Repository navigation
🚨 Security: Critical or high vulnerabilities in graphlit-mcp-server container #957
Description
Activity
Updated Scan Results
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
- Image:
ghcr.io/stacklok/dockyard/npx/graphlit-mcp-server:1.0.20260112001 - Critical vulnerabilities: 0
- High vulnerabilities: 5
Details
See the Security tab for full details.
High Vulnerabilities
- GHSA-2883-xcg3-v3hh in
js-yaml@4.3.1: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources - GHSA-5jgf-p345-68v8 in
fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references - GHSA-jqff-g426-hqxp in
fast-uri@3.1.5: fast-uri vulnerable to host confusion via percent-encoded scheme normalization - GHSA-f65p-4m7j-42xc in
fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization - GHSA-fph4-wmhf-6fwf in
fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
Automated security scan from periodic-security-scan workflow
- Image:
Updated Scan Results
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
- Image:
ghcr.io/stacklok/dockyard/npx/graphlit-mcp-server:1.0.20260112001 - Critical vulnerabilities: 0
- High vulnerabilities: 5
Details
See the Security tab for full details.
High Vulnerabilities
- GHSA-2883-xcg3-v3hh in
js-yaml@4.3.1: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources - GHSA-5jgf-p345-68v8 in
fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references - GHSA-jqff-g426-hqxp in
fast-uri@3.1.5: fast-uri vulnerable to host confusion via percent-encoded scheme normalization - GHSA-f65p-4m7j-42xc in
fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization - GHSA-fph4-wmhf-6fwf in
fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
Automated security scan from periodic-security-scan workflow
- Image:
Updated Scan Results
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
- Image:
ghcr.io/stacklok/dockyard/npx/graphlit-mcp-server:1.0.20260112001 - Critical vulnerabilities: 0
- High vulnerabilities: 5
Details
See the Security tab for full details.
High Vulnerabilities
- GHSA-2883-xcg3-v3hh in
js-yaml@4.3.1: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources - GHSA-5jgf-p345-68v8 in
fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references - GHSA-jqff-g426-hqxp in
fast-uri@3.1.5: fast-uri vulnerable to host confusion via percent-encoded scheme normalization - GHSA-f65p-4m7j-42xc in
fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization - GHSA-fph4-wmhf-6fwf in
fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
Automated security scan from periodic-security-scan workflow
- Image:
Updated Scan Results
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
- Image:
ghcr.io/stacklok/dockyard/npx/graphlit-mcp-server:1.0.20260112001 - Critical vulnerabilities: 0
- High vulnerabilities: 10
Details
See the Security tab for full details.
High Vulnerabilities
- GHSA-xjh9-v7x6-24jw in
@fastify/busboy@3.2.0: @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary - GHSA-2883-xcg3-v3hh in
js-yaml@4.3.1: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources - GHSA-x8mw-p69m-v3mx in
@fastify/busboy@3.2.0: @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header - GHSA-5jgf-p345-68v8 in
fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references - GHSA-6j4f-fj2g-mc7p in
brace-expansion@5.0.9: brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
... and 5 more. See Security tab for complete list.
Automated security scan from periodic-security-scan workflow
- Image:
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
ghcr.io/stacklok/dockyard/npx/graphlit-mcp-server:1.0.20260112001Details
See the Security tab for full details.
High Vulnerabilities
fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative referencesfast-uri@3.1.5: fast-uri vulnerable to host confusion via percent-encoded scheme normalizationfast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizationfast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingAutomated security scan from periodic-security-scan workflow