{ "executive_summary": { "badge": "Unsafe", "security_score": 25.9, "view": "composite", "scanner_badges": { "agentshield": "unavailable", "cisco-skill-scanner": "Unsafe", "agent-audit-kit": "Unsafe", "bearer": "Verified", "nerlo-behavioral": "Verified", "nerlo-install-instruction": "Unsafe", "trivy": "Unsafe", "osv-scanner": "Unsafe" }, "finding_counts": { "critical": 0, "high": 56, "medium": 78, "low": 18 }, "recommendation": "singlestore_mcp_server is NOT recommended for integration: the scan surfaced 0 critical and 56 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering." }, "source_provenance": { "repository_url": "https://github.com/singlestore-labs/mcp-server-singlestore", "commit_sha_scanned": null, "license": null, "maintainer": null, "name": "singlestore_mcp_server", "version": null }, "per_scanner_detail": [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 1.471648175996961, "status": "not_applicable", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [] }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/.", "line_number": null, "rule_identifier": "EXCESSIVE_FILE_COUNT", "title": "Skill package contains many files", "description": "Skill package contains 140 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.", "remediation": "Review file inventory and remove unnecessary files." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.pre-commit-config.yaml", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .pre-commit-config.yaml. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "unauthorized_tool_use", "file_path": "/repo/repo/CONTRIBUTING.md", "line_number": null, "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK", "title": "Undeclared network usage", "description": "Skill code uses network libraries but doesn't declare network requirement", "remediation": "Declare network usage in compatibility field or remove network calls" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/CONTRIBUTING.md", "line_number": 2, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/SKILL.md", "line_number": 2, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/api/common.py", "line_number": 183, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.post(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/api/common.py", "line_number": 319, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.get(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/api/common.py", "line_number": 326, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.post(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/api/common.py", "line_number": 334, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.put(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/api/common.py", "line_number": 342, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.patch(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/api/common.py", "line_number": 349, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.delete(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/src/api/tools/database/database.py", "line_number": 363, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/src/api/tools/notebooks/utils.py", "line_number": 131, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/auth/browser_auth.py", "line_number": 145, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.get(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "data_exfiltration", "file_path": "/repo/src/auth/browser_auth.py", "line_number": 169, "rule_identifier": "DATA_EXFIL_SENSITIVE_FILES", "title": "Opening sensitive system or credential files", "description": "Pattern detected: open(credentials_path", "remediation": "Do not read credential files or sensitive system files" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/auth/browser_auth.py", "line_number": 530, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.post(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/auth/browser_auth.py", "line_number": 685, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.post(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/src/auth/models/models.py", "line_number": 134, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/src/auth/models/models.py", "line_number": 136, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/src/auth/models/models.py", "line_number": 138, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/auth/provider.py", "line_number": 391, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.get(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/config/config.py", "line_number": 153, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.get(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/tests/__init__.py", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File '__init__.py' extension (.py) suggests one format but Magika detected a different text format: Markdown document (markdown). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "command_injection", "file_path": "/repo/tests/integration/cli/test_cli_commands.py", "line_number": 37, "rule_identifier": "COMMAND_INJECTION_SHELL_TRUE", "title": "Shell command execution with shell=True enabled", "description": "Pattern detected: subprocess.run(\"uvx --from build pyproject-build\", shell=True", "remediation": "Use shell=False and pass commands as lists" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "command_injection", "file_path": "/repo/tests/integration/cli/test_cli_commands.py", "line_number": 43, "rule_identifier": "YARA_code_execution_generic", "title": "CODE EXECUTION detected by YARA", "description": "Detects dangerous code execution patterns with untrusted input in agent skills: subprocess.run(\n f\"", "remediation": "Review and remove code execution pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/integration/tools/conftest.py", "line_number": 50, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_authenticate_main.py", "line_number": 71, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_authenticate_main.py", "line_number": 73, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_refresh_and_auth_main.py", "line_number": 282, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_refresh_token_helpers.py", "line_number": 260, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_refresh_token_helpers.py", "line_number": 263, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_refresh_token_helpers.py", "line_number": 284, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_refresh_token_helpers.py", "line_number": 286, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_session_credentials_manager.py", "line_number": 41, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_session_credentials_manager.py", "line_number": 65, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_session_credentials_manager.py", "line_number": 146, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_session_credentials_manager.py", "line_number": 176, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_session_credentials_manager.py", "line_number": 187, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/managers/test_s2_manager.py", "line_number": 15, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/test_cloud_functions.py", "line_number": 15, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/test_stage.py", "line_number": 23, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/test_uuid_validation.py", "line_number": 118, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/scripts/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/scripts/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/changelog/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/changelog/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "unauthorized_tool_use", "file_path": "/repo/src/config/repo/src/config/instructions.md", "line_number": null, "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK", "title": "Undeclared network usage", "description": "Skill code uses network libraries but doesn't declare network requirement", "remediation": "Declare network usage in compatibility field or remove network calls" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/src/config/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/src/config/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/config/config.py", "line_number": 153, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.get(", "remediation": "Ensure network operations are necessary and document allowed destinations" } ], "execution_duration_seconds": 42.75894333899487, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo", "scripts", "changelog", "config" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 8, "high": 2, "medium": 38, "critical": 0, "informational": 4 } }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/commands/start.py", "line_number": 20, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/auth/models/models.py", "line_number": 134, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/auth/models/models.py", "line_number": 134, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/auth/models/models.py", "line_number": 136, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/auth/models/models.py", "line_number": 136, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/auth/models/models.py", "line_number": 138, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/auth/models/models.py", "line_number": 138, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "SECURITY.md", "line_number": null, "rule_identifier": "AAK-SEC-MD-001", "title": "MCP server repo missing SECURITY.md or security_contact", "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.", "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "mcp-config", "file_path": "src/config/config.py", "line_number": 29, "rule_identifier": "AAK-SSRF-002", "title": "Localhost/loopback reachable from MCP tool", "description": "An MCP tool handler forwards user-supplied URLs that could target 127.0.0.1/localhost/::1, reaching internal services bound to loopback.", "remediation": "Block loopback and link-local addresses after DNS resolution." