🔒 ASH Security Scan - Monthly Report (2026-05-01)

# ASH Security Scan - Full Repository Report

**Scan Date:** 2026-05-01T03:17:15+00:00
**Trigger:** schedule
**Type:** Monthly scheduled scan

## Scanner Results Summary

| Scanner | S | C | H | M | L | I | Time | Action | Result | Thresh |
|---------|---|---|---|---|---|---|------|--------|--------|--------|
| bandit | 0 | 1 | 0 | 0 | 6 | 0 | 1.1s | 1 | FAILED | MED (g) |
| cdk-nag | 0 | 0 | 0 | 0 | 0 | 0 | 59.2s | 0 | PASSED | MED (g) |
| cfn-nag | 0 | 0 | 0 | 0 | 0 | 0 | 18.5s | 0 | PASSED | MED (g) |
| checkov | 0 | 5 | 0 | 0 | 0 | 0 | 13.7s | 5 | FAILED | MED (g) |
| detect-secr… | 0 | 1 | 0 | 0 | 0 | 0 | 14.6s | 1 | FAILED | MED (g) |
| grype | 0 | 16 | 0 | 22 | 3 | 0 | 52.5s | 38 | FAILED | MED (g) |
| npm-audit | 0 | 0 | 0 | 0 | 0 | 0 | 5.6s | 0 | PASSED | MED (g) |
| opengrep | 12 | 15 | 0 | 0 | 0 | 0 | 41.6s | 15 | FAILED | MED (g) |
| semgrep | 0 | 0 | 0 | 0 | 0 | 0 | <1ms | 0 | MISSING | MED (g) |
| syft | 0 | 0 | 0 | 0 | 0 | 0 | 3.6s | 0 | PASSED | MED (g) |

**Status:** ⚠️ Security findings detected

## Detailed Findings

Detailed Findings

Show 60 actionable findings

### Finding 1: B310

- **Severity**: HIGH
- **Scanner**: bandit
- **Rule ID**: B310
- **Location**: samples/llm-council/infra-cdk/lambdas/zip-packager/index.py:62-64

**Description**:
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.

**Code Snippet**:
```
)
urllib.request.urlopen(req)
```

---

### Finding 2: CKV_DOCKER_2

- **Severity**: HIGH
- **Scanner**: checkov
- **Rule ID**: CKV_DOCKER_2
- **Location**: samples/copilotkit-generative-ui/docker/Dockerfile.bridge.dev:1-7

**Description**:
Ensure that HEALTHCHECK instructions have been added to container images

**Code Snippet**:
```
FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
CMD ["node", "dist/server.js"]
```

---

### Finding 3: CKV_DOCKER_3

- **Severity**: HIGH
- **Scanner**: checkov
- **Rule ID**: CKV_DOCKER_3
- **Location**: samples/copilotkit-generative-ui/docker/Dockerfile.bridge.dev:1-7

**Description**:
Ensure that a user for the container has been created

**Code Snippet**:
```
FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
CMD ["node", "dist/server.js"]
```

---

### Finding 4: CKV_DOCKER_2

- **Severity**: HIGH
- **Scanner**: checkov
- **Rule ID**: CKV_DOCKER_2
- **Location**: samples/copilotkit-generative-ui/docker/Dockerfile.frontend.dev:1-21

**Description**:
Ensure that HEALTHCHECK instructions have been added to container images

**Code Snippet**:
```
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0

FROM node:20-alpine

WORKDIR /app

# Copy package files
COPY package*.json ./

# Install dependencies
RUN npm install

# Copy source code
COPY . .

# Expose port
EXPOSE 3000

# Start development server (--host exposes to Docker network)
CMD ["npm", "run", "dev", "--", "--host"]
```

---

### Finding 5: CKV_DOCKER_3

- **Severity**: HIGH
- **Scanner**: checkov
- **Rule ID**: CKV_DOCKER_3
- **Location**: samples/copilotkit-generative-ui/docker/Dockerfile.frontend.dev:1-21

