# Security Audit Report — @mailgun/mcp-server - **Report ID:** `fca97f6b-b8b1-43c5-85d4-5d41750af18c` - **Generated:** 2026-07-22T22:41:06.581828+00:00 - **Signature:** unsigned (cosign keyless signing runs in CI; Req 22.4) ## 1. Executive Summary **Badge:** Unsafe (composite) **Security score:** 39.04 | Scanner | Badge | | --- | --- | | agent-audit-kit | Unsafe | | agentshield | Verified | | bearer | Verified | | cisco-skill-scanner | Unsafe | | nerlo-behavioral | Verified | | nerlo-install-instruction | Verified | | osv-scanner | Unsafe | | trivy | Unsafe | | Severity | Findings | | --- | --- | | critical | 0 | | high | 15 | | medium | 38 | | low | 7 | @mailgun/mcp-server is NOT recommended for integration: the scan surfaced 0 critical and 15 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering. ## 2. Source Provenance - **Repository:** https://github.com/mailgun/mailgun-mcp-server - **Commit scanned:** `unknown` - **License:** Apache-2.0 - **Maintainer:** Mailgun Technologies, Inc - **Version:** 2.1.0 ## 3. Per-Scanner Detail ### agentshield (v1.4.0) — Verified / 100.0 No findings. ### cisco-skill-scanner (v2.0.11) — Unsafe / 30.5 - **[high] Critically low analyzability score** — Only 40% of skill content could be analyzed. 22 of 38 files are opaque to the scanner. The safety assessment has low confidence. (/repo:None) - **[low] Hidden data file detected** — Hidden file found: .oxlintrc.json. Hidden files may contain concealed configuration or data that should be reviewed. (/repo/.oxlintrc.json:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/SKILL.md:None) - **[high] Node.js filesystem access that could read or write sensitive data** — Pattern detected: fs.readFileSync( (/repo/scripts/check-version-sync.mjs:3) - **[high] Node.js filesystem access that could read or write sensitive data** — Pattern detected: fs.readFileSync( (/repo/scripts/check-version-sync.mjs:4) - **[medium] Outbound network request primitives in JavaScript/TypeScript** — Pattern detected: https.request( (/repo/src/api.ts:35) - **[high] Node.js filesystem access that could read or write sensitive data** — Pattern detected: fs.readFileSync( (/repo/src/openapi.ts:9) ### agent-audit-kit (v0.3.26) — Unsafe / 38.0 - **[low] Dependency count exceeds threshold** — More than 200 direct + transitive dependencies in lockfile. Each dependency is a trust decision. (package-lock.json:None) - **[medium] Dependency uses install scripts** — package.json has install scripts (preinstall, postinstall, etc.) that execute arbitrary commands during npm install. (package.json:36) - **[medium] Missing rate limiting on MCP endpoint** — An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks. (src/mailgun-mcp.ts:3) - **[medium] Missing rate limiting on MCP endpoint** — An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks. (src/tools.ts:1) - **[medium] Missing rate limiting on MCP endpoint** — An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks. (src/custom-tools/get-metrics-summary.ts:1) - **[medium] Missing rate limiting on MCP endpoint** — An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks. (src/custom-tools/index.ts:1) - **[medium] Repo depends on a third-party agent-platform SDK** — The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel × Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants. (package.json:44) - **[high] MCP server built on the upstream SDK without STDIO sanitizer** — Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python 'mcp' / 'modelcontextprotocol', TS '@modelcontextprotocol/sdk', Java 'io.modelcontextprotocol:*', Rust 'mcp' / 'modelcontextprotocol') and exposes a STDIO transport ('StdioServerTransport', 'stdio_server', etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed — sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L (src/mailgun-mcp.ts:None) - **[high] Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)** — A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python 'mcp' >= 1.23.0, TS '@modelcontextprotocol/sdk' >= 1.21.1, Java 'io.modelcontextprotocol.sdk:mcp-core' >= 