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "mcp-config", "file_path": "tests/unit/test_uuid_validation.py", "line_number": 64, "rule_identifier": "AAK-OAUTH-004", "title": "Wildcard or overly-broad redirect_uri", "description": "An OAuth client registers a wildcard, localhost-with-any-port, or overly-broad redirect_uri. Attackers can hijack authorization codes via dangling subdomains or open redirectors.", "remediation": "Register exact-match redirect URIs only. No wildcards." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "mcp-config", "file_path": "tests/unit/auth/test_authenticate_helpers.py", "line_number": 126, "rule_identifier": "AAK-OAUTH-004", "title": "Wildcard or overly-broad redirect_uri", "description": "An OAuth client registers a wildcard, localhost-with-any-port, or overly-broad redirect_uri. Attackers can hijack authorization codes via dangling subdomains or open redirectors.", "remediation": "Register exact-match redirect URIs only. No wildcards." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "mcp-config", "file_path": "tests/unit/auth/test_refresh_and_auth_main.py", "line_number": 48, "rule_identifier": "AAK-OAUTH-001", "title": "OAuth flow without PKCE", "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.", "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "mcp-config", "file_path": "tests/unit/auth/test_refresh_token_helpers.py", "line_number": 145, "rule_identifier": "AAK-OAUTH-001", "title": "OAuth flow without PKCE", "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.", "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "CONTRIBUTING.md", "line_number": 469, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "scripts/README.md", "line_number": 11, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "pyproject.toml", "line_number": 2, "rule_identifier": "AAK-OAUTH-3P-001", "title": "Repo depends on a third-party agent-platform SDK", "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.", "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident" }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": "pyproject.toml", "line_number": 8, "rule_identifier": "AAK-DNS-REBIND-002", "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)", "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.", "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/publish-pypi.yml", "line_number": 72, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/publish-pypi.yml", "line_number": 90, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/ci.yml", "line_number": 35, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/api/common.py", "line_number": 499, "rule_identifier": "AAK-SPLUNK-TOKLOG-001", "title": "Session token written to log sink in cleartext", "description": "An MCP server, agent, or tool logs a session token, JWT, or Bearer credential through a generic log sink (logger.info / .warn / .error, print) without redaction. CVE-2026-20205 (splunk-mcp-server < 1.0.3) shipped this exact pattern \u2014 session tokens ended up in the Splunk `_internal` index, readable by anyone with index-read. Any token written to a log sink is also a supply-chain risk: the log file, shipper, and SIEM are now in scope for the token's blast radius.", "remediation": "Redact token-shaped values before logging. Never interpolate a raw `Authorization`, `Bearer`, JWT, `splunkd_session`, or `st-` credential into a log message. Pin `splunk-mcp-server >= 1.0.3`." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/config/config.py", "line_number": 86, "rule_identifier": "AAK-SPLUNK-TOKLOG-001", "title": "Session token written to log sink in cleartext", "description": "An MCP server, agent, or tool logs a session token, JWT, or Bearer credential through a generic log sink (logger.info / .warn / .error, print) without redaction. CVE-2026-20205 (splunk-mcp-server < 1.0.3) shipped this exact pattern \u2014 session tokens ended up in the Splunk `_internal` index, readable by anyone with index-read. Any token written to a log sink is also a supply-chain risk: the log file, shipper, and SIEM are now in scope for the token's blast radius.", "remediation": "Redact token-shaped values before logging. Never interpolate a raw `Authorization`, `Bearer`, JWT, `splunkd_session`, or `st-` credential into a log message. Pin `splunk-mcp-server >= 1.0.3`." } ], "execution_duration_seconds": 30.498908307999955, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 134, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 1, "high": 17, "medium": 4, "critical": 0, "informational": 0 } }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 13.948422822999419, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 50.23953489300038, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 64, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 59.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/CONTRIBUTING.md", "line_number": 30, "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.", "remediation": null } ], "execution_duration_seconds": 50.00941608501307, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 22, "install_command": "pip install 'semgrep==1.97.0'", "severity_counts": { "low": 0, "high": 1, "medium": 0, "critical": 0, "informational": 0 } }, "display_score": 59.0, "display_badge": "Unsafe" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-68146", "title": "filelock: filelock: Time-of-Check-Time-of-Use (TOCTOU) race condition and symlink attack allows arbitrary file corruption or truncation", "description": "filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows lock file creation where filelock checks if a file exists before opening it with O_TRUNC. An attacker can create a symlink pointing to a victim file in the time gap between the check and open, causing os.open() to follow", "remediation": "Upgrade filelock from 3.18.0 to 3.20.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-22701", "title": "filelock: filelock Time-of-Check-Time-of-Use (TOCTOU) in SoftFileLock", "description": "filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission c", "remediation": "Upgrade filelock from 3.18.0 to 3.20.3 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-45409", "title": "python-idna: idna: Denial of Service via specially crafted long inputs", "description": "Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi", "remediation": "Upgrade idna from 3.10 to 3.15 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-30167", "title": "Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability", "description": "Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to recei", "remediation": "Upgrade jupyter-core from 5.7.2 to 5.8.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-66416", "title": "mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK", "description": "The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin po", "remediation": "Upgrade mcp from 1.10.1 to 1.23.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-52869", "title": "MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal", "description": "The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client", "remediation": "Upgrade mcp from 1.10.1 to 1.27.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-59950", "title": "MCP Python SDK: WebSocket server transport does not support Host/Origin validation", "description": "The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.", "remediation": "Upgrade mcp from 1.10.1 to 1.28.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-32597", "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)", "description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.", "remediation": "Upgrade pyjwt from 2.10.1 to 2.12.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48526", "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens", "description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.", "remediation": "Upgrade pyjwt from 2.10.1 to 2.13.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48522", "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient", "description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parame", "remediation": "Upgrade pyjwt from 2.10.1 to 2.13.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48523", "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access", "description": "PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, adv", "remediation": "Upgrade pyjwt from 2.10.1 to 2.13.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48525", "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens", "description": "PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option (\"b64\": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled \u201cwork amplifier\u201d: a", "remediation": "Upgrade pyjwt from 2.10.1 to 2.13.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48524", "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs", "description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint be", "remediation": "Upgrade pyjwt from 2.10.1 to 2.13.