DependencyTrack / DependencyTrack/dependency-track
audit vulnerabilities tab empty
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Certain projects show the "audit vulnerabilities" empty despite have thousands of impacted vulnerabilities.
This seems to happen when some components references a vulnerability with a very rich description like: GHSA-m7jm-9gc2-mpf2 or GHSA-v2v4-37r5-5v8g. Those vulnerabilities description has code samples with javascript / SQL and the api server fail to render a proper JSON parseable by the frontend.
When keeping an eye with F12/chrome looks like the JSON is being partially formed until the mentioned vulnerabilities are reached then the JSON is broken.
Navigating from the vulnerabilities browser also show severity, affected projects ... empty.
likely related: https://github.com/DependencyTrack/dependency-track/discussions/3229
[dummy_sbom.json](https://github.com/user-attachments/files/27753380/dummy_sbom.json)
### Steps to Reproduce
1. create a project and upload the provided BOM
### Expected Behavior
It should display the "audit vulnerabilities" section with all the information about the vulnerabilities.
### Dependency-Track Version
4.13.5
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
Google Chrome
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.