DependencyTrack / DependencyTrack/dependency-track

audit vulnerabilities tab empty

Open
#6,136 8 comments 0 reactions 0 assignees View on GitHub
defect pending more information
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Certain projects show the "audit vulnerabilities" empty despite have thousands of impacted vulnerabilities.

This seems to happen when some components references a vulnerability with a very rich description like: GHSA-m7jm-9gc2-mpf2 or GHSA-v2v4-37r5-5v8g. Those vulnerabilities description has code samples with javascript / SQL and the api server fail to render a proper JSON parseable by the frontend.

When keeping an eye with F12/chrome looks like the JSON is being partially formed until the mentioned vulnerabilities are reached then the JSON is broken.

Navigating from the vulnerabilities browser also show severity, affected projects ... empty.

likely related: https://github.com/DependencyTrack/dependency-track/discussions/3229

[dummy_sbom.json](https://github.com/user-attachments/files/27753380/dummy_sbom.json)

### Steps to Reproduce

1. create a project and upload the provided BOM

### Expected Behavior

It should display the "audit vulnerabilities" section with all the information about the vulnerabilities.

### Dependency-Track Version

4.13.5

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.