🚨 Security: Critical or high vulnerabilities in mcp-neo4j-cypher container
Open
Nobody has claimed this yet.
critical
grype
high
security
- Dominant language
- Go
- Stars
- 8
- Forks
- 7
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 62
Description
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
- Image:
ghcr.io/stacklok/dockyard/uvx/mcp-neo4j-cypher:0.5.3 - Critical vulnerabilities: 1
- High vulnerabilities: 1
Details
See the Security tab for full details.
Critical Vulnerabilities
- GHSA-vv7q-7jx5-f767 in
fastmcp@2.14.7: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
High Vulnerabilities
- GHSA-rww4-4w9c-7733 in
fastmcp@2.14.7: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
Automated security scan from periodic-security-scan workflow
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Security tab and periodic-security-scan workflow named in the issue, then trace how the mcp-neo4j-cypher:0.5.3 image and its FastMCP dependency are built. Update the dependency or image source to address both listed advisories, rerun the relevant scan and build, and confirm publishing is no longer blocked.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, github-actions, python
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100