# Security Audit Report — @anaisbetts/mcp-installer

- **Report ID:** `6adcfd87-852c-4e5b-ab6d-0724a0ca868f`
- **Generated:** 2026-07-21T17:44:31.505459+00:00
- **Signature:** unsigned (cosign keyless signing runs in CI; Req 22.4)

## 1. Executive Summary

**Badge:** Unsafe (composite)  
**Security score:** 52.04

| Scanner | Badge |
| --- | --- |
| agent-audit-kit | Caution |
| agentshield | Verified |
| bearer | Verified |
| cisco-skill-scanner | Verified |
| nerlo-behavioral | Verified |
| nerlo-install-instruction | Verified |
| osv-scanner | Unsafe |
| trivy | Unsafe |

| Severity | Findings |
| --- | --- |
| critical | 0 |
| high | 16 |
| medium | 5 |
| low | 6 |

@anaisbetts/mcp-installer is NOT recommended for integration: the scan surfaced 0 critical and 16 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering.

## 2. Source Provenance

- **Repository:** https://github.com/anaisbetts/mcp-installer
- **Commit scanned:** `unknown`
- **License:** MIT
- **Maintainer:** Ani Betts <anais@anaisbetts.org>
- **Version:** 0.5.0

## 3. Per-Scanner Detail

### agentshield (v1.4.0) — Verified / 100.0

No findings.

### cisco-skill-scanner (v2.0.11) — Verified / 92.5

- **[medium] Moderate analyzability score** — Only 89% of skill content could be analyzed. 1 of 10 files are opaque to the scanner. Some content could not be verified as safe. (/repo:None)
- **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/SKILL.md:None)
- **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/SKILL.md:None)

### agent-audit-kit (v0.3.26) — Caution / 78.0

- **[low] MCP server repo missing SECURITY.md or security_contact** — A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a 'security_contact' entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel. (SECURITY.md:None)
- **[medium] Repo depends on a third-party agent-platform SDK** — The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel × Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants. (package.json:15)
- **[high] Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)** — A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python 'mcp' >= 1.23.0, TS '@modelcontextprotocol/sdk' >= 1.21.1, Java 'io.modelcontextprotocol.sdk:mcp-core' >= 0.11.0, '@apollo/mcp-server' >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug. (package.json:None)

### bearer (v2.0.2) — Verified / 100.0

No findings.

### nerlo-behavioral (v0.1.0) — Verified / 100.0

No findings.

### nerlo-install-instruction (v0.1.0) — Verified / 100.0

No findings.

### trivy (v0.71.0) — Unsafe / 18.0

- **[high] Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default** — MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy rest (package-lock.json:None)
- **[medium] brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern** — The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., '{1..2..0}') causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to 'expand()' to ensure a step value of '0' is not used. (package-lock.json:None)
- **[low] brace-expansion: juliangruber brace-expansion index.js expand redos** — A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 i (package-lock.json:None)
- **[high] glob: glob: Command Injection Vulnerability via Malicious Filenames** — Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <command> <patterns> are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under th (package-lock.json:None)
- **[high] minimatch: minimatch: Denial of Service via specially crafted glob patterns** — minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N)  (package-lock.json:None)
- **[high] minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns** — minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, 'matchOne()' performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent '**' (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where 'n' is the number of path segments and 'k' is the number of globstars. With k=11 and n=30, a call (package-lock.json:None)
- **[high] minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions** — minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested '*()' extglobs produce regexps with nested unbounded quantifiers (e.g. '(?:(?:a\|b)*)*'), which exhibit catastrophic backtracking in V8. With a 12-byte pattern '*(*(*(a\|b)))' and an 18-byte non-matching input, 'minimatch()' stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe (package-lock.json:None)

