`cves` command detects incorrect version (`0.0.0`) of a `devDependency` for a Node-based image

👋 Hello Docker Scout team!

We have just found interesting behaviour when using command: cves on a Node-based image. For devDependencies Scout determines the used versions of the packages as 0.0.0.

Of course this version is very low and a dependency is marked vulnerable to every vulnerability ever discovered in the package.

These dependencies are not actually present in the image.
This seems to only happen in github actions, not in CLI or docker desktop.
This seems to happen only when analyzing an image that has the sbom.

Example

We are using concurrently (npm) to run a couple of scripts in a local development environment. We are not using it in production.

package.json:

	...
	"scripts": {
		"dev": "concurrently --raw ...",
		...
	},
	"dependencies": {
	...
	},
	"devDependencies": {
		...
		"concurrently": "^8.2.2",
		...
	}

This means concurrently is showing up in our yarn.lock

concurrently@^8.2.2:
  version "8.2.2"
  resolved "https://registry.yarnpkg.com/concurrently/-/concurrently-8.2.2.tgz#353141985c198cfa5e4a3ef90082c336b5851784"
  integrity sha512-1dP4gpXFhei8IOtlXRE/T/4H88ElHgTiUzh71YUmtjTEHMSRS2Z/fgOxHSxxusGHogsRfxNq1vyAwxSC+EVyDg==
  dependencies:
    chalk "^4.1.2"
    date-fns "^2.30.0"
    lodash "^4.17.21"
    rxjs "^7.8.1"
    shell-quote "^1.8.1"
    spawn-command "0.0.2"
    supports-color "^8.1.1"
    tree-kill "^1.2.2"
    yargs "^17.7.2"

concurrently depends on shell-quote, which had two critical vulnerabilities in past

• critical 9.8: CVE-2016-10541, Affected range <1.6.1
• critical 9.8: CVE-2021-42740, Affected range <=1.7.2

In our case

• we actually don't have shell-quote in our final image, it's only a devDependency
• if we did, we specify shell-quote 1.8.1 where both vulnerabilities are fixed

SBOM?

Interestingly enough, this only happens with images that have been built with sbom: true (docker/build-push-action@v5). If the image does not have the sbom attached, these dependencies do not show up in the output (correct).

As a workaround I disabled SBOM generation in our build pipeline. This is not nice of course.
I remember reading somewhere that sbom generation differs between scout and buildkit, can this be related?

Happy to provide more info if needed. Please feel free to reach out!

Start by reproducing the cves command in GitHub Actions with an image built using docker/build-push-action@v5 and sbom: true, then compare it with CLI output and an image without an attached SBOM. Done means devDependency versions are not reported as 0.0.0 and dependencies absent from the final image are not incorrectly flagged.