: 8.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-pmv8-rq9r-6j72", "title": "GHSA-pmv8-rq9r-6j72 \u2014 npm axios@1.15.0", "description": "aliases: GHSA-pmv8-rq9r-6j72 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-pmwg-cvhr-8vh7", "title": "GHSA-pmwg-cvhr-8vh7 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42043, GHSA-pmwg-cvhr-8vh7 | CVSS: 7.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-q8qp-cvcw-x6jj", "title": "GHSA-q8qp-cvcw-x6jj \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42264, GHSA-q8qp-cvcw-x6jj | CVSS: 7.4", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-vf2m-468p-8v99", "title": "GHSA-vf2m-468p-8v99 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42036, GHSA-vf2m-468p-8v99 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-w9j2-pvgh-6h63", "title": "GHSA-w9j2-pvgh-6h63 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42041, GHSA-w9j2-pvgh-6h63 | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-xhjh-pmcv-23jw", "title": "GHSA-xhjh-pmcv-23jw \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42040, GHSA-xhjh-pmcv-23jw | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-xx6v-rp6x-q39c", "title": "GHSA-xx6v-rp6x-q39c \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42042, GHSA-xx6v-rp6x-q39c | CVSS: 5.4", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v422-hmwv-36x6", "title": "GHSA-v422-hmwv-36x6 \u2014 npm body-parser@2.2.2", "description": "aliases: CVE-2026-12590, GHSA-v422-hmwv-36x6 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3jxr-9vmj-r5cp", "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@1.1.14", "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3jxr-9vmj-r5cp", "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@2.1.0", "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-q3j6-qgpj-74h6", "title": "GHSA-q3j6-qgpj-74h6 \u2014 npm fast-uri@3.1.0", "description": "aliases: CVE-2026-6321, GHSA-q3j6-qgpj-74h6 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v39h-62p7-jpjc", "title": "GHSA-v39h-62p7-jpjc \u2014 npm fast-uri@3.1.0", "description": "aliases: CVE-2026-6322, GHSA-v39h-62p7-jpjc | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-hmw2-7cc7-3qxx", "title": "GHSA-hmw2-7cc7-3qxx \u2014 npm form-data@4.0.5", "description": "aliases: CVE-2026-12143, GHSA-hmw2-7cc7-3qxx | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-2gcr-mfcq-wcc3", "title": "GHSA-2gcr-mfcq-wcc3 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-47676, GHSA-2gcr-mfcq-wcc3 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3hrh-pfw6-9m5x", "title": "GHSA-3hrh-pfw6-9m5x \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-47675, GHSA-3hrh-pfw6-9m5x | CVSS: 4.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-69xw-7hcm-h432", "title": "GHSA-69xw-7hcm-h432 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44455, GHSA-69xw-7hcm-h432 | CVSS: 4.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-88fw-hqm2-52qc", "title": "GHSA-88fw-hqm2-52qc \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54290, GHSA-88fw-hqm2-52qc | CVSS: 7.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-9vqf-7f2p-gf9v", "title": "GHSA-9vqf-7f2p-gf9v \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44456, GHSA-9vqf-7f2p-gf9v | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-f577-qrjj-4474", "title": "GHSA-f577-qrjj-4474 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-47673, GHSA-f577-qrjj-4474 | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-hm8q-7f3q-5f36", "title": "GHSA-hm8q-7f3q-5f36 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44459, GHSA-hm8q-7f3q-5f36 | CVSS: 3.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-j6c9-x7qj-28xf", "title": "GHSA-j6c9-x7qj-28xf \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54287, GHSA-j6c9-x7qj-28xf | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-p77w-8qqv-26rm", "title": "GHSA-p77w-8qqv-26rm \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44457, GHSA-p77w-8qqv-26rm | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-qp7p-654g-cw7p", "title": "GHSA-qp7p-654g-cw7p \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44458, GHSA-qp7p-654g-cw7p | CVSS: 4.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-rv63-4mwf-qqc2", "title": "GHSA-rv63-4mwf-qqc2 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54288, GHSA-rv63-4mwf-qqc2 | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-wgpf-jwqj-8h8p", "title": "GHSA-wgpf-jwqj-8h8p \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54289, GHSA-wgpf-jwqj-8h8p | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-wwfh-h76j-fc44", "title": "GHSA-wwfh-h76j-fc44 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54286, GHSA-wwfh-h76j-fc44 | CVSS: 5.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-xrhx-7g5j-rcj5", "title": "GHSA-xrhx-7g5j-rcj5 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-47674, GHSA-xrhx-7g5j-rcj5 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v2v4-37r5-5v8g", "title": "GHSA-v2v4-37r5-5v8g \u2014 npm ip-address@10.1.0", "description": "aliases: CVE-2026-42338, GHSA-v2v4-37r5-5v8g | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-52cp-r559-cp3m", "title": "GHSA-52cp-r559-cp3m \u2014 npm js-yaml@4.1.1", "description": "aliases: CVE-2026-59869, GHSA-52cp-r559-cp3m | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-h67p-54hq-rp68", "title": "GHSA-h67p-54hq-rp68 \u2014 npm js-yaml@4.1.1", "description": "aliases: CVE-2026-53550, GHSA-h67p-54hq-rp68 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-q8mj-m7cp-5q26", "title": "GHSA-q8mj-m7cp-5q26 \u2014 npm qs@6.14.2", "description": "aliases: CVE-2026-8723, GHSA-q8mj-m7cp-5q26 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-fx2h-pf6j-xcff", "title": "GHSA-fx2h-pf6j-xcff \u2014 npm vite@8.0.14", "description": "aliases: CVE-2026-53571, GHSA-fx2h-pf6j-xcff | CVSS: 8.