Repository navigation
🚨 Security: Critical or high vulnerabilities in blender-mcp container #985
Description
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
- Image:
ghcr.io/stacklok/dockyard/uvx/blender-mcp:1.5.6 - Critical vulnerabilities: 0
- High vulnerabilities: 1
Details
See the Security tab for full details.
High Vulnerabilities
- GHSA-8xx6-hgc6-gc2m in
httpx2@2.10.0: HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
Automated security scan from periodic-security-scan workflow
Activity
github-actions commentedon Sep 21, 2026
Updated Scan Results
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
ghcr.io/stacklok/dockyard/uvx/blender-mcp:1.5.6Details
See the Security tab for full details.
High Vulnerabilities
httpx2@2.10.0: HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)Automated security scan from periodic-security-scan workflow
github-actions commentedon Sep 28, 2026
Updated Scan Results
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
ghcr.io/stacklok/dockyard/uvx/blender-mcp:1.5.6Details
See the Security tab for full details.
High Vulnerabilities
httpx2@2.10.0: HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)Automated security scan from periodic-security-scan workflow
github-actions commentedon Oct 5, 2026
Updated Scan Results
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
ghcr.io/stacklok/dockyard/uvx/blender-mcp:1.5.6Details
See the Security tab for full details.
Critical Vulnerabilities
pyjwt@2.13.0: PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardHigh Vulnerabilities
httpx2@2.10.0: HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)pyjwt@2.13.0: PyJWT BOM Bypasspyjwt@2.13.0: PyJWT accepts public JWK containers as HMAC secretspyjwt@2.13.0: PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validationpyjwt@2.13.0: PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard... and 1 more. See Security tab for complete list.
Automated security scan from periodic-security-scan workflow
github-actions commentedon Oct 12, 2026
The periodic scan of
ghcr.io/stacklok/dockyard/uvx/blender-mcp:2.1.9found no fixable critical or high vulnerabilities, so this issue is being closed. It will be reopened as a new issue if findings return.