0.11.0, '@apollo/mcp-server' >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug. (package.json:None) ### bearer (v2.0.2) — Verified / 100.0 No findings. ### nerlo-behavioral (v0.1.0) — Verified / 100.0 No findings. ### nerlo-install-instruction (v0.1.0) — Verified / 100.0 No findings. ### trivy (v0.71.0) — Unsafe / 0.0 - **[low] body-parser: body-parser: Denial of Service via invalid limit option** — Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars (package-lock.json:None) - **[high] fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies** — fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Version (package-lock.json:None) - **[high] fast-uri: fast-uri: URI authority bypass due to improper delimiter handling** — fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a differ (package-lock.json:None) - **[high] hono: CORS Middleware reflects any Origin with credentials when 'origin' defaults to the wildcard** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25. (package-lock.json:None) - **[medium] hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4 (package-lock.json:None) - **[medium] Hono: bodyLimit() can be bypassed for chunked / unknown-length requests** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16. (package-lock.json:None) - **[medium] Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18. (package-lock.json:None) - **[medium] Hono has CSS Declaration Injection via Style Object Values in JSX SSR** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18. (package-lock.json:None) - **[medium] Hono: JWT middleware accepts any Authorization scheme, not only Bearer** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value — regardless of the scheme name in the first position — proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is (package-lock.json:None) - **[medium] Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 ** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the (package-lock.json:None) - **[medium] Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \r, \n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed (package-lock.json:None) - **[medium] Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed (package-lock.json:None) - **[medium] hono: Path traversal in 'serve-static' on Windows via encoded backslash ('%5C')** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25. (package-lock.json:None) - **[medium] hono: AWS Lambda adapter merges multiple 'Set-Cookie' headers into one value, dropping cookies on ALB single-header and Lattice** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25. (package-lock.json:None) - **[medium] hono: Body Limit Middleware can be bypassed on AWS Lambda by understating 'Content-Length'** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a (package-lock.json:None) - **[medium] hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request mid (package-lock.json:None) - **[low] Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() — typically when the application itself issues such tokens, or when the signing key is otherwise unde (package-lock.json:None) - **[medium] ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input** — ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, (package-lock.json:None) - **[high] js-yaml: js-yaml: Denial of Service via crafted YAML documents** — js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0. (package-lock.json:None) - **[medium] js-yaml: js-yaml: Denial of Service via crafted YAML merge keys** — js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerabil (package-lock.json:None) - **[medium] \#\#\# Summary 'qs.stringify' throws 'TypeError' when called with 'arr ...