{ "executive_summary": { "badge": "Unsafe", "security_score": 35.3, "view": "composite", "scanner_badges": { "agentshield": "unavailable", "cisco-skill-scanner": "Unsafe", "agent-audit-kit": "Unsafe", "bearer": "Verified", "nerlo-behavioral": "Verified", "nerlo-install-instruction": "Verified", "trivy": "Unsafe", "osv-scanner": "Unsafe" }, "finding_counts": { "critical": 0, "high": 25, "medium": 40, "low": 7 }, "recommendation": "congressmcp is NOT recommended for integration: the scan surfaced 0 critical and 25 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering." }, "source_provenance": { "repository_url": "https://github.com/amurshak/congressMCP", "commit_sha_scanned": null, "license": "Sustainable Use License", "maintainer": "Alex Murshak", "name": "congressmcp", "version": "2.0.0" }, "per_scanner_detail": [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 1.164174528006697, "status": "not_applicable", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [] }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 53.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/.", "line_number": null, "rule_identifier": "EXCESSIVE_FILE_COUNT", "title": "Skill package contains many files", "description": "Skill package contains 103 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.", "remediation": "Review file inventory and remove unnecessary files." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "unauthorized_tool_use", "file_path": "/repo/repo/README.md", "line_number": null, "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK", "title": "Undeclared network usage", "description": "Skill code uses network libraries but doesn't declare network requirement", "remediation": "Declare network usage in compatibility field or remove network calls" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'requirements.txt' extension (.txt) suggests one format but Magika detected a different text format: INI configuration file (ini). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/send_test_email.py", "line_number": 29, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/test_email_service.py", "line_number": 62, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/test_email_service.py", "line_number": 83, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/test_email_templates.py", "line_number": 33, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/test_email_templates.py", "line_number": 54, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/test_upgrade_email.py", "line_number": 31, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/documentation/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/documentation/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" } ], "execution_duration_seconds": 72.75545678498747, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo", "documentation" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 3, "high": 0, "medium": 8, "critical": 0, "informational": 2 } }, "display_score": 53.0, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "setup_email.py", "line_number": 34, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "tests/test_email_templates.py", "line_number": 54, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "tests/test_upgrade_email.py", "line_number": 31, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "congress_api/core/api_config.py", "line_number": 68, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "pyproject.toml", "line_number": null, "rule_identifier": "AAK-SUPPLY-004", "title": "No lockfile present", "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.", "remediation": "Generate and commit lockfile." }, { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "SECURITY.md", "line_number": null, "rule_identifier": "AAK-SEC-MD-001", "title": "MCP server repo missing SECURITY.md or security_contact", "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.", "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "documentation/CongressAPI_documentation.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "documentation/CongressAPI_documentation.md", "line_number": 5605, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/treaties_and_summaries_tool.py", "line_number": 125, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/bills_tool.py", "line_number": 197, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/amendments_tool.py", "line_number": 128, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/buckets/committee_intelligence.py", "line_number": 268, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/buckets/research_and_professional.py", "line_number": 195, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/buckets/records_and_hearings.py", "line_number": 257, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/buckets/laws.py", "line_number": 167, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/buckets/voting_and_nominations.py", "line_number": 227, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "pyproject.toml", "line_number": 6, "rule_identifier": "AAK-OAUTH-3P-001", "title": "Repo depends on a third-party agent-platform SDK", "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.", "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident" }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "requirements.txt", "line_number": 2, "rule_identifier": "AAK-OAUTH-3P-001", "title": "Repo depends on a third-party agent-platform SDK", "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.", "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident" }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/publish.yml", "line_number": 29, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "tests/test_user_creation.py", "line_number": 52, "rule_identifier": "AAK-SPLUNK-TOKLOG-001", "title": "Session token written to log sink in cleartext", "description": "An MCP server, agent, or tool logs a session token, JWT, or Bearer credential through a generic log sink (logger.info / .warn / .error, print) without redaction. CVE-2026-20205 (splunk-mcp-server < 1.0.3) shipped this exact pattern \u2014 session tokens ended up in the Splunk `_internal` index, readable by anyone with index-read. Any token written to a log sink is also a supply-chain risk: the log file, shipper, and SIEM are now in scope for the token's blast radius.", "remediation": "Redact token-shaped values before logging. Never interpolate a raw `Authorization`, `Bearer`, JWT, `splunkd_session`, or `st-` credential into a log message. Pin `splunk-mcp-server >= 1.0.3`." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "scripts/init_database.py", "line_number": 65, "rule_identifier": "AAK-SPLUNK-TOKLOG-001", "title": "Session token written to log sink in cleartext", "description": "An MCP server, agent, or tool logs a session token, JWT, or Bearer credential through a generic log sink (logger.info / .warn / .error, print) without redaction. CVE-2026-20205 (splunk-mcp-server < 1.0.3) shipped this exact pattern \u2014 session tokens ended up in the Splunk `_internal` index, readable by anyone with index-read. Any token written to a log sink is also a supply-chain risk: the log file, shipper, and SIEM are now in scope for the token's blast radius.", "remediation": "Redact token-shaped values before logging. Never interpolate a raw `Authorization`, `Bearer`, JWT, `splunkd_session`, or `st-` credential into a log message. Pin `splunk-mcp-server >= 1.0.3`." } ], "execution_duration_seconds": 64.57355511101196, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 98, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 1, "high": 7, "medium": 13, "critical": 0, "informational": 0 } }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 13.36410034399887, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 56.014483658000245, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 62, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 53.647198407998076, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 7, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "trivy", "severity": "low", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-4539", "title": "pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer", "description": "A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.", "remediation": "Upgrade Pygments from 2.19.1 to 2.20.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-45409", "title": "python-idna: idna: Denial of Service via specially crafted long inputs", "description": "Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi", "remediation": "Upgrade idna from 3.10 to 3.15 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-28684", "title": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following", "description": "python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.", "remediation": "Upgrade python-dotenv from 1.1.0 to 1.2.2 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2024-47081", "title": "requests: Requests vulnerable to .netrc credentials leak via malicious URLs", "description": "Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.", "remediation": "Upgrade requests from 2.32.3 to 2.32.4 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-25645", "title": "requests: Requests: Security bypass due to predictable temporary file creation", "description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulner", "remediation": "Upgrade requests from 2.32.3 to 2.33.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2025-62727", "title": "starlette: Starlette DoS via Range header merging", "description": "Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial\u2011of\u2011service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.", "remediation": "Upgrade starlette from 0.46.2 to 0.49.