### osv-scanner (v2.3.8) — Unsafe / 0.0

- **[high] GHSA-w48q-cv73-mx4w — npm @modelcontextprotocol/sdk@1.0.1** — aliases: CVE-2025-66414, GHSA-w48q-cv73-mx4w \| CVSS: 7.6 (/repo/package-lock.json:None)
- **[high] GHSA-3jxr-9vmj-r5cp — npm brace-expansion@1.1.11** — aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp \| CVSS: 7.7 (/repo/package-lock.json:None)
- **[medium] GHSA-f886-m6hf-6m8v — npm brace-expansion@1.1.11** — aliases: CVE-2026-33750, GHSA-f886-m6hf-6m8v \| CVSS: 6.5 (/repo/package-lock.json:None)
- **[low] GHSA-v6h2-p8h4-qcjw — npm brace-expansion@1.1.11** — aliases: CVE-2025-5889, GHSA-v6h2-p8h4-qcjw \| CVSS: 3.1 (/repo/package-lock.json:None)
- **[high] GHSA-3jxr-9vmj-r5cp — npm brace-expansion@2.0.1** — aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp \| CVSS: 7.7 (/repo/package-lock.json:None)
- **[medium] GHSA-f886-m6hf-6m8v — npm brace-expansion@2.0.1** — aliases: CVE-2026-33750, GHSA-f886-m6hf-6m8v \| CVSS: 6.5 (/repo/package-lock.json:None)
- **[low] GHSA-v6h2-p8h4-qcjw — npm brace-expansion@2.0.1** — aliases: CVE-2025-5889, GHSA-v6h2-p8h4-qcjw \| CVSS: 3.1 (/repo/package-lock.json:None)
- **[low] GHSA-73rr-hh4g-fpgx — npm diff@4.0.2** — aliases: CVE-2026-24001, GHSA-73rr-hh4g-fpgx \| CVSS: 2.7 (/repo/package-lock.json:None)
- **[high] GHSA-5j98-mcp5-4vw2 — npm glob@11.0.0** — aliases: CVE-2025-64756, GHSA-5j98-mcp5-4vw2 \| CVSS: 7.5 (/repo/package-lock.json:None)
- **[high] GHSA-23c5-xmqv-rm74 — npm minimatch@10.0.1** — aliases: CVE-2026-27904, GHSA-23c5-xmqv-rm74 \| CVSS: 7.5 (/repo/package-lock.json:None)
- **[high] GHSA-3ppc-4f35-3m26 — npm minimatch@10.0.1** — aliases: CVE-2026-26996, GHSA-3ppc-4f35-3m26 \| CVSS: 8.7 (/repo/package-lock.json:None)
- **[high] GHSA-7r86-cg39-jmmj — npm minimatch@10.0.1** — aliases: CVE-2026-27903, GHSA-7r86-cg39-jmmj \| CVSS: 7.5 (/repo/package-lock.json:None)
- **[high] GHSA-23c5-xmqv-rm74 — npm minimatch@3.1.2** — aliases: CVE-2026-27904, GHSA-23c5-xmqv-rm74 \| CVSS: 7.5 (/repo/package-lock.json:None)
- **[high] GHSA-3ppc-4f35-3m26 — npm minimatch@3.1.2** — aliases: CVE-2026-26996, GHSA-3ppc-4f35-3m26 \| CVSS: 8.7 (/repo/package-lock.json:None)
- **[high] GHSA-7r86-cg39-jmmj — npm minimatch@3.1.2** — aliases: CVE-2026-27903, GHSA-7r86-cg39-jmmj \| CVSS: 7.5 (/repo/package-lock.json:None)

## 4. Threat Model

Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.