** — \#\#\# Summary 'qs.stringify' throws 'TypeError' when called with 'arrayFormat: 'comma'' and 'encodeValuesOnly: true' on an array containing 'null' or 'undefined'. The throw is synchronous and not handled by any of qs's null-related options ('skipNulls', 'strictNullHandling'). \#\#\# Details In the comma + 'encodeValuesOnly' branch, 'lib/stringify.js:145' mapped the array through the raw encoder before joining: '''js obj = utils.maybeMap(obj, encoder); ''' 'utils.encode' ('lib/uti (package-lock.json:None) ### osv-scanner (v2.3.8) — Unsafe / 0.0 - **[low] GHSA-v422-hmwv-36x6 — npm body-parser@2.2.2** — aliases: CVE-2026-12590, GHSA-v422-hmwv-36x6 \| CVSS: 3.7 (/repo/package-lock.json:None) - **[high] GHSA-q3j6-qgpj-74h6 — npm fast-uri@3.1.0** — aliases: CVE-2026-6321, GHSA-q3j6-qgpj-74h6 \| CVSS: 7.5 (/repo/package-lock.json:None) - **[high] GHSA-v39h-62p7-jpjc — npm fast-uri@3.1.0** — aliases: CVE-2026-6322, GHSA-v39h-62p7-jpjc \| CVSS: 7.5 (/repo/package-lock.json:None) - **[medium] GHSA-2gcr-mfcq-wcc3 — npm hono@4.12.14** — aliases: CVE-2026-47676, GHSA-2gcr-mfcq-wcc3 \| CVSS: 5.3 (/repo/package-lock.json:None) - **[medium] GHSA-3hrh-pfw6-9m5x — npm hono@4.12.14** — aliases: CVE-2026-47675, GHSA-3hrh-pfw6-9m5x \| CVSS: 4.3 (/repo/package-lock.json:None) - **[medium] GHSA-69xw-7hcm-h432 — npm hono@4.12.14** — aliases: CVE-2026-44455, GHSA-69xw-7hcm-h432 \| CVSS: 4.7 (/repo/package-lock.json:None) - **[high] GHSA-88fw-hqm2-52qc — npm hono@4.12.14** — aliases: CVE-2026-54290, GHSA-88fw-hqm2-52qc \| CVSS: 7.1 (/repo/package-lock.json:None) - **[medium] GHSA-9vqf-7f2p-gf9v — npm hono@4.12.14** — aliases: CVE-2026-44456, GHSA-9vqf-7f2p-gf9v \| CVSS: 6.5 (/repo/package-lock.json:None) - **[medium] GHSA-f577-qrjj-4474 — npm hono@4.12.14** — aliases: CVE-2026-47673, GHSA-f577-qrjj-4474 \| CVSS: 4.8 (/repo/package-lock.json:None) - **[low] GHSA-hm8q-7f3q-5f36 — npm hono@4.12.14** — aliases: CVE-2026-44459, GHSA-hm8q-7f3q-5f36 \| CVSS: 3.8 (/repo/package-lock.json:None) - **[medium] GHSA-j6c9-x7qj-28xf — npm hono@4.12.14** — aliases: CVE-2026-54287, GHSA-j6c9-x7qj-28xf \| CVSS: 5.3 (/repo/package-lock.json:None) - **[medium] GHSA-p77w-8qqv-26rm — npm hono@4.12.14** — aliases: CVE-2026-44457, GHSA-p77w-8qqv-26rm \| CVSS: 5.3 (/repo/package-lock.json:None) - **[medium] GHSA-qp7p-654g-cw7p — npm hono@4.12.14** — aliases: CVE-2026-44458, GHSA-qp7p-654g-cw7p \| CVSS: 4.3 (/repo/package-lock.json:None) - **[medium] GHSA-rv63-4mwf-qqc2 — npm hono@4.12.14** — aliases: CVE-2026-54288, GHSA-rv63-4mwf-qqc2 \| CVSS: 6.5 (/repo/package-lock.json:None) - **[medium] GHSA-wgpf-jwqj-8h8p — npm hono@4.12.14** — aliases: CVE-2026-54289, GHSA-wgpf-jwqj-8h8p \| CVSS: 4.8 (/repo/package-lock.json:None) - **[medium] GHSA-wwfh-h76j-fc44 — npm hono@4.12.14** — aliases: CVE-2026-54286, GHSA-wwfh-h76j-fc44 \| CVSS: 5.9 (/repo/package-lock.json:None) - **[medium] GHSA-xrhx-7g5j-rcj5 — npm hono@4.12.14** — aliases: CVE-2026-47674, GHSA-xrhx-7g5j-rcj5 \| CVSS: 5.3 (/repo/package-lock.json:None) - **[medium] GHSA-v2v4-37r5-5v8g — npm ip-address@10.1.0** — aliases: CVE-2026-42338, GHSA-v2v4-37r5-5v8g \| CVSS: 5.3 (/repo/package-lock.json:None) - **[high] GHSA-52cp-r559-cp3m — npm js-yaml@4.1.1** — aliases: CVE-2026-59869, GHSA-52cp-r559-cp3m \| CVSS: 7.5 (/repo/package-lock.json:None) - **[medium] GHSA-h67p-54hq-rp68 — npm js-yaml@4.1.1** — aliases: CVE-2026-53550, GHSA-h67p-54hq-rp68 \| CVSS: 5.3 (/repo/package-lock.json:None) - **[medium] GHSA-q8mj-m7cp-5q26 — npm qs@6.15.1** — aliases: CVE-2026-8723, GHSA-q8mj-m7cp-5q26 \| CVSS: 6.3 (/repo/package-lock.json:None) - **[high] GHSA-fx2h-pf6j-xcff — npm vite@8.0.6** — aliases: CVE-2026-53571, GHSA-fx2h-pf6j-xcff \| CVSS: 8.2 (/repo/package-lock.json:None) - **[medium] GHSA-v6wh-96g9-6wx3 — npm vite@8.0.6** — aliases: CVE-2026-53632, GHSA-v6wh-96g9-6wx3 \| CVSS: 5.5 (/repo/package-lock.json:None) ## 4. Threat Model Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report. ## 5. Audit Chain - **Scan job:** `bc0acba4-5dce-4e02-801b-a47db0b132d6` - **Completed:** 2026-07-21T02:26:07.442383+00:00 - **Scanner base image:** `us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:aa25580a8213f0c63144c63ae892cdc349d9220471fff005661ef583a93008e8` - **AI decision log entries:** 1 - `7712f882-6f45-46b1-8b71-d1c8ab4957ea` ## 6. Appendix — Raw Scanner Output ```json [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 9.451655219003442, "status": "complete", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [ "supply_chain" ] }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 30.5, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "policy_violation", "file_path": "/repo", "line_number": null, "rule_identifier": "LOW_ANALYZABILITY", "title": "Critically low analyzability score", "description": "Only 40% of skill content could be analyzed. 