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-71176", "title": "pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handling", "description": "pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.", "remediation": "Upgrade pytest from 8.3.5 to 9.0.3 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-28684", "title": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following", "description": "python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.", "remediation": "Upgrade python-dotenv from 1.1.0 to 1.2.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-24486", "title": "python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.22 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-42561", "title": "python-multipart: python-multipart: Denial of Service via excessive multipart part headers", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request reje", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.27 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-53539", "title": "python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the ne", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.30 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-40347", "title": "python-multipart: Python-Multipart: Denial of Service via crafted multipart/form-data requests", "description": "Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.26 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-53537", "title": "multipart: Python-Multipart: Information disclosure via header parsing discrepancy", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset'lang'value, name*=..., and the filename*0/filename*1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 \u00a74.2 explicitly forbid", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.30 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-53538", "title": "python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form ", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.30 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-53540", "title": "python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.31 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2024-47081", "title": "requests: Requests vulnerable to .netrc credentials leak via malicious URLs", "description": "Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.", "remediation": "Upgrade requests from 2.32.3 to 2.32.4 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-25645", "title": "requests: Requests: Security bypass due to predictable temporary file creation", "description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulner", "remediation": "Upgrade requests from 2.32.3 to 2.33.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-62727", "title": "starlette: Starlette DoS via Range header merging", "description": "Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial\u2011of\u2011service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.", "remediation": "Upgrade starlette from 0.46.2 to 0.49.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48818", "title": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows", "description": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account\u2019s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas", "remediation": "Upgrade starlette from 0.46.2 to 1.1.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-54283", "title": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS", "description": "Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.", "remediation": "Upgrade starlette from 0.46.2 to 1.3.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-54121", "title": "starlette: Starlette denial-of-service", "description": "Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_me", "remediation": "Upgrade starlette from 0.46.2 to 0.47.2 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48710", "title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header", "description": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) ", "remediation": "Upgrade starlette from 0.46.2 to 1.0.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48817", "title": "starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods", "description": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo", "remediation": "Upgrade starlette from 0.46.2 to 1.1.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-54282", "title": "starlette: Starlette: Information disclosure due to improper HTTP request path validation", "description": "Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header ", "remediation": "Upgrade starlette from 0.46.2 to 1.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-66418", "title": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-66471", "title": "urllib3: urllib3 Streaming API improperly handles highly compressed data", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, b", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-21441", "title": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)", "description": "urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in ve", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.3 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-44431", "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers", "description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.7.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-50181", "title": "urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation", "description": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.5.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-50182", "title": "urllib3: urllib3 does not control redirects in browsers and Node.js", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodi", "remediation": "Upgrade urllib3 from 2.4.0 to 2.5.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-22702", "title": "virtualenv: virtualenv: Local attacker can redirect file operations via TOCTOU race condition", "description": "virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.", "remediation": "Upgrade virtualenv from 20.31.2 to 20.36.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-24049", "title": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking", "description": "wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of c", "remediation": "Upgrade wheel from 0.45.1 to 0.46.2 or later" } ], "execution_duration_seconds": 3.681514887997764, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "severity_counts": { "low": 5, "high": 17, "medium": 17, "critical": 0, "informational": 0 }, "manifests_scanned": [ "uv.lock" ] }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2132", "title": "PYSEC-2026-2132 \u2014 PyPI click@8.2.1", "description": "aliases: CVE-2026-7246, GHSA-47fr-3ffg-hgmw, PYSEC-2026-2132 | CVSS: 7.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1374", "title": "PYSEC-2026-1374 \u2014 PyPI filelock@3.18.0", "description": "aliases: CVE-2026-22701, GHSA-qmgc-5h2g-mvrw, PYSEC-2026-1374 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1375", "title": "PYSEC-2026-1375 \u2014 PyPI filelock@3.18.0", "description": "aliases: CVE-2025-68146, GHSA-w853-jp5j-5j7f, PYSEC-2026-1375 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-215", "title": "PYSEC-2026-215 \u2014 PyPI idna@3.10", "description": "aliases: CVE-2026-45409, GHSA-65pc-fj4g-8rjx, PYSEC-2026-215 | CVSS: 6.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1477", "title": "PYSEC-2026-1477 \u2014 PyPI jupyter-core@5.7.2", "description": "aliases: CVE-2025-30167, GHSA-33p9-3p43-82vq, PYSEC-2026-1477 | CVSS: 7.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1617", "title": "PYSEC-2026-1617 \u2014 PyPI mcp@1.10.1", "description": "aliases: CVE-2025-66416, GHSA-9h52-p55h-vw2f, PYSEC-2026-1617 | CVSS: 7.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "GHSA-jpw9-pfvf-9f58", "title": "GHSA-jpw9-pfvf-9f58 \u2014 PyPI mcp@1.10.1", "description": "aliases: CVE-2026-52869, GHSA-jpw9-pfvf-9f58 | CVSS: 7.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "GHSA-vj7q-gjh5-988w", "title": "GHSA-vj7q-gjh5-988w \u2014 PyPI mcp@1.10.1", "description": "aliases: CVE-2026-59950, GHSA-vj7q-gjh5-988w | CVSS: 7.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2025-183", "title": "PYSEC-2025-183 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2025-45768, PYSEC-2025-183 | CVSS: 7.0", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-120", "title": "PYSEC-2026-120 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2026-32597, GHSA-752w-5fwx-jx9f, PYSEC-2026-120 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-175", "title": "PYSEC-2026-175 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2026-48522, GHSA-993g-76c3-p5m4, PYSEC-2026-175 | CVSS: 4.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-176", "title": "PYSEC-2026-176 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2026-48523, GHSA-jq35-7prp-9v3f, PYSEC-2026-176 | CVSS: 5.4", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-177", "title": "PYSEC-2026-177 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2026-48524, GHSA-fhv5-28vv-h8m8, PYSEC-2026-177 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-178", "title": "PYSEC-2026-178 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2026-48525, GHSA-w7vc-732c-9m39, PYSEC-2026-178 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-179", "title": "PYSEC-2026-179 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2026-48526, GHSA-xgmm-8j9v-c9wx, PYSEC-2026-179 | CVSS: 7.4", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1845", "title": "PYSEC-2026-1845 \u2014 PyPI pytest@8.3.5", "description": "aliases: CVE-2025-71176, GHSA-6w46-j5rx-g56g, PYSEC-2026-1845 | CVSS: 6.