[container-image-scan] Container findings for ghcr.io/github/serena-mcp-server

### Overview

`ghcr.io/github/serena-mcp-server:sha-891c160@sha256:` (Debian 13 "trixie" based image) — by far the highest-risk scanned image: 65 Critical (30 unique CVE/GHSA IDs), 395 High (207 unique CVE/GHSA IDs), and 514 license policy violations. Base OS + bundled Node.js/npm/Python stack are all significantly out of date relative to upstream security releases.

### Key Metrics

| Severity | Findings | Unique IDs |
|---|---|---|
| Critical | 65 | 30 |
| High | 395 | 207 |
| Medium/Low/Unknown | 0 | 0 |
| License violations | 514 | — |

Critical vulnerabilities — 30 unique CVE/GHSA IDs

| CVE/GHSA | Representative package(s) | Installed | Fixed |
|---|---|---|---|
| CVE-2026-5450 | libc-bin, libc6 | 2.41-12+deb13u1 | not yet available |
| CVE-2026-8376 / CVE-2026-13221 / CVE-2026-42496 / CVE-2026-12087 / CVE-2026-57433 | perl, perl-base, perl-modules-5.40, libperl5.40 | 5.40.1-6 | not yet available |
| CVE-2026-34182 / CVE-2026-31789 | openssl, openssl-provider-legacy, libssl3t64, libssl-dev | 3.5.4-1~deb13u2 | 3.5.5/3.5.6-1~deb13u2 |
| CVE-2026-11856 / CVE-2026-9079 / CVE-2026-8924 / CVE-2026-8927 / CVE-2026-8926 / CVE-2026-10536 | libcurl3t64-gnutls | 8.14.1-2+deb13u2 | not yet available |
| CVE-2026-42010 / CVE-2026-33845 | libgnutls30t64 | 3.8.9-3+deb13u1 | 3.8.9-3+deb13u4 |
| CVE-2026-7598 | libssh2-1t64 | 1.11.1-1 | 1.11.1-1+deb13u1 |
| CVE-2025-55130 / CVE-2026-48930 | nodejs, libnode-dev, libnode115 | 20.19.2+dfsg-1 | 20.19.2+dfsg-1+deb13u1 (for CVE-2025-55130) |
| CVE-2025-68121 / CVE-2026-27143 | golang-1.24-go, golang-1.24-src | 1.24.4-1 | not yet available (Debian package) |
| GO-2026-4337 | stdlib | go1.24.4 | 1.24.13, 1.25.7, 1.26.0-rc.3 |
| CVE-2026-4800 | node-lodash, node-lodash-packages | 4.17.21 (bundled) | not yet available |
| CVE-2026-33937 | handlebars | 3:4.7.7+~4.1.0-1 | not yet available |
| GHSA-2w6w-674q-4c4q | handlebars | 4.7.7 | 4.7.9 |
| CVE-2026-33228 | node-flatted | 3.2.7~ds-1 | 3.2.7~ds-1+deb13u1 |
| CVE-2026-27699 | node-agent-base, node-data-uri-to-buffer, node-http-proxy-agent, node-https-proxy-agent | various | 0~2024040606-6+deb13u1 |
| CVE-2026-45623 | node-postcss | 8.4.49+~cs9.2.32-1 | not yet available |
| CVE-2026-1525 / CVE-2026-13697 | node-undici | 7.3.0+dfsg1+~cs24.12.11-1 | not yet available |
| CVE-2026-25547 | node-brace-expansion | 2.0.1+~1.1.0-2 | not yet available |