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-48818", "title": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows", "description": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account\u2019s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas", "remediation": "Upgrade starlette from 0.46.2 to 1.1.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-54283", "title": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS", "description": "Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.", "remediation": "Upgrade starlette from 0.46.2 to 1.3.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2025-54121", "title": "starlette: Starlette denial-of-service", "description": "Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_me", "remediation": "Upgrade starlette from 0.46.2 to 0.47.2 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-48710", "title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header", "description": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) ", "remediation": "Upgrade starlette from 0.46.2 to 1.0.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-48817", "title": "starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods", "description": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo", "remediation": "Upgrade starlette from 0.46.2 to 1.1.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-54282", "title": "starlette: Starlette: Information disclosure due to improper HTTP request path validation", "description": "Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header ", "remediation": "Upgrade starlette from 0.46.2 to 1.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2025-66418", "title": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2025-66471", "title": "urllib3: urllib3 Streaming API improperly handles highly compressed data", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, b", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-21441", "title": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)", "description": "urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in ve", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.3 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-44431", "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers", "description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.7.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2025-50181", "title": "urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation", "description": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.5.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2025-50182", "title": "urllib3: urllib3 does not control redirects in browsers and Node.js", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodi", "remediation": "Upgrade urllib3 from 2.4.0 to 2.5.0 or later" } ], "execution_duration_seconds": 1.6881044760084478, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "severity_counts": { "low": 2, "high": 7, "medium": 9, "critical": 0, "informational": 0 }, "manifests_scanned": [ "requirements.txt" ] }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-2987", "title": "PYSEC-2026-2987 \u2014 PyPI pygments@2.19.1", "description": "aliases: CVE-2026-4539, GHSA-5239-wwwm-4pmq, PYSEC-2026-2987 | CVSS: 3.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-2132", "title": "PYSEC-2026-2132 \u2014 PyPI click@8.2.1", "description": "aliases: CVE-2026-7246, GHSA-47fr-3ffg-hgmw, PYSEC-2026-2132 | CVSS: 7.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-215", "title": "PYSEC-2026-215 \u2014 PyPI idna@3.10", "description": "aliases: CVE-2026-45409, GHSA-65pc-fj4g-8rjx, PYSEC-2026-215 | CVSS: 6.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "GHSA-hvrp-rf83-w775", "title": "GHSA-hvrp-rf83-w775 \u2014 PyPI mcp@1.26.0", "description": "aliases: CVE-2026-52870, GHSA-hvrp-rf83-w775 | CVSS: 7.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "GHSA-jpw9-pfvf-9f58", "title": "GHSA-jpw9-pfvf-9f58 \u2014 PyPI mcp@1.26.0", "description": "aliases: CVE-2026-52869, GHSA-jpw9-pfvf-9f58 | CVSS: 7.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "GHSA-vj7q-gjh5-988w", "title": "GHSA-vj7q-gjh5-988w \u2014 PyPI mcp@1.26.0", "description": "aliases: CVE-2026-59950, GHSA-vj7q-gjh5-988w | CVSS: 7.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-2270", "title": "PYSEC-2026-2270 \u2014 PyPI python-dotenv@1.1.0", "description": "aliases: CVE-2026-28684, GHSA-mf9w-mj56-hr94, PYSEC-2026-2270 | CVSS: 6.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1872", "title": "PYSEC-2026-1872 \u2014 PyPI requests@2.32.3", "description": "aliases: CVE-2024-47081, GHSA-9hjg-9r4m-mvj7, PYSEC-2026-1872 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-2275", "title": "PYSEC-2026-2275 \u2014 PyPI requests@2.32.3", "description": "aliases: CVE-2026-25645, GHSA-gc5v-m9x4-r6x2, PYSEC-2026-2275 | CVSS: 5.