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2270", "title": "PYSEC-2026-2270 \u2014 PyPI python-dotenv@1.1.0", "description": "aliases: CVE-2026-28684, GHSA-mf9w-mj56-hr94, PYSEC-2026-2270 | CVSS: 6.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1852", "title": "PYSEC-2026-1852 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-24486, GHSA-wp53-j4wj-2cfg, PYSEC-2026-1852 | CVSS: 8.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3036", "title": "PYSEC-2026-3036 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-53539, GHSA-5rvq-cxj2-64vf, PYSEC-2026-3036 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3037", "title": "PYSEC-2026-3037 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-53538, GHSA-6jv3-5f52-599m, PYSEC-2026-3037 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3038", "title": "PYSEC-2026-3038 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-40347, GHSA-mj87-hwqh-73pj, PYSEC-2026-3038 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3039", "title": "PYSEC-2026-3039 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-42561, GHSA-pp6c-gr5w-3c5g, PYSEC-2026-3039 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3040", "title": "PYSEC-2026-3040 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-53540, GHSA-v9pg-7xvm-68hf, PYSEC-2026-3040 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3041", "title": "PYSEC-2026-3041 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-53537, GHSA-vffw-93wf-4j4q, PYSEC-2026-3041 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1872", "title": "PYSEC-2026-1872 \u2014 PyPI requests@2.32.3", "description": "aliases: CVE-2024-47081, GHSA-9hjg-9r4m-mvj7, PYSEC-2026-1872 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2275", "title": "PYSEC-2026-2275 \u2014 PyPI requests@2.32.3", "description": "aliases: CVE-2026-25645, GHSA-gc5v-m9x4-r6x2, PYSEC-2026-2275 | CVSS: 5.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3447", "title": "PYSEC-2026-3447 \u2014 PyPI setuptools@80.9.0", "description": "aliases: BIT-setuptools-2026-59890, CVE-2026-59890, GHSA-h35f-9h28-mq5c, PYSEC-2026-3447 | CVSS: 6.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-161", "title": "PYSEC-2026-161 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48710, GHSA-86qp-5c8j-p5mr, PYSEC-2026-161, X41-2026-002 | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1941", "title": "PYSEC-2026-1941 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2025-54121, GHSA-2c2j-9gv5-cj73, PYSEC-2026-1941 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1942", "title": "PYSEC-2026-1942 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2025-62727, GHSA-7f5h-v6xp-fcq8, PYSEC-2026-1942 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2280", "title": "PYSEC-2026-2280 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48817, GHSA-x746-7m8f-x49c, PYSEC-2026-2280 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2281", "title": "PYSEC-2026-2281 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48818, GHSA-wqp7-x3pw-xc5r, PYSEC-2026-2281 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-248", "title": "PYSEC-2026-248 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-54282, GHSA-jp82-jpqv-5vv3, PYSEC-2026-248 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-249", "title": "PYSEC-2026-249 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-54283, GHSA-82w8-qh3p-5jfq, PYSEC-2026-249 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-141", "title": "PYSEC-2026-141 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2026-44431, GHSA-qccp-gfcp-xxvc, PYSEC-2026-141 | CVSS: 8.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1994", "title": "PYSEC-2026-1994 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-66471, GHSA-2xpw-w6gg-jr37, PYSEC-2026-1994 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1996", "title": "PYSEC-2026-1996 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2026-21441, GHSA-38jv-5279-wg99, PYSEC-2026-1996 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1997", "title": "PYSEC-2026-1997 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-50182, GHSA-48p4-8xcf-vxj5, PYSEC-2026-1997 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1998", "title": "PYSEC-2026-1998 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-66418, GHSA-gm62-xv2j-4w53, PYSEC-2026-1998 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1999", "title": "PYSEC-2026-1999 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-50181, GHSA-pq67-6m6q-mj2v, PYSEC-2026-1999 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2009", "title": "PYSEC-2026-2009 \u2014 PyPI virtualenv@20.31.2", "description": "aliases: BIT-virtualenv-2026-22702, CVE-2026-22702, GHSA-597g-3phw-6986, PYSEC-2026-2009 | CVSS: 4.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2047", "title": "PYSEC-2026-2047 \u2014 PyPI wheel@0.45.1", "description": "aliases: CVE-2026-24049, GHSA-8rrh-rw8j-w5fx, PYSEC-2026-2047 | CVSS: 7.1", "remediation": null } ], "execution_duration_seconds": 10.202634995002882, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "PyPI" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 4, "high": 19, "medium": 19, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/uv.lock" ], "finding_id_aliases": { "PYSEC-2025-183": [ "CVE-2025-45768" ], "PYSEC-2026-120": [ "CVE-2026-32597", "GHSA-752w-5fwx-jx9f" ], "PYSEC-2026-141": [ "CVE-2026-44431", "GHSA-qccp-gfcp-xxvc" ], "PYSEC-2026-161": [ "CVE-2026-48710", "GHSA-86qp-5c8j-p5mr", "X41-2026-002" ], "PYSEC-2026-175": [ "CVE-2026-48522", "GHSA-993g-76c3-p5m4" ], "PYSEC-2026-176": [ "CVE-2026-48523", "GHSA-jq35-7prp-9v3f" ], "PYSEC-2026-177": [ "CVE-2026-48524", "GHSA-fhv5-28vv-h8m8" ], "PYSEC-2026-178": [ "CVE-2026-48525", "GHSA-w7vc-732c-9m39" ], "PYSEC-2026-179": [ "CVE-2026-48526", "GHSA-xgmm-8j9v-c9wx" ], "PYSEC-2026-215": [ "CVE-2026-45409", "GHSA-65pc-fj4g-8rjx" ], "PYSEC-2026-248": [ "CVE-2026-54282", "GHSA-jp82-jpqv-5vv3" ], "PYSEC-2026-249": [ "CVE-2026-54283", "GHSA-82w8-qh3p-5jfq" ], "PYSEC-2026-1374": [ "CVE-2026-22701", "GHSA-qmgc-5h2g-mvrw" ], "PYSEC-2026-1375": [ "CVE-2025-68146", "GHSA-w853-jp5j-5j7f" ], "PYSEC-2026-1477": [ "CVE-2025-30167", "GHSA-33p9-3p43-82vq" ], "PYSEC-2026-1617": [ "CVE-2025-66416", "GHSA-9h52-p55h-vw2f" ], "PYSEC-2026-1845": [ "CVE-2025-71176", "GHSA-6w46-j5rx-g56g" ], "PYSEC-2026-1852": [ "CVE-2026-24486", "GHSA-wp53-j4wj-2cfg" ], "PYSEC-2026-1872": [ "CVE-2024-47081", "GHSA-9hjg-9r4m-mvj7" ], "PYSEC-2026-1941": [ "CVE-2025-54121", "GHSA-2c2j-9gv5-cj73" ], "PYSEC-2026-1942": [ "CVE-2025-62727", "GHSA-7f5h-v6xp-fcq8" ], "PYSEC-2026-1994": [ "CVE-2025-66471", "GHSA-2xpw-w6gg-jr37" ], "PYSEC-2026-1996": [ "CVE-2026-21441", "GHSA-38jv-5279-wg99" ], "PYSEC-2026-1997": [ "CVE-2025-50182", "GHSA-48p4-8xcf-vxj5" ], "PYSEC-2026-1998": [ "CVE-2025-66418", "GHSA-gm62-xv2j-4w53" ], "PYSEC-2026-1999": [ "CVE-2025-50181", "GHSA-pq67-6m6q-mj2v" ], "PYSEC-2026-2009": [ "BIT-virtualenv-2026-22702", "CVE-2026-22702", "GHSA-597g-3phw-6986" ], "PYSEC-2026-2047": [ "CVE-2026-24049", "GHSA-8rrh-rw8j-w5fx" ], "PYSEC-2026-2132": [ "CVE-2026-7246", "GHSA-47fr-3ffg-hgmw" ], "PYSEC-2026-2270": [ "CVE-2026-28684", "GHSA-mf9w-mj56-hr94" ], "PYSEC-2026-2275": [ "CVE-2026-25645", "GHSA-gc5v-m9x4-r6x2" ], "PYSEC-2026-2280": [ "CVE-2026-48817", "GHSA-x746-7m8f-x49c" ], "PYSEC-2026-2281": [ "CVE-2026-48818", "GHSA-wqp7-x3pw-xc5r" ], "PYSEC-2026-3036": [ "CVE-2026-53539", "GHSA-5rvq-cxj2-64vf" ], "PYSEC-2026-3037": [ "CVE-2026-53538", "GHSA-6jv3-5f52-599m" ], "PYSEC-2026-3038": [ "CVE-2026-40347", "GHSA-mj87-hwqh-73pj" ], "PYSEC-2026-3039": [ "CVE-2026-42561", "GHSA-pp6c-gr5w-3c5g" ], "PYSEC-2026-3040": [ "CVE-2026-53540", "GHSA-v9pg-7xvm-68hf" ], "PYSEC-2026-3041": [ "CVE-2026-53537", "GHSA-vffw-93wf-4j4q" ], "PYSEC-2026-3447": [ "BIT-setuptools-2026-59890", "CVE-2026-59890", "GHSA-h35f-9h28-mq5c" ], "GHSA-jpw9-pfvf-9f58": [ "CVE-2026-52869" ], "GHSA-vj7q-gjh5-988w": [ "CVE-2026-59950" ] }, "cross_scanner_correlation": { "only_osv": [ "PYSEC-2025-183", "PYSEC-2026-2132", "PYSEC-2026-3447" ], "only_trivy": [], "intersection_ids": [ "CVE-2024-47081", "CVE-2025-30167", "CVE-2025-50181", "CVE-2025-50182", "CVE-2025-54121", "CVE-2025-62727", "CVE-2025-66416", "CVE-2025-66418", "CVE-2025-66471", "CVE-2025-68146", "CVE-2025-71176", "CVE-2026-21441", "CVE-2026-22701", "CVE-2026-22702", "CVE-2026-24049", "CVE-2026-24486", "CVE-2026-25645", "CVE-2026-28684", "CVE-2026-32597", "CVE-2026-40347", "CVE-2026-42561", "CVE-2026-44431", "CVE-2026-45409", "CVE-2026-48522", "CVE-2026-48523", "CVE-2026-48524", "CVE-2026-48525", "CVE-2026-48526", "CVE-2026-48710", "CVE-2026-48817", "CVE-2026-48818", "CVE-2026-52869", "CVE-2026-53537", "CVE-2026-53538", "CVE-2026-53539", "CVE-2026-53540", "CVE-2026-54282", "CVE-2026-54283", "CVE-2026-59950" ] } }, "display_score": 0.0, "display_badge": "Unsafe" } ], "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.", "audit_chain": { "scan_job_id": "5b372da2-3fbe-4fda-af2f-7e551a24256f", "scan_completed_at": "2026-07-21T03:57:25.492958+00:00", "scanner_versions": { "agentshield": "1.4.0", "cisco-skill-scanner": "2.0.11", "agent-audit-kit": "0.3.26", "bearer": "2.0.2", "nerlo-behavioral": "0.1.0", "nerlo-install-instruction": "0.1.0", "trivy": "0.71.0", "osv-scanner": "2.3.8" }, "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:0d7a0f702716ad30f03909f728be7c48ecb0d11e336553babe5fda357f15fba8", "ai_decision_log_ids": [ "5e1ac09a-bab8-4310-9e33-c55f281771a1" ], "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation" }, "appendix": { "raw_scanner_reports": [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 1.471648175996961, "status": "not_applicable", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [] }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/.", "line_number": null, "rule_identifier": "EXCESSIVE_FILE_COUNT", "title": "Skill package contains many files", "description": "Skill package contains 140 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.", "remediation": "Review file inventory and remove unnecessary files." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.pre-commit-config.yaml", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .pre-commit-config.yaml. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "unauthorized_tool_use", "file_path": "/repo/repo/CONTRIBUTING.md", "line_number": null, "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK", "title": "Undeclared network usage", "description": "Skill code uses network libraries but doesn't declare network requirement", "remediation": "Declare network usage in compatibility field or remove network calls" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/CONTRIBUTING.md", "line_number": 2, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "command_injection", "file_path": "/repo/SKILL.md", "line_number": 2, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/api/common.py", "line_number": 183, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.post(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/api/common.py", "line_number": 319, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.get(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/api/common.py", "line_number": 326, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.post(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/api/common.py", "line_number": 334, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.put(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/api/common.py", "line_number": 342, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.patch(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/api/common.py", "line_number": 349, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.delete(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/src/api/tools/database/database.py", "line_number": 363, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/src/api/tools/notebooks/utils.py", "line_number": 131, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/auth/browser_auth.py", "line_number": 145, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.get(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "data_exfiltration", "file_path": "/repo/src/auth/browser_auth.py", "line_number": 169, "rule_identifier": "DATA_EXFIL_SENSITIVE_FILES", "title": "Opening sensitive system or credential files", "description": "Pattern detected: open(credentials_path", "remediation": "Do not read credential files or sensitive system files" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/auth/browser_auth.py", "line_number": 530, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.post(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/auth/browser_auth.py", "line_number": 685, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.post(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/src/auth/models/models.py", "line_number": 134, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/src/auth/models/models.py", "line_number": 136, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/src/auth/models/models.py", "line_number": 138, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/auth/provider.py", "line_number": 391, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.get(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/config/config.py", "line_number": 153, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.get(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/tests/__init__.py", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File '__init__.py' extension (.py) suggests one format but Magika detected a different text format: Markdown document (markdown). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "command_injection", "file_path": "/repo/tests/integration/cli/test_cli_commands.py", "line_number": 37, "rule_identifier": "COMMAND_INJECTION_SHELL_TRUE", "title": "Shell command execution with shell=True enabled", "description": "Pattern detected: subprocess.run(\"uvx --from build pyproject-build\", shell=True", "remediation": "Use shell=False and pass commands as lists" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "command_injection", "file_path": "/repo/tests/integration/cli/test_cli_commands.py", "line_number": 43, "rule_identifier": "YARA_code_execution_generic", "title": "CODE EXECUTION detected by YARA", "description": "Detects dangerous code execution patterns with untrusted input in agent skills: subprocess.run(\n f\"", "remediation": "Review and remove code execution pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/integration/tools/conftest.py", "line_number": 50, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_authenticate_main.py", "line_number": 71, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_authenticate_main.py", "line_number": 73, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_refresh_and_auth_main.py", "line_number": 282, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_refresh_token_helpers.py", "line_number": 260, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_refresh_token_helpers.py", "line_number": 263, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_refresh_token_helpers.py", "line_number": 284, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_refresh_token_helpers.py", "line_number": 286, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_session_credentials_manager.py", "line_number": 41, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_session_credentials_manager.py", "line_number": 65, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_session_credentials_manager.py", "line_number": 146, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_session_credentials_manager.py", "line_number": 176, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/auth/test_session_credentials_manager.py", "line_number": 187, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/managers/test_s2_manager.py", "line_number": 15, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: pass****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/test_cloud_functions.py", "line_number": 15, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/test_stage.py", "line_number": 23, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: api_****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "hardcoded_secrets", "file_path": "/repo/tests/unit/test_uuid_validation.py", "line_number": 118, "rule_identifier": "SECRET_PASSWORD_VAR", "title": "Hardcoded password or secret in variable", "description": "Pattern detected: toke****", "remediation": "Use environment variables or secure vaults for secrets" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/scripts/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/scripts/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/changelog/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/changelog/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "unauthorized_tool_use", "file_path": "/repo/src/config/repo/src/config/instructions.md", "line_number": null, "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK", "title": "Undeclared network usage", "description": "Skill code uses network libraries but doesn't declare network requirement", "remediation": "Declare network usage in compatibility field or remove network calls" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/src/config/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/src/config/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/config/config.py", "line_number": 153, "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: requests.get(", "remediation": "Ensure network operations are necessary and document allowed destinations" } ], "execution_duration_seconds": 42.75894333899487, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo", "scripts", "changelog", "config" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 8, "high": 2, "medium": 38, "critical": 0, "informational": 4 } }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/commands/start.py", "line_number": 20, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/auth/models/models.py", "line_number": 134, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/auth/models/models.py", "line_number": 134, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/auth/models/models.py", "line_number": 136, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/auth/models/models.py", "line_number": 136, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/auth/models/models.py", "line_number": 138, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/auth/models/models.py", "line_number": 138, "rule_identifier": "AAK-SECRET-004", "title": "Generic high-entropy secret", "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.", "remediation": "Move to environment variables or secrets manager." }, { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "SECURITY.md", "line_number": null, "rule_identifier": "AAK-SEC-MD-001", "title": "MCP server repo missing SECURITY.md or security_contact", "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.", "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "mcp-config", "file_path": "src/config/config.py", "line_number": 29, "rule_identifier": "AAK-SSRF-002", "title": "Localhost/loopback reachable from MCP tool", "description": "An MCP tool handler forwards user-supplied URLs that could target 127.0.0.1/localhost/::1, reaching internal services bound to loopback.", "remediation": "Block loopback and link-local addresses after DNS resolution." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "mcp-config", "file_path": "tests/unit/test_uuid_validation.py", "line_number": 64, "rule_identifier": "AAK-OAUTH-004", "title": "Wildcard or overly-broad redirect_uri", "description": "An OAuth client registers a wildcard, localhost-with-any-port, or overly-broad redirect_uri. Attackers can hijack authorization codes via dangling subdomains or open redirectors.", "remediation": "Register exact-match redirect URIs only. No wildcards." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "mcp-config", "file_path": "tests/unit/auth/test_authenticate_helpers.py", "line_number": 126, "rule_identifier": "AAK-OAUTH-004", "title": "Wildcard or overly-broad redirect_uri", "description": "An OAuth client registers a wildcard, localhost-with-any-port, or overly-broad redirect_uri. Attackers can hijack authorization codes via dangling subdomains or open redirectors.", "remediation": "Register exact-match redirect URIs only. No wildcards." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "mcp-config", "file_path": "tests/unit/auth/test_refresh_and_auth_main.py", "line_number": 48, "rule_identifier": "AAK-OAUTH-001", "title": "OAuth flow without PKCE", "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.", "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "mcp-config", "file_path": "tests/unit/auth/test_refresh_token_helpers.py", "line_number": 145, "rule_identifier": "AAK-OAUTH-001", "title": "OAuth flow without PKCE", "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.", "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "CONTRIBUTING.md", "line_number": 469, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "scripts/README.md", "line_number": 11, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "pyproject.toml", "line_number": 2, "rule_identifier": "AAK-OAUTH-3P-001", "title": "Repo depends on a third-party agent-platform SDK", "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.", "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident" }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": "pyproject.toml", "line_number": 8, "rule_identifier": "AAK-DNS-REBIND-002", "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)", "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.", "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/publish-pypi.yml", "line_number": 72, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/publish-pypi.yml", "line_number": 90, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/ci.yml", "line_number": 35, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/api/common.py", "line_number": 499, "rule_identifier": "AAK-SPLUNK-TOKLOG-001", "title": "Session token written to log sink in cleartext", "description": "An MCP server, agent, or tool logs a session token, JWT, or Bearer credential through a generic log sink (logger.info / .warn / .error, print) without redaction. CVE-2026-20205 (splunk-mcp-server < 1.0.3) shipped this exact pattern \u2014 session tokens ended up in the Splunk `_internal` index, readable by anyone with index-read. Any token written to a log sink is also a supply-chain risk: the log file, shipper, and SIEM are now in scope for the token's blast radius.", "remediation": "Redact token-shaped values before logging. Never interpolate a raw `Authorization`, `Bearer`, JWT, `splunkd_session`, or `st-` credential into a log message. Pin `splunk-mcp-server >= 1.0.3`." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "secret-exposure", "file_path": "src/config/config.py", "line_number": 86, "rule_identifier": "AAK-SPLUNK-TOKLOG-001", "title": "Session token written to log sink in cleartext", "description": "An MCP server, agent, or tool logs a session token, JWT, or Bearer credential through a generic log sink (logger.info / .warn / .error, print) without redaction. CVE-2026-20205 (splunk-mcp-server < 1.0.3) shipped this exact pattern \u2014 session tokens ended up in the Splunk `_internal` index, readable by anyone with index-read. Any token written to a log sink is also a supply-chain risk: the log file, shipper, and SIEM are now in scope for the token's blast radius.", "remediation": "Redact token-shaped values before logging. Never interpolate a raw `Authorization`, `Bearer`, JWT, `splunkd_session`, or `st-` credential into a log message. Pin `splunk-mcp-server >= 1.0.3`." } ], "execution_duration_seconds": 30.498908307999955, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 134, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 1, "high": 17, "medium": 4, "critical": 0, "informational": 0 } }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 13.948422822999419, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 50.23953489300038, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 64, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 59.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/CONTRIBUTING.md", "line_number": 30, "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.", "remediation": null } ], "execution_duration_seconds": 50.00941608501307, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 22, "install_command": "pip install 'semgrep==1.97.0'", "severity_counts": { "low": 0, "high": 1, "medium": 0, "critical": 0, "informational": 0 } }, "display_score": 59.0, "display_badge": "Unsafe" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-68146", "title": "filelock: filelock: Time-of-Check-Time-of-Use (TOCTOU) race condition and symlink attack allows arbitrary file corruption or truncation", "description": "filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows lock file creation where filelock checks if a file exists before opening it with O_TRUNC. An attacker can create a symlink pointing to a victim file in the time gap between the check and open, causing os.open() to follow", "remediation": "Upgrade filelock from 3.18.0 to 3.20.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-22701", "title": "filelock: filelock Time-of-Check-Time-of-Use (TOCTOU) in SoftFileLock", "description": "filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission c", "remediation": "Upgrade filelock from 3.18.0 to 3.20.3 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-45409", "title": "python-idna: idna: Denial of Service via specially crafted long inputs", "description": "Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi", "remediation": "Upgrade idna from 3.10 to 3.15 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-30167", "title": "Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability", "description": "Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to recei", "remediation": "Upgrade jupyter-core from 5.7.2 to 5.8.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-66416", "title": "mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK", "description": "The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin po", "remediation": "Upgrade mcp from 1.10.1 to 1.23.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-52869", "title": "MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal", "description": "The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client", "remediation": "Upgrade mcp from 1.10.1 to 1.27.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-59950", "title": "MCP Python SDK: WebSocket server transport does not support Host/Origin validation", "description": "The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.", "remediation": "Upgrade mcp from 1.10.1 to 1.28.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-32597", "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)", "description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.", "remediation": "Upgrade pyjwt from 2.10.1 to 2.12.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48526", "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens", "description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.", "remediation": "Upgrade pyjwt from 2.10.1 to 2.13.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48522", "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient", "description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parame", "remediation": "Upgrade pyjwt from 2.10.1 to 2.13.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48523", "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access", "description": "PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, adv", "remediation": "Upgrade pyjwt from 2.10.1 to 2.13.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48525", "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens", "description": "PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option (\"b64\": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled \u201cwork amplifier\u201d: a", "remediation": "Upgrade pyjwt from 2.10.1 to 2.13.