## 5. Audit Chain

- **Scan job:** `e3047945-8074-480a-b505-5360bc55f13f`
- **Completed:** 2026-07-21T01:06:55.672389+00:00
- **Scanner base image:** `us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:ef7da8218b19aeb9d792be4a8df36d0f2aacd0b5abe27ad406095abff0ec1f32`
- **AI decision log entries:** 1
  - `8679c8e0-3f29-453d-b0f6-f9fcdce0a7e7`

## 6. Appendix — Raw Scanner Output

```json
[
  {
    "scanner_name": "agentshield",
    "scanner_version": "1.4.0",
    "score": 100.0,
    "scanner_badge": "Verified",
    "findings": [],
    "execution_duration_seconds": 6.820380174001912,
    "status": "complete",
    "metadata": {
      "source": "npm",
      "source_url": "https://www.npmjs.com/package/ecc-agentshield",
      "install_command": "npm install -g ecc-agentshield@1.4.0",
      "scans_performed": [
        "supply_chain"
      ]
    },
    "display_score": 100.0,
    "display_badge": "Verified"
  },
  {
    "scanner_name": "cisco-skill-scanner",
    "scanner_version": "2.0.11",
    "score": 92.5,
    "scanner_badge": "Verified",
    "findings": [
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "medium",
        "category": "policy_violation",
        "file_path": "/repo",
        "line_number": null,
        "rule_identifier": "LOW_ANALYZABILITY",
        "title": "Moderate analyzability score",
        "description": "Only 89% of skill content could be analyzed. 1 of 10 files are opaque to the scanner. Some content could not be verified as safe.",
        "remediation": "Review opaque files and replace with inspectable formats where possible."
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "low",
        "category": "social_engineering",
        "file_path": "/repo/SKILL.md",
        "line_number": null,
        "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
        "title": "Vague skill description",
        "description": "Skill description is too short (16 chars). Provide detailed explanation.",
        "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
      },
      {
        "tool_name": "cisco-skill-scanner",
        "severity": "informational",
        "category": "policy_violation",
        "file_path": "/repo/SKILL.md",
        "line_number": null,
        "rule_identifier": "MANIFEST_MISSING_LICENSE",
        "title": "Skill does not specify a license",
        "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
        "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
      }
    ],
    "execution_duration_seconds": 32.95143884899153,
    "status": "complete",
    "metadata": {
      "source": "pypi",
      "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
      "report_type": "cisco-skill-sast",
      "analyzers_used": [
        "bytecode",
        "pipeline",
        "static_analyzer"
      ],
      "skills_scanned": [
        "repo"
      ],
      "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
      "severity_counts": {
        "low": 1,
        "high": 0,
        "medium": 1,
        "critical": 0,
        "informational": 1
      }
    },
    "display_score": 92.5,
    "display_badge": "Verified"
  },
  {
    "scanner_name": "agent-audit-kit",
    "scanner_version": "0.3.26",
    "score": 78.0,
    "scanner_badge": "Caution",
    "findings": [
      {
        "tool_name": "agent-audit-kit",
        "severity": "low",
        "category": "supply-chain",
        "file_path": "SECURITY.md",
        "line_number": null,
        "rule_identifier": "AAK-SEC-MD-001",
        "title": "MCP server repo missing SECURITY.md or security_contact",
        "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.",
        "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest."
      },
      {
        "tool_name": "agent-audit-kit",
        "severity": "medium",
        "category": "supply-chain",
        "file_path": "package.json",
        "line_number": 15,
        "rule_identifier": "AAK-OAUTH-3P-001",
        "title": "Repo depends on a third-party agent-platform SDK",
        "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.",
        "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
      },
      {
        "tool_name": "agent-audit-kit",
        "severity": "high",
        "category": "supply-chain",
        "file_path": "package.json",
        "line_number": null,