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v6wh-96g9-6wx3", "title": "GHSA-v6wh-96g9-6wx3 \u2014 npm vite@8.0.14", "description": "aliases: CVE-2026-53632, GHSA-v6wh-96g9-6wx3 | CVSS: 5.5", "remediation": null } ], "execution_duration_seconds": 35.84983584698057, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "npm" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 3, "high": 20, "medium": 31, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/package-lock.json" ], "finding_id_aliases": { "GHSA-2gcr-mfcq-wcc3": [ "CVE-2026-47676" ], "GHSA-35jp-ww65-95wh": [ "CVE-2026-44494" ], "GHSA-3g43-6gmg-66jw": [ "CVE-2026-44495" ], "GHSA-3hrh-pfw6-9m5x": [ "CVE-2026-47675" ], "GHSA-3jxr-9vmj-r5cp": [ "CVE-2026-13149", "CVE-2026-13149" ], "GHSA-3w6x-2g7m-8v23": [ "CVE-2026-42044" ], "GHSA-445q-vr5w-6q77": [ "CVE-2026-42037" ], "GHSA-52cp-r559-cp3m": [ "CVE-2026-59869" ], "GHSA-5c9x-8gcm-mpgx": [ "CVE-2026-42034" ], "GHSA-62hf-57xw-28j9": [ "CVE-2026-42039" ], "GHSA-69xw-7hcm-h432": [ "CVE-2026-44455" ], "GHSA-6chq-wfr3-2hj9": [ "CVE-2026-42035" ], "GHSA-777c-7fjr-54vf": [ "CVE-2026-44488" ], "GHSA-88fw-hqm2-52qc": [ "CVE-2026-54290" ], "GHSA-898c-q2cr-xwhg": [ "CVE-2026-44490" ], "GHSA-9vqf-7f2p-gf9v": [ "CVE-2026-44456" ], "GHSA-f577-qrjj-4474": [ "CVE-2026-47673" ], "GHSA-fx2h-pf6j-xcff": [ "CVE-2026-53571" ], "GHSA-h67p-54hq-rp68": [ "CVE-2026-53550" ], "GHSA-hfxv-24rg-xrqf": [ "CVE-2026-44496" ], "GHSA-hm8q-7f3q-5f36": [ "CVE-2026-44459" ], "GHSA-hmw2-7cc7-3qxx": [ "CVE-2026-12143" ], "GHSA-j5f8-grm9-p9fc": [ "CVE-2026-44486" ], "GHSA-j6c9-x7qj-28xf": [ "CVE-2026-54287" ], "GHSA-m7pr-hjqh-92cm": [ "CVE-2026-42038" ], "GHSA-p77w-8qqv-26rm": [ "CVE-2026-44457" ], "GHSA-p92q-9vqr-4j8v": [ "CVE-2026-44487" ], "GHSA-pf86-5x62-jrwf": [ "CVE-2026-42033" ], "GHSA-pjwm-pj3p-43mv": [ "CVE-2026-44492" ], "GHSA-pmwg-cvhr-8vh7": [ "CVE-2026-42043" ], "GHSA-q3j6-qgpj-74h6": [ "CVE-2026-6321" ], "GHSA-q8mj-m7cp-5q26": [ "CVE-2026-8723" ], "GHSA-q8qp-cvcw-x6jj": [ "CVE-2026-42264" ], "GHSA-qp7p-654g-cw7p": [ "CVE-2026-44458" ], "GHSA-rv63-4mwf-qqc2": [ "CVE-2026-54288" ], "GHSA-v2v4-37r5-5v8g": [ "CVE-2026-42338" ], "GHSA-v39h-62p7-jpjc": [ "CVE-2026-6322" ], "GHSA-v422-hmwv-36x6": [ "CVE-2026-12590" ], "GHSA-v6wh-96g9-6wx3": [ "CVE-2026-53632" ], "GHSA-vf2m-468p-8v99": [ "CVE-2026-42036" ], "GHSA-w9j2-pvgh-6h63": [ "CVE-2026-42041" ], "GHSA-wgpf-jwqj-8h8p": [ "CVE-2026-54289" ], "GHSA-wwfh-h76j-fc44": [ "CVE-2026-54286" ], "GHSA-xhjh-pmcv-23jw": [ "CVE-2026-42040" ], "GHSA-xrhx-7g5j-rcj5": [ "CVE-2026-47674" ], "GHSA-xx6v-rp6x-q39c": [ "CVE-2026-42042" ] }, "cross_scanner_correlation": { "only_osv": [ "GHSA-3jxr-9vmj-r5cp", "GHSA-52cp-r559-cp3m", "GHSA-fx2h-pf6j-xcff", "GHSA-h67p-54hq-rp68", "GHSA-v6wh-96g9-6wx3" ], "only_trivy": [], "intersection_ids": [ "CVE-2026-12143", "CVE-2026-12590", "CVE-2026-42033", "CVE-2026-42034", "CVE-2026-42035", "CVE-2026-42036", "CVE-2026-42037", "CVE-2026-42038", "CVE-2026-42039", "CVE-2026-42040", "CVE-2026-42041", "CVE-2026-42042", "CVE-2026-42043", "CVE-2026-42044", "CVE-2026-42264", "CVE-2026-42338", "CVE-2026-44455", "CVE-2026-44456", "CVE-2026-44457", "CVE-2026-44458", "CVE-2026-44459", "CVE-2026-44486", "CVE-2026-44487", "CVE-2026-44488", "CVE-2026-44490", "CVE-2026-44492", "CVE-2026-44494", "CVE-2026-44495", "CVE-2026-44496", "CVE-2026-47673", "CVE-2026-47674", "CVE-2026-47675", "CVE-2026-47676", "CVE-2026-54286", "CVE-2026-54287", "CVE-2026-54288", "CVE-2026-54289", "CVE-2026-54290", "CVE-2026-6321", "CVE-2026-6322", "CVE-2026-8723", "GHSA-42h9-826w-cgv3", "GHSA-7q8q-rj6j-mhjq", "GHSA-f4gw-2p7v-4548", "GHSA-jqh4-m9w3-8hp9", "GHSA-mmx7-hfxf-jppx", "GHSA-mwf2-3pr3-8698", "GHSA-pmv8-rq9r-6j72" ] } }, "display_score": 0.0, "display_badge": "Unsafe" } ], "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.", "audit_chain": { "scan_job_id": "613dfa2c-0746-4e42-a85c-9323c3a73a18", "scan_completed_at": "2026-07-21T04:28:24.418335+00:00", "scanner_versions": { "agentshield": "1.4.0", "cisco-skill-scanner": "2.0.11", "agent-audit-kit": "0.3.26", "bearer": "2.0.2", "nerlo-behavioral": "0.1.0", "nerlo-install-instruction": "0.1.0", "trivy": "0.71.0", "osv-scanner": "2.3.8" }, "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:f39b78766d0689eab28dd1321de274d846ba9804d434ee124cfac0d71e09d86e", "ai_decision_log_ids": [ "9d200b3f-dfee-41b9-b794-84d469fddad4" ], "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation" }, "appendix": { "raw_scanner_reports": [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 7.6542569209996145, "status": "complete", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [ "supply_chain" ] }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 13.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "policy_violation", "file_path": "/repo", "line_number": null, "rule_identifier": "LOW_ANALYZABILITY", "title": "Critically low analyzability score", "description": "Only 9% of skill content could be analyzed. 132 of 147 files are opaque to the scanner. The safety assessment has low confidence.", "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/.", "line_number": null, "rule_identifier": "EXCESSIVE_FILE_COUNT", "title": "Skill package contains many files", "description": "Skill package contains 147 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.", "remediation": "Review file inventory and remove unnecessary files." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/clients/xero-client.ts", "line_number": 164, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "Pattern detected: axios.post(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/clients/xero-client.ts", "line_number": 178, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "Pattern detected: axios.get(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/create/create-contact.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'create-contact.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/create/create-tracking-category.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'create-tracking-category.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/create/create-tracking-options.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'create-tracking-options.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/create/index.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'index.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/list/list-aged-payables-by-contact.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'list-aged-payables-by-contact.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/list/list-aged-receivables-by-contact.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'list-aged-receivables-by-contact.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/list/list-bank-transactions.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'list-bank-transactions.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/list/list-tracking-categories.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'list-tracking-categories.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/update/update-contact.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'update-contact.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/update/update-tracking-category.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'update-tracking-category.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/src/tools/update/update-tracking-options.tool.ts", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'update-tracking-options.tool.ts' extension (.ts) suggests one format but Magika detected a different text format: JavaScript source (javascript). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/examples/openai-agents/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/examples/openai-agents/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" } ], "execution_duration_seconds": 61.676579759980086, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo", "openai-agents" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 3, "high": 1, "medium": 13, "critical": 0, "informational": 2 } }, "display_score": 13.0, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 66.0, "scanner_badge": "Caution", "findings": [ { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "AAK-SUPPLY-005", "title": "Dependency count exceeds threshold", "description": "More than 200 direct + transitive dependencies in lockfile. Each dependency is a trust decision.", "remediation": "Audit and remove unused dependencies. Consider lighter alternatives." }, { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "SECURITY.md", "line_number": null, "rule_identifier": "AAK-SEC-MD-001", "title": "MCP server repo missing SECURITY.md or security_contact", "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.", "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "mcp-config", "file_path": "src/server/xero-mcp-server.ts", "line_number": 1, "rule_identifier": "AAK-MCP-018", "title": "Missing rate limiting on MCP endpoint", "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.", "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "mcp-config", "file_path": "src/tools/tool-factory.ts", "line_number": 1, "rule_identifier": "AAK-MCP-018", "title": "Missing rate limiting on MCP endpoint", "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.", "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "package.json", "line_number": 27, "rule_identifier": "AAK-OAUTH-3P-001", "title": "Repo depends on a third-party agent-platform SDK", "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.", "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident" }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": "src/index.ts", "line_number": null, "rule_identifier": "AAK-ANTHROPIC-SDK-001", "title": "MCP server built on the upstream SDK without STDIO sanitizer", "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L", "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`." } ], "execution_duration_seconds": 29.14182960501057, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 143, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 2, "high": 1, "medium": 3, "critical": 0, "informational": 0 } }, "display_score": 66.0, "display_badge": "Caution" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 18.176760433008894, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 90.