**Description**:
Ensure that a user for the container has been created

**Code Snippet**:
```
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0

FROM node:20-alpine

WORKDIR /app

# Copy package files
COPY package*.json ./

# Install dependencies
RUN npm install

# Copy source code
COPY . .

# Expose port
EXPOSE 3000

# Start development server (--host exposes to Docker network)
CMD ["npm", "run", "dev", "--", "--host"]
```

---

### Finding 6: CKV_DOCKER_2

- **Severity**: HIGH
- **Scanner**: checkov
- **Rule ID**: CKV_DOCKER_2
- **Location**: samples/llm-council/patterns/llm-council-agent/Dockerfile:1-22

**Description**:
Ensure that HEALTHCHECK instructions have been added to container images

**Code Snippet**:
```
FROM public.ecr.aws/docker/library/python:3.13-slim

WORKDIR /app

# Copy and install agent-specific requirements
COPY patterns/llm-council-agent/requirements.txt requirements.txt
RUN pip install --no-cache-dir -r requirements.txt

# Copy shared utilities
COPY gateway/ gateway/
COPY tools/ tools/

# Copy the agent code as a package
COPY patterns/llm-council-agent/ llm_council_agent/

# Create non-root user
RUN useradd -m -u 1000 bedrock_agentcore
USER bedrock_agentcore

EXPOSE 8080

CMD ["python", "-m", "llm_council_agent.council_agent"]
```

---

### Finding 7: SECRET-HEX-HIGH-ENTROPY-STRING

- **Severity**: HIGH
- **Scanner**: detect-secrets
- **Rule ID**: SECRET-HEX-HIGH-ENTROPY-STRING
- **Location**: ash-output.log:1531

**Description**:
Secret of type 'Hex High Entropy String' detected in file 'ash-output.log' at line 1531

**Code Snippet**:
```
Secret of type Hex High Entropy String detected
```

---

### Finding 8: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode
- **Location**: samples/copilotkit-generative-ui/agents/utils/auth.py:62

**Description**:
Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified.

**Code Snippet**:
```
options={"verify_signature": False},
```

---

### Finding 9: javascript.lang.security.detect-child-process.detect-child-process

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: javascript.lang.security.detect-child-process.detect-child-process
- **Location**: samples/copilotkit-generative-ui/infra-cdk/lib/backend-stack.ts:396

**Description**:
Detected calls to child_process from a function argument `outputDir`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.

**Code Snippet**:
```
`cp -R dist node_modules package.json package-lock.json ${outputDir}/`,
```

---

### Finding 10: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
- **Location**: samples/copilotkit-generative-ui/infra-cdk/lib/utils/config-manager.ts:50

**Description**:
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

**Code Snippet**:
```
const configPath = path.join(__dirname, "..", "..", "..", configFile);
```

---

### Finding 11: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop
- **Location**: samples/copilotkit-generative-ui/infra-cdk/lib/utils/config-manager.ts:135

**Description**:
Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object.

**Code Snippet**:
```
value = value[k];
```

---

### Finding 12: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected
- **Location**: samples/llm-council/infra-cdk/lambdas/zip-packager/index.py:63

**Description**:
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.

**Code Snippet**:
```
urllib.request.urlopen(req)
```

---

### Finding 13: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
- **Location**: samples/llm-council/infra-cdk/lib/backend-stack.ts:124

**Description**:
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

**Code Snippet**:
```
const patternDir = path.join(repoRoot, "patterns", pattern)
```

---

### Finding 14: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
- **Location**: samples/llm-council/infra-cdk/lib/backend-stack.ts:152

**Description**:
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

**Code Snippet**:
```
const content = fs.readFileSync(path.join(patternDir, file))
```

---

### Finding 15: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
- **Location**: samples/llm-council/infra-cdk/lib/backend-stack.ts:152

**Description**:
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

**Code Snippet**:
```
const content = fs.readFileSync(path.join(patternDir, file))
```

---

### Finding 16: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
- **Location**: samples/llm-council/infra-cdk/lib/backend-stack.ts:166

**Description**:
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

**Code Snippet**:
```
const requirementsPath = path.join(patternDir, "requirements.txt")
```

---

### Finding 17: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
- **Location**: samples/llm-council/infra-cdk/lib/backend-stack.ts:796