22 of 38 files are opaque to the scanner. The safety assessment has low confidence.", "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.oxlintrc.json", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .oxlintrc.json. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "data_exfiltration", "file_path": "/repo/scripts/check-version-sync.mjs", "line_number": 3, "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS", "title": "Node.js filesystem access that could read or write sensitive data", "description": "Pattern detected: fs.readFileSync(", "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "data_exfiltration", "file_path": "/repo/scripts/check-version-sync.mjs", "line_number": 4, "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS", "title": "Node.js filesystem access that could read or write sensitive data", "description": "Pattern detected: fs.readFileSync(", "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/api.ts", "line_number": 35, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "Pattern detected: https.request(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "data_exfiltration", "file_path": "/repo/src/openapi.ts", "line_number": 9, "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS", "title": "Node.js filesystem access that could read or write sensitive data", "description": "Pattern detected: fs.readFileSync(", "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores" } ], "execution_duration_seconds": 40.41628859200864, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 2, "high": 4, "medium": 1, "critical": 0, "informational": 1 } }, "display_score": 30.5, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 38.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "AAK-SUPPLY-005", "title": "Dependency count exceeds threshold", "description": "More than 200 direct + transitive dependencies in lockfile. Each dependency is a trust decision.", "remediation": "Audit and remove unused dependencies. Consider lighter alternatives." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "package.json", "line_number": 36, "rule_identifier": "AAK-SUPPLY-003", "title": "Dependency uses install scripts", "description": "package.json has install scripts (preinstall, postinstall, etc.) that execute arbitrary commands during npm install.", "remediation": "Audit install scripts. Use --ignore-scripts flag and run scripts manually after review." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "mcp-config", "file_path": "src/mailgun-mcp.ts", "line_number": 3, "rule_identifier": "AAK-MCP-018", "title": "Missing rate limiting on MCP endpoint", "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.", "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "mcp-config", "file_path": "src/tools.ts", "line_number": 1, "rule_identifier": "AAK-MCP-018", "title": "Missing rate limiting on MCP endpoint", "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.", "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "mcp-config", "file_path": "src/custom-tools/get-metrics-summary.ts", "line_number": 1, "rule_identifier": "AAK-MCP-018", "title": "Missing rate limiting on MCP endpoint", "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.", "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "mcp-config", "file_path": "src/custom-tools/index.ts", "line_number": 1, "rule_identifier": "AAK-MCP-018", "title": "Missing rate limiting on MCP endpoint", "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.", "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "package.json", "line_number": 44, "rule_identifier": "AAK-OAUTH-3P-001", "title": "Repo depends on a third-party agent-platform SDK", "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.", "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident" }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": "src/mailgun-mcp.ts", "line_number": null, "rule_identifier": "AAK-ANTHROPIC-SDK-001", "title": "MCP