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "nerlo-behavioral", "severity": "medium", "category": "undisclosed-egress", "file_path": "/repo/src/clients/xero-client.ts", "line_number": 164, "rule_identifier": "opt.nerlo-rules.nerlo-hardcoded-external-egress", "title": "opt.nerlo-rules.nerlo-hardcoded-external-egress", "description": "Network request to a hardcoded external host/URL. Undisclosed egress in an MCP server is a common exfiltration channel \u2014 confirm it is expected.", "remediation": null }, { "tool_name": "nerlo-behavioral", "severity": "medium", "category": "undisclosed-egress", "file_path": "/repo/src/clients/xero-client.ts", "line_number": 178, "rule_identifier": "opt.nerlo-rules.nerlo-hardcoded-external-egress", "title": "opt.nerlo-rules.nerlo-hardcoded-external-egress", "description": "Network request to a hardcoded external host/URL. Undisclosed egress in an MCP server is a common exfiltration channel \u2014 confirm it is expected.", "remediation": null } ], "execution_duration_seconds": 59.80976568500046, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 133, "install_command": "pip install 'semgrep==1.97.0'", "severity_counts": { "low": 0, "high": 0, "medium": 2, "critical": 0, "informational": 0 } }, "display_score": 90.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 55.85829200199805, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 2, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42033", "title": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same ", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42035", "title": "axios: Axios: Arbitrary HTTP header injection via prototype pollution", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance an", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42043", "title": "axios: Axios: NO_PROXY bypass via crafted URL", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42264", "title": "axios: Axios: Prototype pollution allows information disclosure and request manipulation", "description": "Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request.", "remediation": "Upgrade axios from 1.15.0 to 1.15.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44486", "title": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019 Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. T", "remediation": "Upgrade axios from 1.15.0 to 1.16.0, 0.32.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44487", "title": "axios: Axios: Information disclosure of proxy credentials via redirect flows", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was in", "remediation": "Upgrade axios from 1.15.0 to 1.16.0, 0.32.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44488", "title": "axios: Axios: Denial of Service due to unenforced request and response size limits", "description": "Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usag", "remediation": "Upgrade axios from 1.15.0 to 1.16.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44492", "title": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vuln", "remediation": "Upgrade axios from 1.15.0 to 1.16.0, 0.32.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44494", "title": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution", "description": "Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack \u2014 intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, whic", "remediation": "Upgrade axios from 1.15.0 to 1.16.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44495", "title": "axios: Axios: Information disclosure due to prototype pollution vulnerability", "description": "Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-p", "remediation": "Upgrade axios from 1.15.0 to 1.15.2, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44496", "title": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name", "description": "Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the", "remediation": "Upgrade axios from 1.15.0 to 1.16.0, 0.32.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42034", "title": "axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42036", "title": "axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42037", "title": "axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header", "description": "Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypa", "remediation": "Upgrade axios from 1.15.0 to 1.15.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42038", "title": "axios: Axios: Information disclosure due to `no_proxy` bypass", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching \u2014 it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42039", "title": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42041", "title": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42042", "title": "axios: Axios: XSRF token bypass leading to information disclosure", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin s", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42044", "title": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget", "description": "Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses \u2014 including privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, ", "remediation": "Upgrade axios from 1.15.0 to 1.15.2 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44490", "title": "axios: Axios: Information disclosure and denial of service due to prototype pollution", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the mer", "remediation": "Upgrade axios from 1.15.0 to 1.16.0, 0.32.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-42h9-826w-cgv3", "title": "Axios: Excessive recursion in formDataToJSON can cause denial of service", "description": "## Summary\nAxios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData is sent with an `application/json` content type.\n\nApplications are affected when they pass attacker-controlled `FormData` field names into this functionality. A field name with thousands of nested bracket segments can exhaust the JavaScript call stack and throw `RangeError: ", "remediation": "Upgrade axios from 1.15.0 to 0.33.0, 1.18.