**Description**:
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

**Code Snippet**:
```
const fullPath = path.join(dirPath, entry.name)
```

---

### Finding 18: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
- **Location**: samples/llm-council/infra-cdk/lib/backend-stack.ts:796

**Description**:
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

**Code Snippet**:
```
const fullPath = path.join(dirPath, entry.name)
```

---

### Finding 19: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
- **Location**: samples/llm-council/infra-cdk/lib/backend-stack.ts:797

**Description**:
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

**Code Snippet**:
```
const relativePath = path.join(prefix, entry.name)
```

---

### Finding 20: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
- **Location**: samples/llm-council/infra-cdk/lib/backend-stack.ts:797

**Description**:
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

**Code Snippet**:
```
const relativePath = path.join(prefix, entry.name)
```

---

### Finding 21: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
- **Location**: samples/llm-council/infra-cdk/lib/utils/config-manager.ts:32

**Description**:
Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

**Code Snippet**:
```
const configPath = path.join(__dirname, "..", "..", configFile)
```

---

### Finding 22: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop

- **Severity**: HIGH
- **Scanner**: opengrep
- **Rule ID**: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop
- **Location**: samples/llm-council/infra-cdk/lib/utils/config-manager.ts:82

**Description**:
Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object.

**Code Snippet**:
```
value = value[k]
```

---

### Finding 23: GHSA-mrrh-fwg8-r2c3-tj-actions/changed-files

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-mrrh-fwg8-r2c3-tj-actions/changed-files
- **Location**: .github/workflows/python-lint.yml:1

**Description**:
A high vulnerability in github-action package: tj-actions/changed-files, version ed68ef82c095e0d48ec87eccea555d944a631a4c was found at: /.github/workflows/python-lint.yml

---

### Finding 24: GHSA-mrrh-fwg8-r2c3-tj-actions/changed-files

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-mrrh-fwg8-r2c3-tj-actions/changed-files
- **Location**: .github/workflows/js-lint.yml:1

**Description**:
A high vulnerability in github-action package: tj-actions/changed-files, version ed68ef82c095e0d48ec87eccea555d944a631a4c was found at: /.github/workflows/js-lint.yml

---

### Finding 25: GHSA-mcph-m25j-8j63-tj-actions/changed-files

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-mcph-m25j-8j63-tj-actions/changed-files
- **Location**: .github/workflows/python-lint.yml:1

**Description**:
A high vulnerability in github-action package: tj-actions/changed-files, version ed68ef82c095e0d48ec87eccea555d944a631a4c was found at: /.github/workflows/python-lint.yml

---

### Finding 26: GHSA-mcph-m25j-8j63-tj-actions/changed-files

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-mcph-m25j-8j63-tj-actions/changed-files
- **Location**: .github/workflows/js-lint.yml:1

**Description**:
A high vulnerability in github-action package: tj-actions/changed-files, version ed68ef82c095e0d48ec87eccea555d944a631a4c was found at: /.github/workflows/js-lint.yml

---

### Finding 27: GHSA-x7hr-w5r2-h6wg-prismjs

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-x7hr-w5r2-h6wg-prismjs
- **Location**: samples/copilotkit-generative-ui/frontend/package-lock.json:1

**Description**:
A medium vulnerability in npm package: prismjs, version 1.27.0 was found at: /samples/copilotkit-generative-ui/frontend/package-lock.json

---

### Finding 28: GHSA-37qj-frw5-hhjh-fast-xml-parser

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-37qj-frw5-hhjh-fast-xml-parser
- **Location**: samples/llm-council/infra-cdk/package-lock.json:1

**Description**:
A high vulnerability in npm package: fast-xml-parser, version 5.2.5 was found at: /samples/llm-council/infra-cdk/package-lock.json

---

### Finding 29: GHSA-j3q9-mxjg-w52f-path-to-regexp

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-j3q9-mxjg-w52f-path-to-regexp
- **Location**: samples/copilotkit-generative-ui/infra-cdk/lambdas/copilotkit-runtime/package-lock.json:1

**Description**:
A high vulnerability in npm package: path-to-regexp, version 8.3.0 was found at: /samples/copilotkit-generative-ui/infra-cdk/lambdas/copilotkit-runtime/package-lock.json