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-161", "title": "PYSEC-2026-161 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48710, GHSA-86qp-5c8j-p5mr, PYSEC-2026-161, X41-2026-002 | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1941", "title": "PYSEC-2026-1941 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2025-54121, GHSA-2c2j-9gv5-cj73, PYSEC-2026-1941 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1942", "title": "PYSEC-2026-1942 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2025-62727, GHSA-7f5h-v6xp-fcq8, PYSEC-2026-1942 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-2280", "title": "PYSEC-2026-2280 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48817, GHSA-x746-7m8f-x49c, PYSEC-2026-2280 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-2281", "title": "PYSEC-2026-2281 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48818, GHSA-wqp7-x3pw-xc5r, PYSEC-2026-2281 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-248", "title": "PYSEC-2026-248 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-54282, GHSA-jp82-jpqv-5vv3, PYSEC-2026-248 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-249", "title": "PYSEC-2026-249 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-54283, GHSA-82w8-qh3p-5jfq, PYSEC-2026-249 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-141", "title": "PYSEC-2026-141 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2026-44431, GHSA-qccp-gfcp-xxvc, PYSEC-2026-141 | CVSS: 8.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1994", "title": "PYSEC-2026-1994 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-66471, GHSA-2xpw-w6gg-jr37, PYSEC-2026-1994 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1996", "title": "PYSEC-2026-1996 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2026-21441, GHSA-38jv-5279-wg99, PYSEC-2026-1996 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1997", "title": "PYSEC-2026-1997 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-50182, GHSA-48p4-8xcf-vxj5, PYSEC-2026-1997 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1998", "title": "PYSEC-2026-1998 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-66418, GHSA-gm62-xv2j-4w53, PYSEC-2026-1998 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1999", "title": "PYSEC-2026-1999 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-50181, GHSA-pq67-6m6q-mj2v, PYSEC-2026-1999 | CVSS: 5.3", "remediation": null } ], "execution_duration_seconds": 5.339111591005349, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "PyPI" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 1, "high": 11, "medium": 10, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/requirements.txt" ], "finding_id_aliases": { "PYSEC-2026-141": [ "CVE-2026-44431", "GHSA-qccp-gfcp-xxvc" ], "PYSEC-2026-161": [ "CVE-2026-48710", "GHSA-86qp-5c8j-p5mr", "X41-2026-002" ], "PYSEC-2026-215": [ "CVE-2026-45409", "GHSA-65pc-fj4g-8rjx" ], "PYSEC-2026-248": [ "CVE-2026-54282", "GHSA-jp82-jpqv-5vv3" ], "PYSEC-2026-249": [ "CVE-2026-54283", "GHSA-82w8-qh3p-5jfq" ], "PYSEC-2026-1872": [ "CVE-2024-47081", "GHSA-9hjg-9r4m-mvj7" ], "PYSEC-2026-1941": [ "CVE-2025-54121", "GHSA-2c2j-9gv5-cj73" ], "PYSEC-2026-1942": [ "CVE-2025-62727", "GHSA-7f5h-v6xp-fcq8" ], "PYSEC-2026-1994": [ "CVE-2025-66471", "GHSA-2xpw-w6gg-jr37" ], "PYSEC-2026-1996": [ "CVE-2026-21441", "GHSA-38jv-5279-wg99" ], "PYSEC-2026-1997": [ "CVE-2025-50182", "GHSA-48p4-8xcf-vxj5" ], "PYSEC-2026-1998": [ "CVE-2025-66418", "GHSA-gm62-xv2j-4w53" ], "PYSEC-2026-1999": [ "CVE-2025-50181", "GHSA-pq67-6m6q-mj2v" ], "PYSEC-2026-2132": [ "CVE-2026-7246", "GHSA-47fr-3ffg-hgmw" ], "PYSEC-2026-2270": [ "CVE-2026-28684", "GHSA-mf9w-mj56-hr94" ], "PYSEC-2026-2275": [ "CVE-2026-25645", "GHSA-gc5v-m9x4-r6x2" ], "PYSEC-2026-2280": [ "CVE-2026-48817", "GHSA-x746-7m8f-x49c" ], "PYSEC-2026-2281": [ "CVE-2026-48818", "GHSA-wqp7-x3pw-xc5r" ], "PYSEC-2026-2987": [ "CVE-2026-4539", "GHSA-5239-wwwm-4pmq" ], "GHSA-hvrp-rf83-w775": [ "CVE-2026-52870" ], "GHSA-jpw9-pfvf-9f58": [ "CVE-2026-52869" ], "GHSA-vj7q-gjh5-988w": [ "CVE-2026-59950" ] }, "cross_scanner_correlation": { "only_osv": [ "GHSA-hvrp-rf83-w775", "GHSA-jpw9-pfvf-9f58", "GHSA-vj7q-gjh5-988w", "PYSEC-2026-2132" ], "only_trivy": [], "intersection_ids": [ "CVE-2024-47081", "CVE-2025-50181", "CVE-2025-50182", "CVE-2025-54121", "CVE-2025-62727", "CVE-2025-66418", "CVE-2025-66471", "CVE-2026-21441", "CVE-2026-25645", "CVE-2026-28684", "CVE-2026-44431", "CVE-2026-4539", "CVE-2026-45409", "CVE-2026-48710", "CVE-2026-48817", "CVE-2026-48818", "CVE-2026-54282", "CVE-2026-54283" ] } }, "display_score": 0.0, "display_badge": "Unsafe" } ], "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.", "audit_chain": { "scan_job_id": "a357c5ec-5e74-407b-9e8f-c4c4a6c9dd4e", "scan_completed_at": "2026-07-21T01:31:14.566246+00:00", "scanner_versions": { "agentshield": "1.4.0", "cisco-skill-scanner": "2.0.11", "agent-audit-kit": "0.3.26", "bearer": "2.0.2", "nerlo-behavioral": "0.1.0", "nerlo-install-instruction": "0.1.0", "trivy": "0.71.0", "osv-scanner": "2.3.8" }, "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:0d7a0f702716ad30f03909f728be7c48ecb0d11e336553babe5fda357f15fba8", "ai_decision_log_ids": [ "e8b319cc-dd16-4f48-9f64-4c31fec0c3f7" ], "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation" }, "appendix": { "raw_scanner_reports": [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 1.164174528006697, "status": "not_applicable", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [] }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 53.