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-7q8q-rj6j-mhjq", "title": "Axios: Nested axios option objects can consume polluted prototype values", "description": "## Summary\n\nAxios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.\n\nThe top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound re", "remediation": "Upgrade axios from 1.15.0 to 0.33.0, 1.18.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-f4gw-2p7v-4548", "title": "Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios", "description": "## Summary\n\nAxios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when evaluating `NO_PROXY` rules. In Node.js applications that use `HTTP_PROXY` or `HTTPS_PROXY` together with `NO_PROXY=localhost,127.0.0.1,::1` or similar, a request to `http://0.0.0.0:/` can be routed through the configured proxy instead of bypassing it.\n\nThe issue is exploitable when an attacker can influence the axios request URL or a followed redirect target, and when th", "remediation": "Upgrade axios from 1.15.0 to 1.18.0, 0.33.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-jqh4-m9w3-8hp9", "title": "Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`", "description": "## Summary\n\naxios\u2019 fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose size cannot be determined before dispatch. Applications that use `adapter: \"fetch\"` and rely on `maxBodyLength` to cap untrusted upload/proxy streams can send the full stream even when it exceeds the configured limit.\n\nThis affects fetch-adapter usage in edge runtimes where fetch is selected, and in Node.js or browser environments where the fetch adapter is explicitly selected.", "remediation": "Upgrade axios from 1.15.0 to 1.18.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-mmx7-hfxf-jppx", "title": "Axios: Prototype pollution gadgets can alter axios request construction", "description": "## Summary\n\naxios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: `axios.get()`, `axios.delete()`, `axios.head()`, and `axios.options()` read inherited `data` before config normalization, causing attacker-controlled body data to be sent on requests that did not explicitly set a body.\n\nAdditional low-level paths affect consumers that ", "remediation": "Upgrade axios from 1.15.0 to 1.18.0, 0.33.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-mwf2-3pr3-8698", "title": "Axios: HTTP/2 streamed uploads bypass `maxBodyLength`", "description": "## Summary\n\nAxios versions with Node.js HTTP/2 support allow streamed request bodies to bypass `maxBodyLength` enforcement when requests are sent with `httpVersion: 2`.\n\nThis affects applications that rely on `maxBodyLength` as a hard cap while forwarding attacker-controlled streams, such as upload endpoints proxying user data to an upstream HTTP/2 service. Buffered request bodies are still checked before the request is sent.\n\n## Impact\n\nAn attacker who can control a stream passed to axios can c", "remediation": "Upgrade axios from 1.15.0 to 1.18.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-pmv8-rq9r-6j72", "title": "Axios: Deep formToJSON Key Recursion Can Cause Denial of Service", "description": "## Summary\n\nAxios versions starting with `0.28.0` contain uncontrolled recursion in `formDataToJSON`, which is exposed as `axios.formToJSON()` and used internally when axios serialises `FormData` with `Content-Type: application/json`.\n\nIf an application passes attacker-controlled `FormData` field names to this functionality, a field name with thousands of nested bracket segments can exhaust the JavaScript call stack and cause denial of service for that request or, in applications without appropr", "remediation": "Upgrade axios from 1.15.0 to 0.33.0, 1.18.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42040", "title": "axios: Axios: Incorrect null byte handling can lead to data integrity issues", "description": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerab", "remediation": "Upgrade axios from 1.15.0 to 1.15.1, 0.31.1 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-12590", "title": "body-parser: body-parser: Denial of Service via invalid limit option", "description": "Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars", "remediation": "Upgrade body-parser from 2.2.2 to 1.20.6, 2.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-6321", "title": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies", "description": "fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Version", "remediation": "Upgrade fast-uri from 3.1.0 to 3.1.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-6322", "title": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling", "description": "fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a differ", "remediation": "Upgrade fast-uri from 3.1.0 to 3.1.