High vulnerabilities — 207 unique CVE/GHSA IDs across 79 packages

Affected packages span the Debian base (`libc6`, `dpkg`, `gzip`, `libacl1`, `libcap2`, `libexpat1`, `libkrb5-*`, `libncursesw6`/`ncurses-*`, `libnghttp2-14`, `libngtcp2-*`, `libsqlite3-0`, `libtasn1-6`, `libtinfo6`, `perl*`), the bundled Go toolchain (`golang-1.24-go/src`, `stdlib`, `go-sdk`), Node.js/npm stack (`nodejs`, `libnode-dev`, `libnode115`, `npm`, `node-ajv`, `node-anymatch`, `node-babel7`(+runtime), `node-browserslist`, `node-diff`, `node-js-yaml`, `node-minimatch`, `node-serialize-javascript`, `node-tar`, `node-uuid`, `nanoid`, `picomatch`, `plugin-transform-modules-systemjs`, `http-cache-semantics`), the Python stack (`python3.13`(+minimal), `libpython3.13-*`, `cryptography`, `pyjwt`, `python-multipart`, `urllib3`, `starlette`, `soupsieve`, `black`, `jaraco-context`, `wheel`, `ujson`), and the `serena-agent`/`mcp` application packages themselves plus `text`, `handlebars`. Full ID list (207 IDs, CVE-2025-13151 ... through GO/GHSA identifiers) is available in the scan output; representative sample includes CVE-2025-13151, CVE-2025-13836, CVE-2025-15281, CVE-2025-4674, CVE-2025-47907, CVE-2025-55131, CVE-2025-58187/58188, CVE-2025-59375/59465/59466, CVE-2025-61723/61725/61726/61729/61731/61732, CVE-2025-68119, CVE-2025-69720/69873, plus numerous 2026-series CVE/GO/GHSA IDs for the Go/Node/Python toolchains.

License policy violations (514 findings)

Dominant license family: `Expat` (MIT) alone accounts for 264 findings (mostly npm/Python transitive deps). 28 packages report "no licenses found," including bundled binaries/tools such as `setuptools`, `jinja2`, `pathspec`, `jiter`, `ujson`, `annotated-types`, `packaging`, `python`, several `@babel/eslint-*` internal packages, `libcrypt1`, and Electron-style `cli-*`/`gui-*`/`web-streams-*` UNKNOWN-versioned bundles (likely a bundled Serena desktop/Electron component). Remaining findings are GPL-2.0/3.0-only/or-later, LGPL family, BSD variants, Artistic, MPL-2.0, CC0-1.0, Zlib, and similar copyleft/permissive licenses typical of a full Debian + Node + Python userland.

### Remediation

1. Rebuild the image on a current Debian 13 point release to pick up `perl`, `openssl`, `libcurl3t64-gnutls`, `libgnutls30t64`, `libssh2-1t64`, `nodejs`/`libnode*` security updates; several CVEs (perl, libcurl, libc6) show "not yet available" and should be tracked against the Debian security tracker for the next point release.
2. Upgrade the bundled Go toolchain to `>=1.24.13`/`1.25.7`/`1.26.0-rc.3` (closes GO-2026-4337 and related stdlib CVEs).
3. Update vendored/bundled npm packages: `handlebars>=4.7.9`, `node-lodash`, `node-flatted`, `node-postcss`, `node-undici`, `node-brace-expansion`, `node-agent-base`/`data-uri-to-buffer`/`http(s)-proxy-agent` to their Debian-patched or upstream-fixed versions.
4. Audit and remove/replace the "no licenses found" bundled `cli-*`/`gui-*`/`web-streams-*` UNKNOWN-versioned components — these are unidentified binary blobs and should be confirmed as legitimate build artifacts with proper license attribution.
5. This workflow runs `gh aw compile --force-refresh-container-pins` daily to keep the base image current; given the volume of Critical/High findings, prioritize this image first in the burn-down (see linked tracking issue).

> Generated by [🛡️ Daily Container Image Security Scan](https://github.com/github/gh-aw/actions/runs/31867321216) · auto · 246.3 AIC · ⌖ 6.66 AIC · ⊞ 7.2K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fdaily-squid-image-scan%22&type=issues)