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48524", "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs", "description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint be", "remediation": "Upgrade pyjwt from 2.10.1 to 2.13.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-71176", "title": "pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handling", "description": "pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.", "remediation": "Upgrade pytest from 8.3.5 to 9.0.3 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-28684", "title": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following", "description": "python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.", "remediation": "Upgrade python-dotenv from 1.1.0 to 1.2.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-24486", "title": "python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.22 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-42561", "title": "python-multipart: python-multipart: Denial of Service via excessive multipart part headers", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request reje", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.27 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-53539", "title": "python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the ne", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.30 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-40347", "title": "python-multipart: Python-Multipart: Denial of Service via crafted multipart/form-data requests", "description": "Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.26 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-53537", "title": "multipart: Python-Multipart: Information disclosure via header parsing discrepancy", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset'lang'value, name*=..., and the filename*0/filename*1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 \u00a74.2 explicitly forbid", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.30 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-53538", "title": "python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form ", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.30 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-53540", "title": "python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.31 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2024-47081", "title": "requests: Requests vulnerable to .netrc credentials leak via malicious URLs", "description": "Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.", "remediation": "Upgrade requests from 2.32.3 to 2.32.4 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-25645", "title": "requests: Requests: Security bypass due to predictable temporary file creation", "description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulner", "remediation": "Upgrade requests from 2.32.3 to 2.33.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-62727", "title": "starlette: Starlette DoS via Range header merging", "description": "Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial\u2011of\u2011service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.", "remediation": "Upgrade starlette from 0.46.2 to 0.49.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48818", "title": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows", "description": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account\u2019s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas", "remediation": "Upgrade starlette from 0.46.2 to 1.1.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-54283", "title": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS", "description": "Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.", "remediation": "Upgrade starlette from 0.46.2 to 1.3.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-54121", "title": "starlette: Starlette denial-of-service", "description": "Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_me", "remediation": "Upgrade starlette from 0.46.2 to 0.47.2 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48710", "title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header", "description": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) ", "remediation": "Upgrade starlette from 0.46.2 to 1.0.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48817", "title": "starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods", "description": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo", "remediation": "Upgrade starlette from 0.46.2 to 1.1.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-54282", "title": "starlette: Starlette: Information disclosure due to improper HTTP request path validation", "description": "Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header ", "remediation": "Upgrade starlette from 0.46.2 to 1.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-66418", "title": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-66471", "title": "urllib3: urllib3 Streaming API improperly handles highly compressed data", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, b", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-21441", "title": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)", "description": "urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in ve", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.3 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-44431", "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers", "description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.7.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-50181", "title": "urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation", "description": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.5.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-50182", "title": "urllib3: urllib3 does not control redirects in browsers and Node.js", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodi", "remediation": "Upgrade urllib3 from 2.4.0 to 2.5.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-22702", "title": "virtualenv: virtualenv: Local attacker can redirect file operations via TOCTOU race condition", "description": "virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.", "remediation": "Upgrade virtualenv from 20.31.2 to 20.36.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-24049", "title": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking", "description": "wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of c", "remediation": "Upgrade wheel from 0.45.1 to 0.46.2 or later" } ], "execution_duration_seconds": 3.681514887997764, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "severity_counts": { "low": 5, "high": 17, "medium": 17, "critical": 0, "informational": 0 }, "manifests_scanned": [ "uv.lock" ] }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2132", "title": "PYSEC-2026-2132 \u2014 PyPI click@8.2.1", "description": "aliases: CVE-2026-7246, GHSA-47fr-3ffg-hgmw, PYSEC-2026-2132 | CVSS: 7.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1374", "title": "PYSEC-2026-1374 \u2014 PyPI filelock@3.18.0", "description": "aliases: CVE-2026-22701, GHSA-qmgc-5h2g-mvrw, PYSEC-2026-1374 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1375", "title": "PYSEC-2026-1375 \u2014 PyPI filelock@3.18.0", "description": "aliases: CVE-2025-68146, GHSA-w853-jp5j-5j7f, PYSEC-2026-1375 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-215", "title": "PYSEC-2026-215 \u2014 PyPI idna@3.10", "description": "aliases: CVE-2026-45409, GHSA-65pc-fj4g-8rjx, PYSEC-2026-215 | CVSS: 6.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1477", "title": "PYSEC-2026-1477 \u2014 PyPI jupyter-core@5.7.2", "description": "aliases: CVE-2025-30167, GHSA-33p9-3p43-82vq, PYSEC-2026-1477 | CVSS: 7.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1617", "title": "PYSEC-2026-1617 \u2014 PyPI mcp@1.10.1", "description": "aliases: CVE-2025-66416, GHSA-9h52-p55h-vw2f, PYSEC-2026-1617 | CVSS: 7.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "GHSA-jpw9-pfvf-9f58", "title": "GHSA-jpw9-pfvf-9f58 \u2014 PyPI mcp@1.10.1", "description": "aliases: CVE-2026-52869, GHSA-jpw9-pfvf-9f58 | CVSS: 7.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "GHSA-vj7q-gjh5-988w", "title": "GHSA-vj7q-gjh5-988w \u2014 PyPI mcp@1.10.1", "description": "aliases: CVE-2026-59950, GHSA-vj7q-gjh5-988w | CVSS: 7.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2025-183", "title": "PYSEC-2025-183 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2025-45768, PYSEC-2025-183 | CVSS: 7.0", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-120", "title": "PYSEC-2026-120 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2026-32597, GHSA-752w-5fwx-jx9f, PYSEC-2026-120 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-175", "title": "PYSEC-2026-175 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2026-48522, GHSA-993g-76c3-p5m4, PYSEC-2026-175 | CVSS: 4.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-176", "title": "PYSEC-2026-176 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2026-48523, GHSA-jq35-7prp-9v3f, PYSEC-2026-176 | CVSS: 5.4", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-177", "title": "PYSEC-2026-177 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2026-48524, GHSA-fhv5-28vv-h8m8, PYSEC-2026-177 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-178", "title": "PYSEC-2026-178 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2026-48525, GHSA-w7vc-732c-9m39, PYSEC-2026-178 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-179", "title": "PYSEC-2026-179 \u2014 PyPI pyjwt@2.10.1", "description": "aliases: CVE-2026-48526, GHSA-xgmm-8j9v-c9wx, PYSEC-2026-179 | CVSS: 7.4", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1845", "title": "PYSEC-2026-1845 \u2014 PyPI pytest@8.3.5", "description": "aliases: CVE-2025-71176, GHSA-6w46-j5rx-g56g, PYSEC-2026-1845 | CVSS: 6.