# Security Audit Report — keycloak-model-context-protocol - **Report ID:** `4f009973-9316-459e-9f61-d658656d8fa3` - **Generated:** 2026-07-22T00:46:57.877540+00:00 - **Signature:** unsigned (cosign keyless signing runs in CI; Req 22.4) ## 1. Executive Summary **Badge:** Caution (composite) **Security score:** 60.96 | Scanner | Badge | | --- | --- | | agent-audit-kit | Caution | | agentshield | Verified | | bearer | Verified | | cisco-skill-scanner | Verified | | nerlo-behavioral | Verified | | nerlo-install-instruction | Verified | | osv-scanner | Unsafe | | trivy | Unsafe | | Severity | Findings | | --- | --- | | critical | 0 | | high | 10 | | medium | 6 | | low | 4 | keycloak-model-context-protocol may be integrated with compensating controls: review the 10 high-severity findings below, restrict granted permissions to the minimum the manifest declares, and subscribe to monitoring alerts for score changes. ## 2. Source Provenance - **Repository:** https://github.com/ChristophEnglisch/keycloak-model-context-protocol - **Commit scanned:** `unknown` - **License:** MIT - **Maintainer:** Christoph Englisch - **Version:** 0.0.2 ## 3. Per-Scanner Detail ### agentshield (v1.4.0) — Verified / 100.0 No findings. ### cisco-skill-scanner (v2.0.11) — Verified / 92.5 - **[medium] Moderate analyzability score** — Only 83% of skill content could be analyzed. 1 of 7 files are opaque to the scanner. Some content could not be verified as safe. (/repo:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/SKILL.md:None) ### agent-audit-kit (v0.3.26) — Caution / 65.0 - **[medium] Repo depends on a third-party agent-platform SDK** — The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel × Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants. (package.json:20) - **[high] MCP server built on the upstream SDK without STDIO sanitizer** — Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python 'mcp' / 'modelcontextprotocol', TS '@modelcontextprotocol/sdk', Java 'io.modelcontextprotocol:*', Rust 'mcp' / 'modelcontextprotocol') and exposes a STDIO transport ('StdioServerTransport', 'stdio_server', etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed — sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L (src/index.ts:None) - **[high] Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)** — A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python 'mcp' >= 1.23.0, TS '@modelcontextprotocol/sdk' >= 1.21.1, Java 'io.modelcontextprotocol.sdk:mcp-core' >= 0.11.0, '@apollo/mcp-server' >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug. (package.json:None) ### bearer (v2.0.2) — Verified / 100.0 No findings. ### nerlo-behavioral (v0.1.0) — Verified / 100.0 No findings. ### nerlo-install-instruction (v0.1.0) — Verified / 100.0 No findings. ### trivy (v0.71.0) — Unsafe / 58.0 - **[low] keycloak: Keycloak: Information disclosure via authorization bypass in Admin API** — A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled. (package-lock.json:None) - **[high] Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default** — MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy rest (package-lock.json:None) - **[high] lodash: lodash: Arbitrary code execution via untrusted input in template imports** — Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith t (package-lock.json:None) - **[medium] lodash: prototype pollution in _.unset and _.omit functions** — Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23 (package-lock.json:None) - **[medium] lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass** — Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prot (package-lock.json:None) ### osv-scanner (v2.3.8) — Unsafe / 0.0 - **[low] GHSA-r8jr-wg88-fq5c — npm @keycloak/keycloak-admin-client@22.0.5** — aliases: CVE-2026-2366, GHSA-r8jr-wg88-fq5c \| CVSS: 3.1 (/repo/package-lock.json:None) - **[high] GHSA-w48q-cv73-mx4w — npm @modelcontextprotocol/sdk@0.5.0** — aliases: CVE-2025-66414, GHSA-w48q-cv73-mx4w \| CVSS: 7.6 (/repo/package-lock.json:None) - **[high] GHSA-3jxr-9vmj-r5cp — npm brace-expansion@1.1.11** — aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp \| CVSS: 7.7 (/repo/package-lock.json:None) - **[medium] GHSA-f886-m6hf-6m8v — npm brace-expansion@1.1.11** — aliases: CVE-2026-33750, GHSA-f886-m6hf-6m8v \| CVSS: 6.5 (/repo/package-lock.json:None) - **[low] GHSA-v6h2-p8h4-qcjw — npm brace-expansion@1.1.11** — aliases: CVE-2025-5889, GHSA-v6h2-p8h4-qcjw \| CVSS: 3.1 (/repo/package-lock.json:None) - **[medium] GHSA-f23m-r3pf-42rh — npm lodash-es@4.17.21** — aliases: CVE-2025-13465, CVE-2026-2950, GHSA-f23m-r3pf-42rh, GHSA-xxjr-mmjv-4gpg \| CVSS: 6.9 (/repo/package-lock.json:None) - **[high] GHSA-r5fr-rjxr-66jc — npm lodash-es@4.17.21** — aliases: CVE-2021-23337, CVE-2026-4800, GHSA-35jh-r3h4-6jhm, GHSA-r5fr-rjxr-66jc \| CVSS: 8.1 (/repo/package-lock.json:None) - **[high] GHSA-23c5-xmqv-rm74 — npm minimatch@3.1.2** — aliases: CVE-2026-27904, GHSA-23c5-xmqv-rm74 \| CVSS: 7.5 (/repo/package-lock.json:None) - **[high] GHSA-3ppc-4f35-3m26 — npm minimatch@3.1.2** — aliases: CVE-2026-26996, GHSA-3ppc-4f35-3m26 \| CVSS: 8.7 (/repo/package-lock.json:None) - **[high] GHSA-7r86-cg39-jmmj — npm minimatch@3.1.2** — aliases: CVE-2026-27903, GHSA-7r86-cg39-jmmj \| CVSS: 7.5 (/repo/package-lock.json:None) ## 4. Threat Model Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report. ## 5. Audit Chain - **Scan job:** `641a3130-caa7-4c38-9024-74eafd2fa54b` - **Completed:** 2026-07-21T02:18:10.031715+00:00 - **Scanner base image:** `us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:8da4f6692918e836ddba4c8ddd26562eb341283e3054981c2af54dcfba1038d5` - **AI decision log entries:** 1 - `e1012981-6864-4571-9171-4fab4f44f8d6` ## 6. Appendix — Raw Scanner Output ```json [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 6.912542108009802, "status": "complete", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [ "supply_chain" ] }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 92.5, "scanner_badge": "Verified", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "policy_violation", "file_path": "/repo", "line_number": null, "rule_identifier": "LOW_ANALYZABILITY", "title": "Moderate analyzability score", "description": "Only 83% of skill content could be analyzed. 1 of 7 files are opaque to the scanner. Some content could not be verified as safe.", "remediation": "Review opaque files and replace with inspectable formats where possible." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" } ], "execution_duration_seconds": 37.05424463801319, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 1, "high": 0, "medium": 1, "critical": 0, "informational": 1 } }, "display_score": 92.5, "display_badge": "Verified" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 65.0, "scanner_badge": "Caution", "findings": [ { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "package.json", "line_number": 20, "rule_identifier": "AAK-OAUTH-3P-001", "title": "Repo depends on a third-party agent-platform SDK", "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.", "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident" }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": "src/index.ts", "line_number": null, "rule_identifier": "AAK-ANTHROPIC-SDK-001", "title": "MCP server built on the upstream SDK without STDIO sanitizer", "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L", "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": "package.json", "line_number": null, "rule_identifier": "AAK-DNS-REBIND-002", "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)", "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.", "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)." } ], "execution_duration_seconds": 9.415778029011562, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 7, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 0, "high": 2, "medium": 1, "critical": 0, "informational": 0 } }, "display_score": 65.0, "display_badge": "Caution" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 13.572826215007808, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 48.266838427007315, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 1, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 48.028857718993095, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 1, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 58.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-2366", "title": "keycloak: Keycloak: Information disclosure via authorization bypass in Admin API", "description": "A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.", "remediation": null }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2025-66414", "title": "Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default", "description": "MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy rest", "remediation": "Upgrade @modelcontextprotocol/sdk from 0.5.0 to 1.24.