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/.", "line_number": null, "rule_identifier": "EXCESSIVE_FILE_COUNT", "title": "Skill package contains many files", "description": "Skill package contains 103 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.", "remediation": "Review file inventory and remove unnecessary files." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "unauthorized_tool_use", "file_path": "/repo/repo/README.md", "line_number": null, "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK", "title": "Undeclared network usage", "description": "Skill code uses network libraries but doesn't declare network requirement", "remediation": "Declare network usage in compatibility field or remove network calls" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'requirements.txt' extension (.txt) suggests one format but Magika detected a different text format: INI configuration file (ini). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/send_test_email.py", "line_number": 29, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/test_email_service.py", "line_number": 62, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/test_email_service.py", "line_number": 83, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/test_email_templates.py", "line_number": 33, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/test_email_templates.py", "line_number": 54, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/test_upgrade_email.py", "line_number": 31, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/documentation/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/documentation/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" } ], "execution_duration_seconds": 72.75545678498747, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo", "documentation" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 3, "high": 0, "medium": 8, "critical": 0, "informational": 2 } }, "display_score": 53.0, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "setup_email.py", "line_number": 34, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "tests/test_email_templates.py", "line_number": 54, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "tests/test_upgrade_email.py", "line_number": 31, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "congress_api/core/api_config.py", "line_number": 68, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "pyproject.toml", "line_number": null, "rule_identifier": "AAK-SUPPLY-004", "title": "No lockfile present", "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.", "remediation": "Generate and commit lockfile." }, { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "SECURITY.md", "line_number": null, "rule_identifier": "AAK-SEC-MD-001", "title": "MCP server repo missing SECURITY.md or security_contact", "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.", "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "documentation/CongressAPI_documentation.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "documentation/CongressAPI_documentation.md", "line_number": 5605, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/treaties_and_summaries_tool.py", "line_number": 125, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/bills_tool.py", "line_number": 197, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/amendments_tool.py", "line_number": 128, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/buckets/committee_intelligence.py", "line_number": 268, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/buckets/research_and_professional.py", "line_number": 195, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/buckets/records_and_hearings.py", "line_number": 257, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/buckets/laws.py", "line_number": 167, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "taint-analysis", "file_path": "congress_api/features/buckets/voting_and_nominations.py", "line_number": 227, "rule_identifier": "AAK-LOGINJ-001", "title": "MCP tool logs caller-controlled input without CRLF/ANSI sanitization", "description": "A `@tool`-decorated function parameter flows into logger.info / print / sys.stdout.write / console.log without stripping control characters (\\r, \\n, \\x1b) first. CVE-2026-6494 (AAP MCP, CVSS 5.3 MEDIUM, CWE-117) lets an attacker forge log entries and inject ANSI escape sequences to socially engineer an operator.", "remediation": "Strip \\r\\n\\x1b (or accept only printable ASCII) before logging anything derived from tool input. Prefer structured logging (JSON/logfmt) so log consumers aren't confused by forged lines." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "pyproject.toml", "line_number": 6, "rule_identifier": "AAK-OAUTH-3P-001", "title": "Repo depends on a third-party agent-platform SDK", "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.", "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident" }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "requirements.txt", "line_number": 2, "rule_identifier": "AAK-OAUTH-3P-001", "title": "Repo depends on a third-party agent-platform SDK", "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.", "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident" }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/publish.yml", "line_number": 29, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "tests/test_user_creation.py", "line_number": 52, "rule_identifier": "AAK-SPLUNK-TOKLOG-001", "title": "Session token written to log sink in cleartext", "description": "An MCP server, agent, or tool logs a session token, JWT, or Bearer credential through a generic log sink (logger.info / .warn / .error, print) without redaction. CVE-2026-20205 (splunk-mcp-server < 1.0.3) shipped this exact pattern \u2014 session tokens ended up in the Splunk `_internal` index, readable by anyone with index-read. Any token written to a log sink is also a supply-chain risk: the log file, shipper, and SIEM are now in scope for the token's blast radius.", "remediation": "Redact token-shaped values before logging. Never interpolate a raw `Authorization`, `Bearer`, JWT, `splunkd_session`, or `st-` credential into a log message. Pin `splunk-mcp-server >= 1.0.3`." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "scripts/init_database.py", "line_number": 65, "rule_identifier": "AAK-SPLUNK-TOKLOG-001", "title": "Session token written to log sink in cleartext", "description": "An MCP server, agent, or tool logs a session token, JWT, or Bearer credential through a generic log sink (logger.info / .warn / .error, print) without redaction. CVE-2026-20205 (splunk-mcp-server < 1.0.3) shipped this exact pattern \u2014 session tokens ended up in the Splunk `_internal` index, readable by anyone with index-read. Any token written to a log sink is also a supply-chain risk: the log file, shipper, and SIEM are now in scope for the token's blast radius.", "remediation": "Redact token-shaped values before logging. Never interpolate a raw `Authorization`, `Bearer`, JWT, `splunkd_session`, or `st-` credential into a log message. Pin `splunk-mcp-server >= 1.0.3`." } ], "execution_duration_seconds": 64.57355511101196, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 98, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 1, "high": 7, "medium": 13, "critical": 0, "informational": 0 } }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 13.36410034399887, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 56.014483658000245, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 62, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 53.647198407998076, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 7, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "trivy", "severity": "low", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-4539", "title": "pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer", "description": "A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.", "remediation": "Upgrade Pygments from 2.19.1 to 2.20.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-45409", "title": "python-idna: idna: Denial of Service via specially crafted long inputs", "description": "Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi", "remediation": "Upgrade idna from 3.10 to 3.15 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-28684", "title": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following", "description": "python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.", "remediation": "Upgrade python-dotenv from 1.1.0 to 1.2.2 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2024-47081", "title": "requests: Requests vulnerable to .netrc credentials leak via malicious URLs", "description": "Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.", "remediation": "Upgrade requests from 2.32.3 to 2.32.4 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-25645", "title": "requests: Requests: Security bypass due to predictable temporary file creation", "description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulner", "remediation": "Upgrade requests from 2.32.3 to 2.33.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2025-62727", "title": "starlette: Starlette DoS via Range header merging", "description": "Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial\u2011of\u2011service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.", "remediation": "Upgrade starlette from 0.46.2 to 0.49.