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2270", "title": "PYSEC-2026-2270 \u2014 PyPI python-dotenv@1.1.0", "description": "aliases: CVE-2026-28684, GHSA-mf9w-mj56-hr94, PYSEC-2026-2270 | CVSS: 6.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1852", "title": "PYSEC-2026-1852 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-24486, GHSA-wp53-j4wj-2cfg, PYSEC-2026-1852 | CVSS: 8.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3036", "title": "PYSEC-2026-3036 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-53539, GHSA-5rvq-cxj2-64vf, PYSEC-2026-3036 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3037", "title": "PYSEC-2026-3037 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-53538, GHSA-6jv3-5f52-599m, PYSEC-2026-3037 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3038", "title": "PYSEC-2026-3038 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-40347, GHSA-mj87-hwqh-73pj, PYSEC-2026-3038 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3039", "title": "PYSEC-2026-3039 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-42561, GHSA-pp6c-gr5w-3c5g, PYSEC-2026-3039 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3040", "title": "PYSEC-2026-3040 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-53540, GHSA-v9pg-7xvm-68hf, PYSEC-2026-3040 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3041", "title": "PYSEC-2026-3041 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-53537, GHSA-vffw-93wf-4j4q, PYSEC-2026-3041 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1872", "title": "PYSEC-2026-1872 \u2014 PyPI requests@2.32.3", "description": "aliases: CVE-2024-47081, GHSA-9hjg-9r4m-mvj7, PYSEC-2026-1872 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2275", "title": "PYSEC-2026-2275 \u2014 PyPI requests@2.32.3", "description": "aliases: CVE-2026-25645, GHSA-gc5v-m9x4-r6x2, PYSEC-2026-2275 | CVSS: 5.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3447", "title": "PYSEC-2026-3447 \u2014 PyPI setuptools@80.9.0", "description": "aliases: BIT-setuptools-2026-59890, CVE-2026-59890, GHSA-h35f-9h28-mq5c, PYSEC-2026-3447 | CVSS: 6.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-161", "title": "PYSEC-2026-161 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48710, GHSA-86qp-5c8j-p5mr, PYSEC-2026-161, X41-2026-002 | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1941", "title": "PYSEC-2026-1941 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2025-54121, GHSA-2c2j-9gv5-cj73, PYSEC-2026-1941 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1942", "title": "PYSEC-2026-1942 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2025-62727, GHSA-7f5h-v6xp-fcq8, PYSEC-2026-1942 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2280", "title": "PYSEC-2026-2280 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48817, GHSA-x746-7m8f-x49c, PYSEC-2026-2280 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2281", "title": "PYSEC-2026-2281 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48818, GHSA-wqp7-x3pw-xc5r, PYSEC-2026-2281 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-248", "title": "PYSEC-2026-248 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-54282, GHSA-jp82-jpqv-5vv3, PYSEC-2026-248 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-249", "title": "PYSEC-2026-249 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-54283, GHSA-82w8-qh3p-5jfq, PYSEC-2026-249 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-141", "title": "PYSEC-2026-141 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2026-44431, GHSA-qccp-gfcp-xxvc, PYSEC-2026-141 | CVSS: 8.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1994", "title": "PYSEC-2026-1994 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-66471, GHSA-2xpw-w6gg-jr37, PYSEC-2026-1994 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1996", "title": "PYSEC-2026-1996 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2026-21441, GHSA-38jv-5279-wg99, PYSEC-2026-1996 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1997", "title": "PYSEC-2026-1997 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-50182, GHSA-48p4-8xcf-vxj5, PYSEC-2026-1997 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1998", "title": "PYSEC-2026-1998 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-66418, GHSA-gm62-xv2j-4w53, PYSEC-2026-1998 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1999", "title": "PYSEC-2026-1999 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-50181, GHSA-pq67-6m6q-mj2v, PYSEC-2026-1999 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2009", "title": "PYSEC-2026-2009 \u2014 PyPI virtualenv@20.31.2", "description": "aliases: BIT-virtualenv-2026-22702, CVE-2026-22702, GHSA-597g-3phw-6986, PYSEC-2026-2009 | CVSS: 4.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2047", "title": "PYSEC-2026-2047 \u2014 PyPI wheel@0.45.1", "description": "aliases: CVE-2026-24049, GHSA-8rrh-rw8j-w5fx, PYSEC-2026-2047 | CVSS: 7.1", "remediation": null } ], "execution_duration_seconds": 10.202634995002882, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "PyPI" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 4, "high": 19, "medium": 19, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/uv.lock" ], "finding_id_aliases": { "PYSEC-2025-183": [ "CVE-2025-45768" ], "PYSEC-2026-120": [ "CVE-2026-32597", "GHSA-752w-5fwx-jx9f" ], "PYSEC-2026-141": [ "CVE-2026-44431", "GHSA-qccp-gfcp-xxvc" ], "PYSEC-2026-161": [ "CVE-2026-48710", "GHSA-86qp-5c8j-p5mr", "X41-2026-002" ], "PYSEC-2026-175": [ "CVE-2026-48522", "GHSA-993g-76c3-p5m4" ], "PYSEC-2026-176": [ "CVE-2026-48523", "GHSA-jq35-7prp-9v3f" ], "PYSEC-2026-177": [ "CVE-2026-48524", "GHSA-fhv5-28vv-h8m8" ], "PYSEC-2026-178": [ "CVE-2026-48525", "GHSA-w7vc-732c-9m39" ], "PYSEC-2026-179": [ "CVE-2026-48526", "GHSA-xgmm-8j9v-c9wx" ], "PYSEC-2026-215": [ "CVE-2026-45409", "GHSA-65pc-fj4g-8rjx" ], "PYSEC-2026-248": [ "CVE-2026-54282", "GHSA-jp82-jpqv-5vv3" ], "PYSEC-2026-249": [ "CVE-2026-54283", "GHSA-82w8-qh3p-5jfq" ], "PYSEC-2026-1374": [ "CVE-2026-22701", "GHSA-qmgc-5h2g-mvrw" ], "PYSEC-2026-1375": [ "CVE-2025-68146", "GHSA-w853-jp5j-5j7f" ], "PYSEC-2026-1477": [ "CVE-2025-30167", "GHSA-33p9-3p43-82vq" ], "PYSEC-2026-1617": [ "CVE-2025-66416", "GHSA-9h52-p55h-vw2f" ], "PYSEC-2026-1845": [ "CVE-2025-71176", "GHSA-6w46-j5rx-g56g" ], "PYSEC-2026-1852": [ "CVE-2026-24486", "GHSA-wp53-j4wj-2cfg" ], "PYSEC-2026-1872": [ "CVE-2024-47081", "GHSA-9hjg-9r4m-mvj7" ], "PYSEC-2026-1941": [ "CVE-2025-54121", "GHSA-2c2j-9gv5-cj73" ], "PYSEC-2026-1942": [ "CVE-2025-62727", "GHSA-7f5h-v6xp-fcq8" ], "PYSEC-2026-1994": [ "CVE-2025-66471", "GHSA-2xpw-w6gg-jr37" ], "PYSEC-2026-1996": [ "CVE-2026-21441", "GHSA-38jv-5279-wg99" ], "PYSEC-2026-1997": [ "CVE-2025-50182", "GHSA-48p4-8xcf-vxj5" ], "PYSEC-2026-1998": [ "CVE-2025-66418", "GHSA-gm62-xv2j-4w53" ], "PYSEC-2026-1999": [ "CVE-2025-50181", "GHSA-pq67-6m6q-mj2v" ], "PYSEC-2026-2009": [ "BIT-virtualenv-2026-22702", "CVE-2026-22702", "GHSA-597g-3phw-6986" ], "PYSEC-2026-2047": [ "CVE-2026-24049", "GHSA-8rrh-rw8j-w5fx" ], "PYSEC-2026-2132": [ "CVE-2026-7246", "GHSA-47fr-3ffg-hgmw" ], "PYSEC-2026-2270": [ "CVE-2026-28684", "GHSA-mf9w-mj56-hr94" ], "PYSEC-2026-2275": [ "CVE-2026-25645", "GHSA-gc5v-m9x4-r6x2" ], "PYSEC-2026-2280": [ "CVE-2026-48817", "GHSA-x746-7m8f-x49c" ], "PYSEC-2026-2281": [ "CVE-2026-48818", "GHSA-wqp7-x3pw-xc5r" ], "PYSEC-2026-3036": [ "CVE-2026-53539", "GHSA-5rvq-cxj2-64vf" ], "PYSEC-2026-3037": [ "CVE-2026-53538", "GHSA-6jv3-5f52-599m" ], "PYSEC-2026-3038": [ "CVE-2026-40347", "GHSA-mj87-hwqh-73pj" ], "PYSEC-2026-3039": [ "CVE-2026-42561", "GHSA-pp6c-gr5w-3c5g" ], "PYSEC-2026-3040": [ "CVE-2026-53540", "GHSA-v9pg-7xvm-68hf" ], "PYSEC-2026-3041": [ "CVE-2026-53537", "GHSA-vffw-93wf-4j4q" ], "PYSEC-2026-3447": [ "BIT-setuptools-2026-59890", "CVE-2026-59890", "GHSA-h35f-9h28-mq5c" ], "GHSA-jpw9-pfvf-9f58": [ "CVE-2026-52869" ], "GHSA-vj7q-gjh5-988w": [ "CVE-2026-59950" ] }, "cross_scanner_correlation": { "only_osv": [ "PYSEC-2025-183", "PYSEC-2026-2132", "PYSEC-2026-3447" ], "only_trivy": [], "intersection_ids": [ "CVE-2024-47081", "CVE-2025-30167", "CVE-2025-50181", "CVE-2025-50182", "CVE-2025-54121", "CVE-2025-62727", "CVE-2025-66416", "CVE-2025-66418", "CVE-2025-66471", "CVE-2025-68146", "CVE-2025-71176", "CVE-2026-21441", "CVE-2026-22701", "CVE-2026-22702", "CVE-2026-24049", "CVE-2026-24486", "CVE-2026-25645", "CVE-2026-28684", "CVE-2026-32597", "CVE-2026-40347", "CVE-2026-42561", "CVE-2026-44431", "CVE-2026-45409", "CVE-2026-48522", "CVE-2026-48523", "CVE-2026-48524", "CVE-2026-48525", "CVE-2026-48526", "CVE-2026-48710", "CVE-2026-48817", "CVE-2026-48818", "CVE-2026-52869", "CVE-2026-53537", "CVE-2026-53538", "CVE-2026-53539", "CVE-2026-53540", "CVE-2026-54282", "CVE-2026-54283", "CVE-2026-59950" ] } }, "display_score": 0.0, "display_badge": "Unsafe" } ] }, "report": { "report_id": "392d50a8-847a-4a8e-bec7-3bf3475a5e3a", "format": "json", "generated_at": "2026-07-21T20:03:05.975636+00:00", "scanner_filter": null, "signature": null } }