deckhouse / deckhouse/modules-gitlab-ci
CVE scan job does not scan source files
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 3
- Forks
- 1
- Avg merge
- 13m
- Merged PRs (30d)
- 38
Description
For example, frontend image scan report does not show any vulnerabilities, but there are high and medium vulnerabilities in package dependencies.
trivy image scan:
----------------------------------------------
πΎ Image: frontend
Scanning commander::frontend
Done
Uploading trivy CVE report for image frontend of commander module
trivy filesystem scan:
images/frontend/package-lock.json (npm)
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 1, CRITICAL: 0)
ββββββββββββ¬βββββββββββββββββ¬βββββββββββ¬βββββββββ¬ββββββββββββββββββββ¬βββββββββββββββββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β Library β Vulnerability β Severity β Status β Installed Version β Fixed Version β Title β
ββββββββββββΌβββββββββββββββββΌβββββββββββΌβββββββββΌββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β vite β CVE-2025-30208 β MEDIUM β fixed β 6.2.0 β 6.2.3, 6.1.2, 6.0.12, 5.4.15, 4.5.10 β vite: Vite bypasses server.fs.deny when using `?raw??` β
β β β β β β β https://avd.aquasec.com/nvd/cve-2025-30208 β
β ββββββββββββββββββ€ β β ββββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β β CVE-2025-31125 β β β β 6.2.4, 6.1.3, 6.0.13, 5.4.16, 4.5.11 β vite: Vite has a `server.fs.deny` bypassed for `inline` and β
β β β β β β β `raw` with `?import`... β
β β β β β β β https://avd.aquasec.com/nvd/cve-2025-31125 β
β ββββββββββββββββββ€ β β ββββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β β CVE-2025-31486 β β β β 6.2.5, 6.1.4, 6.0.14, 5.4.17, 4.5.12 β vite: Vite allows server.fs.deny to be bypassed with .svg or β
β β β β β β β relative paths... β
β β β β β β β https://avd.aquasec.com/nvd/cve-2025-31486 β
ββββββββββββΌβββββββββββββββββΌβββββββββββ€ βββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€
β vue-i18n β CVE-2025-27597 β HIGH β β 9.14.2 β 9.14.3, 10.0.6, 11.1.2 β Vue I18n Allows Prototype Pollution in `handleFlatJson` β
β β β β β β β https://avd.aquasec.com/nvd/cve-2025-27597 β
ββββββββββββ΄βββββββββββββββββ΄βββββββββββ΄βββββββββ΄ββββββββββββββββββββ΄βββββββββββββββββββββββββββββββββββββββ΄βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up β it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the CVE scan job that runs the Trivy image scan and compare it with the filesystem scan output for images/frontend/package-lock.json. Check how the frontend report is generated and uploaded; done means the report includes the dependency vulnerabilities shown by the filesystem scan.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gitlab, javascript
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100