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-48818", "title": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows", "description": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account\u2019s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas", "remediation": "Upgrade starlette from 0.46.2 to 1.1.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-54283", "title": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS", "description": "Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.", "remediation": "Upgrade starlette from 0.46.2 to 1.3.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2025-54121", "title": "starlette: Starlette denial-of-service", "description": "Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_me", "remediation": "Upgrade starlette from 0.46.2 to 0.47.2 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-48710", "title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header", "description": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) ", "remediation": "Upgrade starlette from 0.46.2 to 1.0.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-48817", "title": "starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods", "description": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo", "remediation": "Upgrade starlette from 0.46.2 to 1.1.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-54282", "title": "starlette: Starlette: Information disclosure due to improper HTTP request path validation", "description": "Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header ", "remediation": "Upgrade starlette from 0.46.2 to 1.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2025-66418", "title": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2025-66471", "title": "urllib3: urllib3 Streaming API improperly handles highly compressed data", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, b", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-21441", "title": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)", "description": "urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in ve", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.3 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2026-44431", "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers", "description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.7.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2025-50181", "title": "urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation", "description": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.5.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pip", "file_path": "requirements.txt", "line_number": null, "rule_identifier": "CVE-2025-50182", "title": "urllib3: urllib3 does not control redirects in browsers and Node.js", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodi", "remediation": "Upgrade urllib3 from 2.4.0 to 2.5.0 or later" } ], "execution_duration_seconds": 1.6881044760084478, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "severity_counts": { "low": 2, "high": 7, "medium": 9, "critical": 0, "informational": 0 }, "manifests_scanned": [ "requirements.txt" ] }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-2987", "title": "PYSEC-2026-2987 \u2014 PyPI pygments@2.19.1", "description": "aliases: CVE-2026-4539, GHSA-5239-wwwm-4pmq, PYSEC-2026-2987 | CVSS: 3.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-2132", "title": "PYSEC-2026-2132 \u2014 PyPI click@8.2.1", "description": "aliases: CVE-2026-7246, GHSA-47fr-3ffg-hgmw, PYSEC-2026-2132 | CVSS: 7.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-215", "title": "PYSEC-2026-215 \u2014 PyPI idna@3.10", "description": "aliases: CVE-2026-45409, GHSA-65pc-fj4g-8rjx, PYSEC-2026-215 | CVSS: 6.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "GHSA-hvrp-rf83-w775", "title": "GHSA-hvrp-rf83-w775 \u2014 PyPI mcp@1.26.0", "description": "aliases: CVE-2026-52870, GHSA-hvrp-rf83-w775 | CVSS: 7.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "GHSA-jpw9-pfvf-9f58", "title": "GHSA-jpw9-pfvf-9f58 \u2014 PyPI mcp@1.26.0", "description": "aliases: CVE-2026-52869, GHSA-jpw9-pfvf-9f58 | CVSS: 7.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "GHSA-vj7q-gjh5-988w", "title": "GHSA-vj7q-gjh5-988w \u2014 PyPI mcp@1.26.0", "description": "aliases: CVE-2026-59950, GHSA-vj7q-gjh5-988w | CVSS: 7.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-2270", "title": "PYSEC-2026-2270 \u2014 PyPI python-dotenv@1.1.0", "description": "aliases: CVE-2026-28684, GHSA-mf9w-mj56-hr94, PYSEC-2026-2270 | CVSS: 6.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1872", "title": "PYSEC-2026-1872 \u2014 PyPI requests@2.32.3", "description": "aliases: CVE-2024-47081, GHSA-9hjg-9r4m-mvj7, PYSEC-2026-1872 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-2275", "title": "PYSEC-2026-2275 \u2014 PyPI requests@2.32.3", "description": "aliases: CVE-2026-25645, GHSA-gc5v-m9x4-r6x2, PYSEC-2026-2275 | CVSS: 5.