---

### Finding 30: GHSA-37ch-88jc-xwx2-path-to-regexp

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-37ch-88jc-xwx2-path-to-regexp
- **Location**: samples/copilotkit-generative-ui/infra-cdk/lambdas/copilotkit-runtime/package-lock.json:1

**Description**:
A high vulnerability in npm package: path-to-regexp, version 0.1.12 was found at: /samples/copilotkit-generative-ui/infra-cdk/lambdas/copilotkit-runtime/package-lock.json

---

### Finding 31: GHSA-r5fr-rjxr-66jc-lodash

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-r5fr-rjxr-66jc-lodash
- **Location**: samples/llm-council/frontend/package-lock.json:1

**Description**:
A high vulnerability in npm package: lodash, version 4.17.23 was found at: /samples/llm-council/frontend/package-lock.json

---

### Finding 32: GHSA-27v5-c462-wpq7-path-to-regexp

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-27v5-c462-wpq7-path-to-regexp
- **Location**: samples/copilotkit-generative-ui/infra-cdk/lambdas/copilotkit-runtime/package-lock.json:1

**Description**:
A medium vulnerability in npm package: path-to-regexp, version 8.3.0 was found at: /samples/copilotkit-generative-ui/infra-cdk/lambdas/copilotkit-runtime/package-lock.json

---

### Finding 33: GHSA-jmr7-xgp7-cmfj-fast-xml-parser

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-jmr7-xgp7-cmfj-fast-xml-parser
- **Location**: samples/llm-council/infra-cdk/package-lock.json:1

**Description**:
A high vulnerability in npm package: fast-xml-parser, version 5.2.5 was found at: /samples/llm-council/infra-cdk/package-lock.json

---

### Finding 34: GHSA-jmr7-xgp7-cmfj-fast-xml-parser

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-jmr7-xgp7-cmfj-fast-xml-parser
- **Location**: samples/llm-council/frontend/package-lock.json:1

**Description**:
A high vulnerability in npm package: fast-xml-parser, version 5.3.4 was found at: /samples/llm-council/frontend/package-lock.json

---

### Finding 35: GHSA-jmr7-xgp7-cmfj-fast-xml-parser

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-jmr7-xgp7-cmfj-fast-xml-parser
- **Location**: samples/llm-council/frontend/package-lock.json:1

**Description**:
A high vulnerability in npm package: fast-xml-parser, version 5.3.5 was found at: /samples/llm-council/frontend/package-lock.json

---

### Finding 36: GHSA-jp2q-39xq-3w4g-fast-xml-parser

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-jp2q-39xq-3w4g-fast-xml-parser
- **Location**: samples/llm-council/infra-cdk/package-lock.json:1

**Description**:
A medium vulnerability in npm package: fast-xml-parser, version 5.2.5 was found at: /samples/llm-council/infra-cdk/package-lock.json

---

### Finding 37: GHSA-jp2q-39xq-3w4g-fast-xml-parser

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-jp2q-39xq-3w4g-fast-xml-parser
- **Location**: samples/llm-council/frontend/package-lock.json:1

**Description**:
A medium vulnerability in npm package: fast-xml-parser, version 5.3.4 was found at: /samples/llm-council/frontend/package-lock.json

---

### Finding 38: GHSA-jp2q-39xq-3w4g-fast-xml-parser

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-jp2q-39xq-3w4g-fast-xml-parser
- **Location**: samples/llm-council/frontend/package-lock.json:1

**Description**:
A medium vulnerability in npm package: fast-xml-parser, version 5.3.5 was found at: /samples/llm-council/frontend/package-lock.json

---

### Finding 39: GHSA-m7jm-9gc2-mpf2-fast-xml-parser

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-m7jm-9gc2-mpf2-fast-xml-parser
- **Location**: samples/llm-council/infra-cdk/package-lock.json:1

**Description**:
A critical vulnerability in npm package: fast-xml-parser, version 5.2.5 was found at: /samples/llm-council/infra-cdk/package-lock.json

---

### Finding 40: GHSA-m7jm-9gc2-mpf2-fast-xml-parser

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-m7jm-9gc2-mpf2-fast-xml-parser
- **Location**: samples/llm-council/frontend/package-lock.json:1

