🚨 Security: Critical or high vulnerabilities in mcp-neo4j-memory container
Open
Nobody has claimed this yet.
critical
grype
high
security
- Dominant language
- Go
- Stars
- 8
- Forks
- 7
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 62
Description
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
- Image:
ghcr.io/stacklok/dockyard/uvx/mcp-neo4j-memory:0.4.5 - Critical vulnerabilities: 1
- High vulnerabilities: 1
Details
See the Security tab for full details.
Critical Vulnerabilities
- GHSA-vv7q-7jx5-f767 in
fastmcp@2.14.7: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
High Vulnerabilities
- GHSA-rww4-4w9c-7733 in
fastmcp@2.14.7: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
Automated security scan from periodic-security-scan workflow
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in the Security tab for the findings on ghcr.io/stacklok/dockyard/uvx/mcp-neo4j-memory:0.4.5, then read the periodic-security-scan workflow to understand how the image is checked. Resolve the listed fastmcp vulnerabilities and confirm the scan passes so publishing is no longer blocked.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, github-actions, python
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100