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-12143", "title": "form-data: form-data: Form field override via CRLF injection", "description": "form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the atta", "remediation": "Upgrade form-data from 4.0.5 to 2.5.6, 3.0.5, 4.0.6 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54290", "title": "hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44455", "title": "hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4", "remediation": "Upgrade hono from 4.12.14 to 4.12.16 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44456", "title": "Hono: bodyLimit() can be bypassed for chunked / unknown-length requests", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.", "remediation": "Upgrade hono from 4.12.14 to 4.12.16 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44457", "title": "Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.", "remediation": "Upgrade hono from 4.12.14 to 4.12.18 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44458", "title": "Hono has CSS Declaration Injection via Style Object Values in JSX SSR", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18.", "remediation": "Upgrade hono from 4.12.14 to 4.12.18 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47673", "title": "Hono: JWT middleware accepts any Authorization scheme, not only Bearer", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value \u2014 regardless of the scheme name in the first position \u2014 proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is", "remediation": "Upgrade hono from 4.12.14 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47674", "title": "Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 ", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule \u2014 such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses \u2014 do not match the normalized rule entry, causing the ", "remediation": "Upgrade hono from 4.12.14 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47675", "title": "Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \\r, \\n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed ", "remediation": "Upgrade hono from 4.12.14 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47676", "title": "Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed", "remediation": "Upgrade hono from 4.12.14 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54286", "title": "hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54287", "title": "hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54288", "title": "hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54289", "title": "hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request mid", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44459", "title": "Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() \u2014 typically when the application itself issues such tokens, or when the signing key is otherwise unde", "remediation": "Upgrade hono from 4.12.14 to 4.12.18 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42338", "title": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input", "description": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods,", "remediation": "Upgrade ip-address from 10.1.0 to 10.1.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-8723", "title": "### Summary `qs.stringify` throws `TypeError` when called with `arr ...", "description": "### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti", "remediation": "Upgrade qs from 6.14.2 to 6.15.2 or later" } ], "execution_duration_seconds": 1.8013843370135874, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "severity_counts": { "low": 3, "high": 15, "medium": 30, "critical": 0, "informational": 0 }, "manifests_scanned": [ "package-lock.json" ] }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-35jp-ww65-95wh", "title": "GHSA-35jp-ww65-95wh \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44494, GHSA-35jp-ww65-95wh | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3g43-6gmg-66jw", "title": "GHSA-3g43-6gmg-66jw \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44495, GHSA-3g43-6gmg-66jw | CVSS: 7.0", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3w6x-2g7m-8v23", "title": "GHSA-3w6x-2g7m-8v23 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42044, GHSA-3w6x-2g7m-8v23 | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-42h9-826w-cgv3", "title": "GHSA-42h9-826w-cgv3 \u2014 npm axios@1.15.0", "description": "aliases: GHSA-42h9-826w-cgv3 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-445q-vr5w-6q77", "title": "GHSA-445q-vr5w-6q77 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42037, GHSA-445q-vr5w-6q77 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-5c9x-8gcm-mpgx", "title": "GHSA-5c9x-8gcm-mpgx \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42034, GHSA-5c9x-8gcm-mpgx | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-62hf-57xw-28j9", "title": "GHSA-62hf-57xw-28j9 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42039, GHSA-62hf-57xw-28j9 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-6chq-wfr3-2hj9", "title": "GHSA-6chq-wfr3-2hj9 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42035, GHSA-6chq-wfr3-2hj9 | CVSS: 7.4", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-777c-7fjr-54vf", "title": "GHSA-777c-7fjr-54vf \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44488, GHSA-777c-7fjr-54vf | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-7q8q-rj6j-mhjq", "title": "GHSA-7q8q-rj6j-mhjq \u2014 npm axios@1.15.0", "description": "aliases: GHSA-7q8q-rj6j-mhjq | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-898c-q2cr-xwhg", "title": "GHSA-898c-q2cr-xwhg \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44490, GHSA-898c-q2cr-xwhg | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-f4gw-2p7v-4548", "title": "GHSA-f4gw-2p7v-4548 \u2014 npm axios@1.15.0", "description": "aliases: GHSA-f4gw-2p7v-4548 | CVSS: 6.