        "rule_identifier": "AAK-DNS-REBIND-002",
        "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)",
        "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.",
        "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)."
      }
    ],
    "execution_duration_seconds": 10.556403246009722,
    "status": "complete",
    "metadata": {
      "source": "pypi",
      "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
      "report_type": "agent-audit-kit-sast",
      "files_scanned": 7,
      "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
      "rules_evaluated": 211,
      "severity_counts": {
        "low": 1,
        "high": 1,
        "medium": 1,
        "critical": 0,
        "informational": 0
      }
    },
    "display_score": 78.0,
    "display_badge": "Caution"
  },
  {
    "scanner_name": "bearer",
    "scanner_version": "2.0.2",
    "score": 100.0,
    "scanner_badge": "Verified",
    "findings": [],
    "execution_duration_seconds": 15.370224051992409,
    "status": "complete",
    "metadata": {
      "source": "github-releases",
      "source_url": "https://github.com/Bearer/bearer",
      "report_type": "security",
      "rules_loaded": 1,
      "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\""
    },
    "display_score": 100.0,
    "display_badge": "Verified"
  },
  {
    "scanner_name": "nerlo-behavioral",
    "scanner_version": "0.1.0",
    "score": 100.0,
    "scanner_badge": "Verified",
    "findings": [],
    "execution_duration_seconds": 49.4616827830032,
    "status": "complete",
    "metadata": {
      "source": "nerlo-original",
      "source_url": "https://github.com/nerlo-ai/nerlo",
      "report_type": "nerlo-behavioral",
      "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
      "files_scanned": 1,
      "install_command": "pip install 'semgrep==1.97.0'"
    },
    "display_score": 100.0,
    "display_badge": "Verified"
  },
  {
    "scanner_name": "nerlo-install-instruction",
    "scanner_version": "0.1.0",
    "score": 100.0,
    "scanner_badge": "Verified",
    "findings": [],
    "execution_duration_seconds": 49.404199351003626,
    "status": "complete",
    "metadata": {
      "source": "nerlo-original",
      "source_url": "https://github.com/nerlo-ai/nerlo",
      "report_type": "nerlo-install-instruction",
      "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
      "files_scanned": 2,
      "install_command": "pip install 'semgrep==1.97.0'"
    },
    "display_score": 100.0,
    "display_badge": "Verified"
  },
  {
    "scanner_name": "trivy",
    "scanner_version": "0.71.0",
    "score": 18.0,
    "scanner_badge": "Unsafe",
    "findings": [
      {
        "tool_name": "trivy",
        "severity": "high",
        "category": "npm",
        "file_path": "package-lock.json",
        "line_number": null,
        "rule_identifier": "CVE-2025-66414",
        "title": "Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default",
        "description": "MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy rest",
        "remediation": "Upgrade @modelcontextprotocol/sdk from 1.0.1 to 1.24.0 or later"
      },
      {
        "tool_name": "trivy",
        "severity": "medium",
        "category": "npm",
        "file_path": "package-lock.json",
        "line_number": null,
        "rule_identifier": "CVE-2026-33750",
        "title": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern",
        "description": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.",
        "remediation": "Upgrade brace-expansion from 2.0.1 to 5.0.5, 3.0.2, 2.0.3, 1.1.13 or later"
      },
      {
        "tool_name": "trivy",
        "severity": "low",
        "category": "npm",
        "file_path": "package-lock.json",
        "line_number": null,
        "rule_identifier": "CVE-2025-5889",
        "title": "brace-expansion: juliangruber brace-expansion index.js expand redos",
        "description": "A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 i",
        "remediation": "Upgrade brace-expansion from 2.0.1 to 2.0.2, 1.1.12, 3.0.1, 4.0.1 or later"
      },
      {
        "tool_name": "trivy",
        "severity": "high",
        "category": "npm",
        "file_path": "package-lock.json",
        "line_number": null,
        "rule_identifier": "CVE-2025-64756",