server built on the upstream SDK without STDIO sanitizer", "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L", "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": "package.json", "line_number": null, "rule_identifier": "AAK-DNS-REBIND-002", "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)", "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.", "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)." } ], "execution_duration_seconds": 23.865051204003976, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 34, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 1, "high": 2, "medium": 6, "critical": 0, "informational": 0 } }, "display_score": 38.0, "display_badge": "Unsafe" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 16.480920588001027, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 48.93632002999948, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 14, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 48.48046424599306, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 4, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-12590", "title": "body-parser: body-parser: Denial of Service via invalid limit option", "description": "Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars", "remediation": "Upgrade body-parser from 2.2.2 to 1.20.6, 2.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-6321", "title": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies", "description": "fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Version", "remediation": "Upgrade fast-uri from 3.1.0 to 3.1.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-6322", "title": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling", "description": "fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a differ", "remediation": "Upgrade fast-uri from 3.1.0 to 3.1.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54290", "title": "hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44455", "title": "hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4", "remediation": "Upgrade hono from 4.12.14 to 4.12.16 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44456", "title": "Hono: bodyLimit() can be bypassed for chunked / unknown-length requests", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.", "remediation": "Upgrade hono from 4.12.14 to 4.12.16 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44457", "title": "Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.", "remediation": "Upgrade hono from 4.12.14 to 4.12.18 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44458", "title": "Hono has CSS Declaration Injection via Style Object Values in JSX SSR", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18.", "remediation": "Upgrade hono from 4.12.14 to 4.12.18 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47673", "title": "Hono: JWT middleware accepts any Authorization scheme, not only Bearer", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value \u2014 regardless of the scheme name in the first position \u2014 proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is", "remediation": "Upgrade hono from 4.12.14 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47674", "title": "Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 ", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule \u2014 such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses \u2014 do not match the normalized rule entry, causing the ", "remediation": "Upgrade hono from 4.12.14 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47675", "title": "Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \\r, \\n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed ", "remediation": "Upgrade hono from 4.12.14 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47676", "title": "Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed", "remediation": "Upgrade hono from 4.12.14 