**Description**:
A critical vulnerability in npm package: fast-xml-parser, version 5.3.4 was found at: /samples/llm-council/frontend/package-lock.json

---

### Finding 41: GHSA-8gc5-j5rx-235r-fast-xml-parser

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-8gc5-j5rx-235r-fast-xml-parser
- **Location**: samples/llm-council/infra-cdk/package-lock.json:1

**Description**:
A high vulnerability in npm package: fast-xml-parser, version 5.2.5 was found at: /samples/llm-council/infra-cdk/package-lock.json

---

### Finding 42: GHSA-8gc5-j5rx-235r-fast-xml-parser

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-8gc5-j5rx-235r-fast-xml-parser
- **Location**: samples/llm-council/frontend/package-lock.json:1

**Description**:
A high vulnerability in npm package: fast-xml-parser, version 5.3.4 was found at: /samples/llm-council/frontend/package-lock.json

---

### Finding 43: GHSA-8gc5-j5rx-235r-fast-xml-parser

- **Severity**: HIGH
- **Scanner**: grype
- **Rule ID**: GHSA-8gc5-j5rx-235r-fast-xml-parser
- **Location**: samples/llm-council/frontend/package-lock.json:1

**Description**:
A high vulnerability in npm package: fast-xml-parser, version 5.3.5 was found at: /samples/llm-council/frontend/package-lock.json

---

### Finding 44: GHSA-f886-m6hf-6m8v-brace-expansion

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-f886-m6hf-6m8v-brace-expansion
- **Location**: samples/copilotkit-generative-ui/infra-cdk/package-lock.json:1

**Description**:
A medium vulnerability in npm package: brace-expansion, version 5.0.3 was found at: /samples/copilotkit-generative-ui/infra-cdk/package-lock.json

---

### Finding 45: GHSA-f23m-r3pf-42rh-lodash

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-f23m-r3pf-42rh-lodash
- **Location**: samples/llm-council/frontend/package-lock.json:1

**Description**:
A medium vulnerability in npm package: lodash, version 4.17.23 was found at: /samples/llm-council/frontend/package-lock.json

---

### Finding 46: GHSA-gh4j-gqv2-49f6-fast-xml-parser

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-gh4j-gqv2-49f6-fast-xml-parser
- **Location**: samples/llm-council/infra-cdk/package-lock.json:1

**Description**:
A medium vulnerability in npm package: fast-xml-parser, version 5.2.5 was found at: /samples/llm-council/infra-cdk/package-lock.json

---

### Finding 47: GHSA-gh4j-gqv2-49f6-fast-xml-parser

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-gh4j-gqv2-49f6-fast-xml-parser
- **Location**: samples/llm-council/frontend/package-lock.json:1

**Description**:
A medium vulnerability in npm package: fast-xml-parser, version 5.3.4 was found at: /samples/llm-council/frontend/package-lock.json

---

### Finding 48: GHSA-gh4j-gqv2-49f6-fast-xml-parser

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-gh4j-gqv2-49f6-fast-xml-parser
- **Location**: samples/llm-council/frontend/package-lock.json:1

**Description**:
A medium vulnerability in npm package: fast-xml-parser, version 5.3.5 was found at: /samples/llm-council/frontend/package-lock.json

---

### Finding 49: GHSA-gh4j-gqv2-49f6-fast-xml-parser

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-gh4j-gqv2-49f6-fast-xml-parser
- **Location**: samples/copilotkit-generative-ui/frontend/package-lock.json:1

**Description**:
A medium vulnerability in npm package: fast-xml-parser, version 5.5.8 was found at: /samples/copilotkit-generative-ui/frontend/package-lock.json

---

### Finding 50: GHSA-gh4j-gqv2-49f6-fast-xml-parser

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-gh4j-gqv2-49f6-fast-xml-parser
- **Location**: samples/copilotkit-generative-ui/infra-cdk/package-lock.json:1

**Description**:
A medium vulnerability in npm package: fast-xml-parser, version 5.5.8 was found at: /samples/copilotkit-generative-ui/infra-cdk/package-lock.json

---

### Finding 51: GHSA-gh4j-gqv2-49f6-fast-xml-parser

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-gh4j-gqv2-49f6-fast-xml-parser
- **Location**: samples/restaurant-assistant/infra-cdk/package-lock.json:1