        "title": "glob: glob: Command Injection Vulnerability via Malicious Filenames",
        "description": "Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <command> <patterns> are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under th",
        "remediation": "Upgrade glob from 11.0.0 to 11.1.0, 10.5.0 or later"
      },
      {
        "tool_name": "trivy",
        "severity": "high",
        "category": "npm",
        "file_path": "package-lock.json",
        "line_number": null,
        "rule_identifier": "CVE-2026-26996",
        "title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns",
        "description": "minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) ",
        "remediation": "Upgrade minimatch from 10.0.1 to 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 or later"
      },
      {
        "tool_name": "trivy",
        "severity": "high",
        "category": "npm",
        "file_path": "package-lock.json",
        "line_number": null,
        "rule_identifier": "CVE-2026-27903",
        "title": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns",
        "description": "minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call",
        "remediation": "Upgrade minimatch from 10.0.1 to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 or later"
      },
      {
        "tool_name": "trivy",
        "severity": "high",
        "category": "npm",
        "file_path": "package-lock.json",
        "line_number": null,
        "rule_identifier": "CVE-2026-27904",
        "title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions",
        "description": "minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe",
        "remediation": "Upgrade minimatch from 10.0.1 to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 or later"
      }
    ],
    "execution_duration_seconds": 1.5594080970040523,
    "status": "complete",
    "metadata": {
      "source": "github-releases",
      "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
      "report_type": "filesystem-vulnerability",
      "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
      "severity_counts": {
        "low": 1,
        "high": 5,
        "medium": 1,
        "critical": 0,
        "informational": 0
      },
      "manifests_scanned": [
        "package-lock.json"
      ]
    },
    "display_score": 18.0,
    "display_badge": "Unsafe"
  },
  {
    "scanner_name": "osv-scanner",
    "scanner_version": "2.3.8",
    "score": 0.0,
    "scanner_badge": "Unsafe",
    "findings": [
      {
        "tool_name": "osv-scanner",
        "severity": "high",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-w48q-cv73-mx4w",
        "title": "GHSA-w48q-cv73-mx4w \u2014 npm @modelcontextprotocol/sdk@1.0.1",
        "description": "aliases: CVE-2025-66414, GHSA-w48q-cv73-mx4w | CVSS: 7.6",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "high",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-3jxr-9vmj-r5cp",
        "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@1.1.11",
        "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "medium",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-f886-m6hf-6m8v",
        "title": "GHSA-f886-m6hf-6m8v \u2014 npm brace-expansion@1.1.11",
        "description": "aliases: CVE-2026-33750, GHSA-f886-m6hf-6m8v | CVSS: 6.5",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "low",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-v6h2-p8h4-qcjw",
        "title": "GHSA-v6h2-p8h4-qcjw \u2014 npm brace-expansion@1.1.11",
        "description": "aliases: CVE-2025-5889, GHSA-v6h2-p8h4-qcjw | CVSS: 3.1",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "high",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-3jxr-9vmj-r5cp",
        "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@2.0.1",
        "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "medium",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-f886-m6hf-6m8v",
        "title": "GHSA-f886-m6hf-6m8v \u2014 npm brace-expansion@2.0.1",
        "description": "aliases: CVE-2026-33750, GHSA-f886-m6hf-6m8v | CVSS: 6.5",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "low",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-v6h2-p8h4-qcjw",
        "title": "GHSA-v6h2-p8h4-qcjw \u2014 npm brace-expansion@2.0.1",