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54286", "title": "hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54287", "title": "hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54288", "title": "hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54289", "title": "hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request mid", "remediation": "Upgrade hono from 4.12.14 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44459", "title": "Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() \u2014 typically when the application itself issues such tokens, or when the signing key is otherwise unde", "remediation": "Upgrade hono from 4.12.14 to 4.12.18 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-42338", "title": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input", "description": "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods,", "remediation": "Upgrade ip-address from 10.1.0 to 10.1.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-59869", "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents", "description": "js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.", "remediation": "Upgrade js-yaml from 4.1.1 to 3.15.0, 4.3.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-53550", "title": "js-yaml: js-yaml: Denial of Service via crafted YAML merge keys", "description": "js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerabil", "remediation": "Upgrade js-yaml from 4.1.1 to 4.2.0, 3.15.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-8723", "title": "### Summary `qs.stringify` throws `TypeError` when called with `arr ...", "description": "### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti", "remediation": "Upgrade qs from 6.15.1 to 6.15.2 or later" } ], "execution_duration_seconds": 1.7449092309980188, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "severity_counts": { "low": 2, "high": 4, "medium": 15, "critical": 0, "informational": 0 }, "manifests_scanned": [ "package-lock.json" ] }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v422-hmwv-36x6", "title": "GHSA-v422-hmwv-36x6 \u2014 npm body-parser@2.2.2", "description": "aliases: CVE-2026-12590, GHSA-v422-hmwv-36x6 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-q3j6-qgpj-74h6", "title": "GHSA-q3j6-qgpj-74h6 \u2014 npm fast-uri@3.1.0", "description": "aliases: CVE-2026-6321, GHSA-q3j6-qgpj-74h6 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v39h-62p7-jpjc", "title": "GHSA-v39h-62p7-jpjc \u2014 npm fast-uri@3.1.0", "description": "aliases: CVE-2026-6322, GHSA-v39h-62p7-jpjc | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-2gcr-mfcq-wcc3", "title": "GHSA-2gcr-mfcq-wcc3 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-47676, GHSA-2gcr-mfcq-wcc3 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3hrh-pfw6-9m5x", "title": "GHSA-3hrh-pfw6-9m5x \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-47675, GHSA-3hrh-pfw6-9m5x | CVSS: 4.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-69xw-7hcm-h432", "title": "GHSA-69xw-7hcm-h432 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44455, GHSA-69xw-7hcm-h432 | CVSS: 4.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-88fw-hqm2-52qc", "title": "GHSA-88fw-hqm2-52qc \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54290, GHSA-88fw-hqm2-52qc | CVSS: 7.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-9vqf-7f2p-gf9v", "title": "GHSA-9vqf-7f2p-gf9v \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44456, GHSA-9vqf-7f2p-gf9v | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-f577-qrjj-4474", "title": "GHSA-f577-qrjj-4474 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-47673, GHSA-f577-qrjj-4474 | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-hm8q-7f3q-5f36", "title": "GHSA-hm8q-7f3q-5f36 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44459, GHSA-hm8q-7f3q-5f36 | CVSS: 3.