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-4800", "title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports", "description": "Impact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith t", "remediation": "Upgrade lodash-es from 4.17.21 to 4.18.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2025-13465", "title": "lodash: prototype pollution in _.unset and _.omit functions", "description": "Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset\u00a0and _.omit\u00a0functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23", "remediation": "Upgrade lodash-es from 4.17.21 to 4.17.23 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-2950", "title": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass", "description": "Impact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prot", "remediation": "Upgrade lodash-es from 4.17.21 to 4.18.0 or later" } ], "execution_duration_seconds": 0.343173155997647, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "severity_counts": { "low": 1, "high": 2, "medium": 2, "critical": 0, "informational": 0 }, "manifests_scanned": [ "package-lock.json" ] }, "display_score": 58.0, "display_badge": "Unsafe" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-r8jr-wg88-fq5c", "title": "GHSA-r8jr-wg88-fq5c \u2014 npm @keycloak/keycloak-admin-client@22.0.5", "description": "aliases: CVE-2026-2366, GHSA-r8jr-wg88-fq5c | CVSS: 3.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-w48q-cv73-mx4w", "title": "GHSA-w48q-cv73-mx4w \u2014 npm @modelcontextprotocol/sdk@0.5.0", "description": "aliases: CVE-2025-66414, GHSA-w48q-cv73-mx4w | CVSS: 7.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3jxr-9vmj-r5cp", "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@1.1.11", "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-f886-m6hf-6m8v", "title": "GHSA-f886-m6hf-6m8v \u2014 npm brace-expansion@1.1.11", "description": "aliases: CVE-2026-33750, GHSA-f886-m6hf-6m8v | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v6h2-p8h4-qcjw", "title": "GHSA-v6h2-p8h4-qcjw \u2014 npm brace-expansion@1.1.11", "description": "aliases: CVE-2025-5889, GHSA-v6h2-p8h4-qcjw | CVSS: 3.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-f23m-r3pf-42rh", "title": "GHSA-f23m-r3pf-42rh \u2014 npm lodash-es@4.17.21", "description": "aliases: CVE-2025-13465, CVE-2026-2950, GHSA-f23m-r3pf-42rh, GHSA-xxjr-mmjv-4gpg | CVSS: 6.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-r5fr-rjxr-66jc", "title": "GHSA-r5fr-rjxr-66jc \u2014 npm lodash-es@4.17.21", "description": "aliases: CVE-2021-23337, CVE-2026-4800, GHSA-35jh-r3h4-6jhm, GHSA-r5fr-rjxr-66jc | CVSS: 8.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-23c5-xmqv-rm74", "title": "GHSA-23c5-xmqv-rm74 \u2014 npm minimatch@3.1.2", "description": "aliases: CVE-2026-27904, GHSA-23c5-xmqv-rm74 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3ppc-4f35-3m26", "title": "GHSA-3ppc-4f35-3m26 \u2014 npm minimatch@3.1.2", "description": "aliases: CVE-2026-26996, GHSA-3ppc-4f35-3m26 | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-7r86-cg39-jmmj", "title": "GHSA-7r86-cg39-jmmj \u2014 npm minimatch@3.1.2", "description": "aliases: CVE-2026-27903, GHSA-7r86-cg39-jmmj | CVSS: 7.5", "remediation": null } ], "execution_duration_seconds": 14.798607400007313, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "npm" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 2, "high": 6, "medium": 2, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/package-lock.json" ], "finding_id_aliases": { "GHSA-23c5-xmqv-rm74": [ "CVE-2026-27904" ], "GHSA-3jxr-9vmj-r5cp": [ "CVE-2026-13149" ], "GHSA-3ppc-4f35-3m26": [ "CVE-2026-26996" ], "GHSA-7r86-cg39-jmmj": [ "CVE-2026-27903" ], "GHSA-f23m-r3pf-42rh": [ "CVE-2025-13465", "CVE-2026-2950", "GHSA-xxjr-mmjv-4gpg" ], "GHSA-f886-m6hf-6m8v": [ "CVE-2026-33750" ], "GHSA-r5fr-rjxr-66jc": [ "CVE-2021-23337", "CVE-2026-4800", "GHSA-35jh-r3h4-6jhm" ], "GHSA-r8jr-wg88-fq5c": [ "CVE-2026-2366" ], "GHSA-v6h2-p8h4-qcjw": [ "CVE-2025-5889" ], "GHSA-w48q-cv73-mx4w": [ "CVE-2025-66414" ] }, "cross_scanner_correlation": { "only_osv": [ "GHSA-23c5-xmqv-rm74", "GHSA-3jxr-9vmj-r5cp", "GHSA-3ppc-4f35-3m26", "GHSA-7r86-cg39-jmmj", "GHSA-f886-m6hf-6m8v", "GHSA-v6h2-p8h4-qcjw" ], "only_trivy": [], "intersection_ids": [ "CVE-2025-13465", "CVE-2025-66414", "CVE-2026-2366", "CVE-2026-2950", "CVE-2026-4800" ] } }, "display_score": 0.0, "display_badge": "Unsafe" } ] ```