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-hfxv-24rg-xrqf", "title": "GHSA-hfxv-24rg-xrqf \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44496, GHSA-hfxv-24rg-xrqf | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-j5f8-grm9-p9fc", "title": "GHSA-j5f8-grm9-p9fc \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44486, GHSA-j5f8-grm9-p9fc | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-jqh4-m9w3-8hp9", "title": "GHSA-jqh4-m9w3-8hp9 \u2014 npm axios@1.15.0", "description": "aliases: GHSA-jqh4-m9w3-8hp9 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-m7pr-hjqh-92cm", "title": "GHSA-m7pr-hjqh-92cm \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42038, GHSA-m7pr-hjqh-92cm | CVSS: 6.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-mmx7-hfxf-jppx", "title": "GHSA-mmx7-hfxf-jppx \u2014 npm axios@1.15.0", "description": "aliases: GHSA-mmx7-hfxf-jppx | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-mwf2-3pr3-8698", "title": "GHSA-mwf2-3pr3-8698 \u2014 npm axios@1.15.0", "description": "aliases: GHSA-mwf2-3pr3-8698 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-p92q-9vqr-4j8v", "title": "GHSA-p92q-9vqr-4j8v \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44487, GHSA-p92q-9vqr-4j8v | CVSS: 8.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-pf86-5x62-jrwf", "title": "GHSA-pf86-5x62-jrwf \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42033, GHSA-pf86-5x62-jrwf | CVSS: 7.4", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-pjwm-pj3p-43mv", "title": "GHSA-pjwm-pj3p-43mv \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-44492, GHSA-pjwm-pj3p-43mv | CVSS: 8.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-pmv8-rq9r-6j72", "title": "GHSA-pmv8-rq9r-6j72 \u2014 npm axios@1.15.0", "description": "aliases: GHSA-pmv8-rq9r-6j72 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-pmwg-cvhr-8vh7", "title": "GHSA-pmwg-cvhr-8vh7 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42043, GHSA-pmwg-cvhr-8vh7 | CVSS: 7.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-q8qp-cvcw-x6jj", "title": "GHSA-q8qp-cvcw-x6jj \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42264, GHSA-q8qp-cvcw-x6jj | CVSS: 7.4", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-vf2m-468p-8v99", "title": "GHSA-vf2m-468p-8v99 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42036, GHSA-vf2m-468p-8v99 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-w9j2-pvgh-6h63", "title": "GHSA-w9j2-pvgh-6h63 \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42041, GHSA-w9j2-pvgh-6h63 | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-xhjh-pmcv-23jw", "title": "GHSA-xhjh-pmcv-23jw \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42040, GHSA-xhjh-pmcv-23jw | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-xx6v-rp6x-q39c", "title": "GHSA-xx6v-rp6x-q39c \u2014 npm axios@1.15.0", "description": "aliases: CVE-2026-42042, GHSA-xx6v-rp6x-q39c | CVSS: 5.4", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v422-hmwv-36x6", "title": "GHSA-v422-hmwv-36x6 \u2014 npm body-parser@2.2.2", "description": "aliases: CVE-2026-12590, GHSA-v422-hmwv-36x6 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3jxr-9vmj-r5cp", "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@1.1.14", "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3jxr-9vmj-r5cp", "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@2.1.0", "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-q3j6-qgpj-74h6", "title": "GHSA-q3j6-qgpj-74h6 \u2014 npm fast-uri@3.1.0", "description": "aliases: CVE-2026-6321, GHSA-q3j6-qgpj-74h6 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v39h-62p7-jpjc", "title": "GHSA-v39h-62p7-jpjc \u2014 npm fast-uri@3.1.0", "description": "aliases: CVE-2026-6322, GHSA-v39h-62p7-jpjc | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-hmw2-7cc7-3qxx", "title": "GHSA-hmw2-7cc7-3qxx \u2014 npm form-data@4.0.5", "description": "aliases: CVE-2026-12143, GHSA-hmw2-7cc7-3qxx | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-2gcr-mfcq-wcc3", "title": "GHSA-2gcr-mfcq-wcc3 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-47676, GHSA-2gcr-mfcq-wcc3 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3hrh-pfw6-9m5x", "title": "GHSA-3hrh-pfw6-9m5x \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-47675, GHSA-3hrh-pfw6-9m5x | CVSS: 4.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-69xw-7hcm-h432", "title": "GHSA-69xw-7hcm-h432 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44455, GHSA-69xw-7hcm-h432 | CVSS: 4.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-88fw-hqm2-52qc", "title": "GHSA-88fw-hqm2-52qc \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54290, GHSA-88fw-hqm2-52qc | CVSS: 7.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-9vqf-7f2p-gf9v", "title": "GHSA-9vqf-7f2p-gf9v \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44456, GHSA-9vqf-7f2p-gf9v | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-f577-qrjj-4474", "title": "GHSA-f577-qrjj-4474 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-47673, GHSA-f577-qrjj-4474 | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-hm8q-7f3q-5f36", "title": "GHSA-hm8q-7f3q-5f36 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44459, GHSA-hm8q-7f3q-5f36 | CVSS: 3.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-j6c9-x7qj-28xf", "title": "GHSA-j6c9-x7qj-28xf \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54287, GHSA-j6c9-x7qj-28xf | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-p77w-8qqv-26rm", "title": "GHSA-p77w-8qqv-26rm \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44457, GHSA-p77w-8qqv-26rm | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-qp7p-654g-cw7p", "title": "GHSA-qp7p-654g-cw7p \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44458, GHSA-qp7p-654g-cw7p | CVSS: 4.