**Description**:
A medium vulnerability in npm package: fast-xml-parser, version 5.5.9 was found at: /samples/restaurant-assistant/infra-cdk/package-lock.json

---

### Finding 52: GHSA-gh4j-gqv2-49f6-fast-xml-parser

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-gh4j-gqv2-49f6-fast-xml-parser
- **Location**: samples/copilotkit-generative-ui/frontend/package-lock.json:1

**Description**:
A medium vulnerability in npm package: fast-xml-parser, version 5.5.9 was found at: /samples/copilotkit-generative-ui/frontend/package-lock.json

---

### Finding 53: GHSA-gh4j-gqv2-49f6-fast-xml-parser

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-gh4j-gqv2-49f6-fast-xml-parser
- **Location**: samples/restaurant-assistant/frontend/package-lock.json:1

**Description**:
A medium vulnerability in npm package: fast-xml-parser, version 5.5.9 was found at: /samples/restaurant-assistant/frontend/package-lock.json

---

### Finding 54: GHSA-w5hq-g745-h8pq-uuid

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-w5hq-g745-h8pq-uuid
- **Location**: samples/copilotkit-generative-ui/frontend/package-lock.json:1

**Description**:
A medium vulnerability in npm package: uuid, version 10.0.0 was found at: /samples/copilotkit-generative-ui/frontend/package-lock.json

---

### Finding 55: GHSA-w5hq-g745-h8pq-uuid

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-w5hq-g745-h8pq-uuid
- **Location**: samples/copilotkit-generative-ui/infra-cdk/lambdas/copilotkit-runtime/package-lock.json:1

**Description**:
A medium vulnerability in npm package: uuid, version 10.0.0 was found at: /samples/copilotkit-generative-ui/infra-cdk/lambdas/copilotkit-runtime/package-lock.json

---

### Finding 56: GHSA-w5hq-g745-h8pq-uuid

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-w5hq-g745-h8pq-uuid
- **Location**: samples/copilotkit-generative-ui/frontend/package-lock.json:1

**Description**:
A medium vulnerability in npm package: uuid, version 11.1.0 was found at: /samples/copilotkit-generative-ui/frontend/package-lock.json

---

### Finding 57: GHSA-w5hq-g745-h8pq-uuid

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-w5hq-g745-h8pq-uuid
- **Location**: samples/copilotkit-generative-ui/infra-cdk/lambdas/copilotkit-runtime/package-lock.json:1

**Description**:
A medium vulnerability in npm package: uuid, version 11.1.0 was found at: /samples/copilotkit-generative-ui/infra-cdk/lambdas/copilotkit-runtime/package-lock.json

---

### Finding 58: GHSA-w5hq-g745-h8pq-uuid

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-w5hq-g745-h8pq-uuid
- **Location**: samples/llm-council/frontend/package-lock.json:1

**Description**:
A medium vulnerability in npm package: uuid, version 11.1.0 was found at: /samples/llm-council/frontend/package-lock.json

---

### Finding 59: GHSA-w5hq-g745-h8pq-uuid

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-w5hq-g745-h8pq-uuid
- **Location**: samples/restaurant-assistant/frontend/package-lock.json:1

**Description**:
A medium vulnerability in npm package: uuid, version 11.1.0 was found at: /samples/restaurant-assistant/frontend/package-lock.json

---

### Finding 60: GHSA-w5hq-g745-h8pq-uuid

- **Severity**: MEDIUM
- **Scanner**: grype
- **Rule ID**: GHSA-w5hq-g745-h8pq-uuid
- **Location**: samples/copilotkit-generative-ui/infra-cdk/lambdas/copilotkit-runtime/package-lock.json:1

**Description**:
A medium vulnerability in npm package: uuid, version 13.0.0 was found at: /samples/copilotkit-generative-ui/infra-cdk/lambdas/copilotkit-runtime/package-lock.json

---

*Report generated by [Automated Security Helper (ASH)](https://github.com/awslabs/automated-security-helper) at 2026-05-01T03:17:08+00:00*

---
*This issue was automatically created by the monthly security scan workflow.*