        "description": "aliases: CVE-2025-5889, GHSA-v6h2-p8h4-qcjw | CVSS: 3.1",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "low",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-73rr-hh4g-fpgx",
        "title": "GHSA-73rr-hh4g-fpgx \u2014 npm diff@4.0.2",
        "description": "aliases: CVE-2026-24001, GHSA-73rr-hh4g-fpgx | CVSS: 2.7",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "high",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-5j98-mcp5-4vw2",
        "title": "GHSA-5j98-mcp5-4vw2 \u2014 npm glob@11.0.0",
        "description": "aliases: CVE-2025-64756, GHSA-5j98-mcp5-4vw2 | CVSS: 7.5",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "high",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-23c5-xmqv-rm74",
        "title": "GHSA-23c5-xmqv-rm74 \u2014 npm minimatch@10.0.1",
        "description": "aliases: CVE-2026-27904, GHSA-23c5-xmqv-rm74 | CVSS: 7.5",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "high",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-3ppc-4f35-3m26",
        "title": "GHSA-3ppc-4f35-3m26 \u2014 npm minimatch@10.0.1",
        "description": "aliases: CVE-2026-26996, GHSA-3ppc-4f35-3m26 | CVSS: 8.7",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "high",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-7r86-cg39-jmmj",
        "title": "GHSA-7r86-cg39-jmmj \u2014 npm minimatch@10.0.1",
        "description": "aliases: CVE-2026-27903, GHSA-7r86-cg39-jmmj | CVSS: 7.5",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "high",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-23c5-xmqv-rm74",
        "title": "GHSA-23c5-xmqv-rm74 \u2014 npm minimatch@3.1.2",
        "description": "aliases: CVE-2026-27904, GHSA-23c5-xmqv-rm74 | CVSS: 7.5",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "high",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-3ppc-4f35-3m26",
        "title": "GHSA-3ppc-4f35-3m26 \u2014 npm minimatch@3.1.2",
        "description": "aliases: CVE-2026-26996, GHSA-3ppc-4f35-3m26 | CVSS: 8.7",
        "remediation": null
      },
      {
        "tool_name": "osv-scanner",
        "severity": "high",
        "category": "npm",
        "file_path": "/repo/package-lock.json",
        "line_number": null,
        "rule_identifier": "GHSA-7r86-cg39-jmmj",
        "title": "GHSA-7r86-cg39-jmmj \u2014 npm minimatch@3.1.2",
        "description": "aliases: CVE-2026-27903, GHSA-7r86-cg39-jmmj | CVSS: 7.5",
        "remediation": null
      }
    ],
    "execution_duration_seconds": 26.41572135098977,
    "status": "complete",
    "metadata": {
      "source": "github-releases",
      "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
      "report_type": "osv-vulnerability",
      "ecosystems_seen": [
        "npm"
      ],
      "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
      "severity_counts": {
        "low": 3,
        "high": 10,
        "medium": 2,
        "critical": 0,
        "informational": 0
      },
      "manifests_scanned": [
        "/repo/package-lock.json"
      ],
      "finding_id_aliases": {
        "GHSA-23c5-xmqv-rm74": [
          "CVE-2026-27904",
          "CVE-2026-27904"
        ],
        "GHSA-3jxr-9vmj-r5cp": [
          "CVE-2026-13149",
          "CVE-2026-13149"
        ],
        "GHSA-3ppc-4f35-3m26": [
          "CVE-2026-26996",
          "CVE-2026-26996"
        ],
        "GHSA-5j98-mcp5-4vw2": [
          "CVE-2025-64756"
        ],
        "GHSA-73rr-hh4g-fpgx": [
          "CVE-2026-24001"
        ],
        "GHSA-7r86-cg39-jmmj": [
          "CVE-2026-27903",
          "CVE-2026-27903"
        ],
        "GHSA-f886-m6hf-6m8v": [
          "CVE-2026-33750",
          "CVE-2026-33750"
        ],
        "GHSA-v6h2-p8h4-qcjw": [
          "CVE-2025-5889",
          "CVE-2025-5889"
        ],
        "GHSA-w48q-cv73-mx4w": [
          "CVE-2025-66414"
        ]
      },
      "cross_scanner_correlation": {
        "only_osv": [
          "GHSA-3jxr-9vmj-r5cp",
          "GHSA-73rr-hh4g-fpgx"
        ],
        "only_trivy": [],
        "intersection_ids": [
          "CVE-2025-5889",
          "CVE-2025-64756",
          "CVE-2025-66414",
          "CVE-2026-26996",
          "CVE-2026-27903",
          "CVE-2026-27904",
          "CVE-2026-33750"
        ]
      }
    },
    "display_score": 0.0,
    "display_badge": "Unsafe"
  }
]
```