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-rv63-4mwf-qqc2", "title": "GHSA-rv63-4mwf-qqc2 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54288, GHSA-rv63-4mwf-qqc2 | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-wgpf-jwqj-8h8p", "title": "GHSA-wgpf-jwqj-8h8p \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54289, GHSA-wgpf-jwqj-8h8p | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-wwfh-h76j-fc44", "title": "GHSA-wwfh-h76j-fc44 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54286, GHSA-wwfh-h76j-fc44 | CVSS: 5.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-xrhx-7g5j-rcj5", "title": "GHSA-xrhx-7g5j-rcj5 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-47674, GHSA-xrhx-7g5j-rcj5 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v2v4-37r5-5v8g", "title": "GHSA-v2v4-37r5-5v8g \u2014 npm ip-address@10.1.0", "description": "aliases: CVE-2026-42338, GHSA-v2v4-37r5-5v8g | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-52cp-r559-cp3m", "title": "GHSA-52cp-r559-cp3m \u2014 npm js-yaml@4.1.1", "description": "aliases: CVE-2026-59869, GHSA-52cp-r559-cp3m | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-h67p-54hq-rp68", "title": "GHSA-h67p-54hq-rp68 \u2014 npm js-yaml@4.1.1", "description": "aliases: CVE-2026-53550, GHSA-h67p-54hq-rp68 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-q8mj-m7cp-5q26", "title": "GHSA-q8mj-m7cp-5q26 \u2014 npm qs@6.14.2", "description": "aliases: CVE-2026-8723, GHSA-q8mj-m7cp-5q26 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-fx2h-pf6j-xcff", "title": "GHSA-fx2h-pf6j-xcff \u2014 npm vite@8.0.14", "description": "aliases: CVE-2026-53571, GHSA-fx2h-pf6j-xcff | CVSS: 8.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v6wh-96g9-6wx3", "title": "GHSA-v6wh-96g9-6wx3 \u2014 npm vite@8.0.14", "description": "aliases: CVE-2026-53632, GHSA-v6wh-96g9-6wx3 | CVSS: 5.5", "remediation": null } ], "execution_duration_seconds": 35.84983584698057, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "npm" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 3, "high": 20, "medium": 31, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/package-lock.json" ], "finding_id_aliases": { "GHSA-2gcr-mfcq-wcc3": [ "CVE-2026-47676" ], "GHSA-35jp-ww65-95wh": [ "CVE-2026-44494" ], "GHSA-3g43-6gmg-66jw": [ "CVE-2026-44495" ], "GHSA-3hrh-pfw6-9m5x": [ "CVE-2026-47675" ], "GHSA-3jxr-9vmj-r5cp": [ "CVE-2026-13149", "CVE-2026-13149" ], "GHSA-3w6x-2g7m-8v23": [ "CVE-2026-42044" ], "GHSA-445q-vr5w-6q77": [ "CVE-2026-42037" ], "GHSA-52cp-r559-cp3m": [ "CVE-2026-59869" ], "GHSA-5c9x-8gcm-mpgx": [ "CVE-2026-42034" ], "GHSA-62hf-57xw-28j9": [ "CVE-2026-42039" ], "GHSA-69xw-7hcm-h432": [ "CVE-2026-44455" ], "GHSA-6chq-wfr3-2hj9": [ "CVE-2026-42035" ], "GHSA-777c-7fjr-54vf": [ "CVE-2026-44488" ], "GHSA-88fw-hqm2-52qc": [ "CVE-2026-54290" ], "GHSA-898c-q2cr-xwhg": [ "CVE-2026-44490" ], "GHSA-9vqf-7f2p-gf9v": [ "CVE-2026-44456" ], "GHSA-f577-qrjj-4474": [ "CVE-2026-47673" ], "GHSA-fx2h-pf6j-xcff": [ "CVE-2026-53571" ], "GHSA-h67p-54hq-rp68": [ "CVE-2026-53550" ], "GHSA-hfxv-24rg-xrqf": [ "CVE-2026-44496" ], "GHSA-hm8q-7f3q-5f36": [ "CVE-2026-44459" ], "GHSA-hmw2-7cc7-3qxx": [ "CVE-2026-12143" ], "GHSA-j5f8-grm9-p9fc": [ "CVE-2026-44486" ], "GHSA-j6c9-x7qj-28xf": [ "CVE-2026-54287" ], "GHSA-m7pr-hjqh-92cm": [ "CVE-2026-42038" ], "GHSA-p77w-8qqv-26rm": [ "CVE-2026-44457" ], "GHSA-p92q-9vqr-4j8v": [ "CVE-2026-44487" ], "GHSA-pf86-5x62-jrwf": [ "CVE-2026-42033" ], "GHSA-pjwm-pj3p-43mv": [ "CVE-2026-44492" ], "GHSA-pmwg-cvhr-8vh7": [ "CVE-2026-42043" ], "GHSA-q3j6-qgpj-74h6": [ "CVE-2026-6321" ], "GHSA-q8mj-m7cp-5q26": [ "CVE-2026-8723" ], "GHSA-q8qp-cvcw-x6jj": [ "CVE-2026-42264" ], "GHSA-qp7p-654g-cw7p": [ "CVE-2026-44458" ], "GHSA-rv63-4mwf-qqc2": [ "CVE-2026-54288" ], "GHSA-v2v4-37r5-5v8g": [ "CVE-2026-42338" ], "GHSA-v39h-62p7-jpjc": [ "CVE-2026-6322" ], "GHSA-v422-hmwv-36x6": [ "CVE-2026-12590" ], "GHSA-v6wh-96g9-6wx3": [ "CVE-2026-53632" ], "GHSA-vf2m-468p-8v99": [ "CVE-2026-42036" ], "GHSA-w9j2-pvgh-6h63": [ "CVE-2026-42041" ], "GHSA-wgpf-jwqj-8h8p": [ "CVE-2026-54289" ], "GHSA-wwfh-h76j-fc44": [ "CVE-2026-54286" ], "GHSA-xhjh-pmcv-23jw": [ "CVE-2026-42040" ], "GHSA-xrhx-7g5j-rcj5": [ "CVE-2026-47674" ], "GHSA-xx6v-rp6x-q39c": [ "CVE-2026-42042" ] }, "cross_scanner_correlation": { "only_osv": [ "GHSA-3jxr-9vmj-r5cp", "GHSA-52cp-r559-cp3m", "GHSA-fx2h-pf6j-xcff", "GHSA-h67p-54hq-rp68", "GHSA-v6wh-96g9-6wx3" ], "only_trivy": [], "intersection_ids": [ "CVE-2026-12143", "CVE-2026-12590", "CVE-2026-42033", "CVE-2026-42034", "CVE-2026-42035", "CVE-2026-42036", "CVE-2026-42037", "CVE-2026-42038", "CVE-2026-42039", "CVE-2026-42040", "CVE-2026-42041", "CVE-2026-42042", "CVE-2026-42043", "CVE-2026-42044", "CVE-2026-42264", "CVE-2026-42338", "CVE-2026-44455", "CVE-2026-44456", "CVE-2026-44457", "CVE-2026-44458", "CVE-2026-44459", "CVE-2026-44486", "CVE-2026-44487", "CVE-2026-44488", "CVE-2026-44490", "CVE-2026-44492", "CVE-2026-44494", "CVE-2026-44495", "CVE-2026-44496", "CVE-2026-47673", "CVE-2026-47674", "CVE-2026-47675", "CVE-2026-47676", "CVE-2026-54286", "CVE-2026-54287", "CVE-2026-54288", "CVE-2026-54289", "CVE-2026-54290", "CVE-2026-6321", "CVE-2026-6322", "CVE-2026-8723", "GHSA-42h9-826w-cgv3", "GHSA-7q8q-rj6j-mhjq", "GHSA-f4gw-2p7v-4548", "GHSA-jqh4-m9w3-8hp9", "GHSA-mmx7-hfxf-jppx", "GHSA-mwf2-3pr3-8698", "GHSA-pmv8-rq9r-6j72" ] } }, "display_score": 0.0, "display_badge": "Unsafe" } ] }, "report": { "report_id": "5d4a52da-4be6-4b9c-8a20-5ca5fd969299", "format": "json", "generated_at": "2026-07-23T00:33:57.821994+00:00", "scanner_filter": null, "signature": null } }