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-j6c9-x7qj-28xf", "title": "GHSA-j6c9-x7qj-28xf \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54287, GHSA-j6c9-x7qj-28xf | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-p77w-8qqv-26rm", "title": "GHSA-p77w-8qqv-26rm \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44457, GHSA-p77w-8qqv-26rm | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-qp7p-654g-cw7p", "title": "GHSA-qp7p-654g-cw7p \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-44458, GHSA-qp7p-654g-cw7p | CVSS: 4.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-rv63-4mwf-qqc2", "title": "GHSA-rv63-4mwf-qqc2 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54288, GHSA-rv63-4mwf-qqc2 | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-wgpf-jwqj-8h8p", "title": "GHSA-wgpf-jwqj-8h8p \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54289, GHSA-wgpf-jwqj-8h8p | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-wwfh-h76j-fc44", "title": "GHSA-wwfh-h76j-fc44 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-54286, GHSA-wwfh-h76j-fc44 | CVSS: 5.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-xrhx-7g5j-rcj5", "title": "GHSA-xrhx-7g5j-rcj5 \u2014 npm hono@4.12.14", "description": "aliases: CVE-2026-47674, GHSA-xrhx-7g5j-rcj5 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v2v4-37r5-5v8g", "title": "GHSA-v2v4-37r5-5v8g \u2014 npm ip-address@10.1.0", "description": "aliases: CVE-2026-42338, GHSA-v2v4-37r5-5v8g | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-52cp-r559-cp3m", "title": "GHSA-52cp-r559-cp3m \u2014 npm js-yaml@4.1.1", "description": "aliases: CVE-2026-59869, GHSA-52cp-r559-cp3m | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-h67p-54hq-rp68", "title": "GHSA-h67p-54hq-rp68 \u2014 npm js-yaml@4.1.1", "description": "aliases: CVE-2026-53550, GHSA-h67p-54hq-rp68 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-q8mj-m7cp-5q26", "title": "GHSA-q8mj-m7cp-5q26 \u2014 npm qs@6.15.1", "description": "aliases: CVE-2026-8723, GHSA-q8mj-m7cp-5q26 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-fx2h-pf6j-xcff", "title": "GHSA-fx2h-pf6j-xcff \u2014 npm vite@8.0.6", "description": "aliases: CVE-2026-53571, GHSA-fx2h-pf6j-xcff | CVSS: 8.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v6wh-96g9-6wx3", "title": "GHSA-v6wh-96g9-6wx3 \u2014 npm vite@8.0.6", "description": "aliases: CVE-2026-53632, GHSA-v6wh-96g9-6wx3 | CVSS: 5.5", "remediation": null } ], "execution_duration_seconds": 29.021470762992976, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "npm" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 2, "high": 5, "medium": 16, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/package-lock.json" ], "finding_id_aliases": { "GHSA-2gcr-mfcq-wcc3": [ "CVE-2026-47676" ], "GHSA-3hrh-pfw6-9m5x": [ "CVE-2026-47675" ], "GHSA-52cp-r559-cp3m": [ "CVE-2026-59869" ], "GHSA-69xw-7hcm-h432": [ "CVE-2026-44455" ], "GHSA-88fw-hqm2-52qc": [ "CVE-2026-54290" ], "GHSA-9vqf-7f2p-gf9v": [ "CVE-2026-44456" ], "GHSA-f577-qrjj-4474": [ "CVE-2026-47673" ], "GHSA-fx2h-pf6j-xcff": [ "CVE-2026-53571" ], "GHSA-h67p-54hq-rp68": [ "CVE-2026-53550" ], "GHSA-hm8q-7f3q-5f36": [ "CVE-2026-44459" ], "GHSA-j6c9-x7qj-28xf": [ "CVE-2026-54287" ], "GHSA-p77w-8qqv-26rm": [ "CVE-2026-44457" ], "GHSA-q3j6-qgpj-74h6": [ "CVE-2026-6321" ], "GHSA-q8mj-m7cp-5q26": [ "CVE-2026-8723" ], "GHSA-qp7p-654g-cw7p": [ "CVE-2026-44458" ], "GHSA-rv63-4mwf-qqc2": [ "CVE-2026-54288" ], "GHSA-v2v4-37r5-5v8g": [ "CVE-2026-42338" ], "GHSA-v39h-62p7-jpjc": [ "CVE-2026-6322" ], "GHSA-v422-hmwv-36x6": [ "CVE-2026-12590" ], "GHSA-v6wh-96g9-6wx3": [ "CVE-2026-53632" ], "GHSA-wgpf-jwqj-8h8p": [ "CVE-2026-54289" ], "GHSA-wwfh-h76j-fc44": [ "CVE-2026-54286" ], "GHSA-xrhx-7g5j-rcj5": [ "CVE-2026-47674" ] }, "cross_scanner_correlation": { "only_osv": [ "GHSA-fx2h-pf6j-xcff", "GHSA-v6wh-96g9-6wx3" ], "only_trivy": [], "intersection_ids": [ "CVE-2026-12590", "CVE-2026-42338", "CVE-2026-44455", "CVE-2026-44456", "CVE-2026-44457", "CVE-2026-44458", "CVE-2026-44459", "CVE-2026-47673", "CVE-2026-47674", "CVE-2026-47675", "CVE-2026-47676", "CVE-2026-53550", "CVE-2026-54286", "CVE-2026-54287", "CVE-2026-54288", "CVE-2026-54289", "CVE-2026-54290", "CVE-2026-59869", "CVE-2026-6321", "CVE-2026-6322", "CVE-2026-8723" ] } }, "display_score": 0.0, "display_badge": "Unsafe" } ] ```