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-161", "title": "PYSEC-2026-161 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48710, GHSA-86qp-5c8j-p5mr, PYSEC-2026-161, X41-2026-002 | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1941", "title": "PYSEC-2026-1941 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2025-54121, GHSA-2c2j-9gv5-cj73, PYSEC-2026-1941 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1942", "title": "PYSEC-2026-1942 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2025-62727, GHSA-7f5h-v6xp-fcq8, PYSEC-2026-1942 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-2280", "title": "PYSEC-2026-2280 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48817, GHSA-x746-7m8f-x49c, PYSEC-2026-2280 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-2281", "title": "PYSEC-2026-2281 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48818, GHSA-wqp7-x3pw-xc5r, PYSEC-2026-2281 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-248", "title": "PYSEC-2026-248 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-54282, GHSA-jp82-jpqv-5vv3, PYSEC-2026-248 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-249", "title": "PYSEC-2026-249 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-54283, GHSA-82w8-qh3p-5jfq, PYSEC-2026-249 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-141", "title": "PYSEC-2026-141 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2026-44431, GHSA-qccp-gfcp-xxvc, PYSEC-2026-141 | CVSS: 8.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1994", "title": "PYSEC-2026-1994 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-66471, GHSA-2xpw-w6gg-jr37, PYSEC-2026-1994 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1996", "title": "PYSEC-2026-1996 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2026-21441, GHSA-38jv-5279-wg99, PYSEC-2026-1996 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1997", "title": "PYSEC-2026-1997 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-50182, GHSA-48p4-8xcf-vxj5, PYSEC-2026-1997 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1998", "title": "PYSEC-2026-1998 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-66418, GHSA-gm62-xv2j-4w53, PYSEC-2026-1998 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/requirements.txt", "line_number": null, "rule_identifier": "PYSEC-2026-1999", "title": "PYSEC-2026-1999 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-50181, GHSA-pq67-6m6q-mj2v, PYSEC-2026-1999 | CVSS: 5.3", "remediation": null } ], "execution_duration_seconds": 5.339111591005349, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "PyPI" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 1, "high": 11, "medium": 10, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/requirements.txt" ], "finding_id_aliases": { "PYSEC-2026-141": [ "CVE-2026-44431", "GHSA-qccp-gfcp-xxvc" ], "PYSEC-2026-161": [ "CVE-2026-48710", "GHSA-86qp-5c8j-p5mr", "X41-2026-002" ], "PYSEC-2026-215": [ "CVE-2026-45409", "GHSA-65pc-fj4g-8rjx" ], "PYSEC-2026-248": [ "CVE-2026-54282", "GHSA-jp82-jpqv-5vv3" ], "PYSEC-2026-249": [ "CVE-2026-54283", "GHSA-82w8-qh3p-5jfq" ], "PYSEC-2026-1872": [ "CVE-2024-47081", "GHSA-9hjg-9r4m-mvj7" ], "PYSEC-2026-1941": [ "CVE-2025-54121", "GHSA-2c2j-9gv5-cj73" ], "PYSEC-2026-1942": [ "CVE-2025-62727", "GHSA-7f5h-v6xp-fcq8" ], "PYSEC-2026-1994": [ "CVE-2025-66471", "GHSA-2xpw-w6gg-jr37" ], "PYSEC-2026-1996": [ "CVE-2026-21441", "GHSA-38jv-5279-wg99" ], "PYSEC-2026-1997": [ "CVE-2025-50182", "GHSA-48p4-8xcf-vxj5" ], "PYSEC-2026-1998": [ "CVE-2025-66418", "GHSA-gm62-xv2j-4w53" ], "PYSEC-2026-1999": [ "CVE-2025-50181", "GHSA-pq67-6m6q-mj2v" ], "PYSEC-2026-2132": [ "CVE-2026-7246", "GHSA-47fr-3ffg-hgmw" ], "PYSEC-2026-2270": [ "CVE-2026-28684", "GHSA-mf9w-mj56-hr94" ], "PYSEC-2026-2275": [ "CVE-2026-25645", "GHSA-gc5v-m9x4-r6x2" ], "PYSEC-2026-2280": [ "CVE-2026-48817", "GHSA-x746-7m8f-x49c" ], "PYSEC-2026-2281": [ "CVE-2026-48818", "GHSA-wqp7-x3pw-xc5r" ], "PYSEC-2026-2987": [ "CVE-2026-4539", "GHSA-5239-wwwm-4pmq" ], "GHSA-hvrp-rf83-w775": [ "CVE-2026-52870" ], "GHSA-jpw9-pfvf-9f58": [ "CVE-2026-52869" ], "GHSA-vj7q-gjh5-988w": [ "CVE-2026-59950" ] }, "cross_scanner_correlation": { "only_osv": [ "GHSA-hvrp-rf83-w775", "GHSA-jpw9-pfvf-9f58", "GHSA-vj7q-gjh5-988w", "PYSEC-2026-2132" ], "only_trivy": [], "intersection_ids": [ "CVE-2024-47081", "CVE-2025-50181", "CVE-2025-50182", "CVE-2025-54121", "CVE-2025-62727", "CVE-2025-66418", "CVE-2025-66471", "CVE-2026-21441", "CVE-2026-25645", "CVE-2026-28684", "CVE-2026-44431", "CVE-2026-4539", "CVE-2026-45409", "CVE-2026-48710", "CVE-2026-48817", "CVE-2026-48818", "CVE-2026-54282", "CVE-2026-54283" ] } }, "display_score": 0.0, "display_badge": "Unsafe" } ] }, "report": { "report_id": "95d758aa-c6f2-45e4-abb4-3229963404a0", "format": "json", "generated_at": "2026-07-21T20:58:29.506332+00:00", "scanner_filter": null, "signature": null } }