Skip to content

Commit 4e5b064

Browse files
afsmeiraafsmeira
authored
fix: Add expected vulnerable test dependencies (#281)
1 parent ebbdd40 commit 4e5b064

3 files changed

Lines changed: 41 additions & 35 deletions

File tree

‎docs/multiple-tests/pattern-vulnerability-critical/results.xml‎

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -39,36 +39,6 @@
3939
/>
4040
</file>
4141

42-
<file name="javascript/package-lock.json">
43-
<error
44-
source="vulnerability_critical"
45-
line="14"
46-
message="Insecure dependency npm/axios@0.21.0 (CVE-2025-62718: axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization) (update to 0.31.0)"
47-
severity="error"
48-
/>
49-
<error
50-
source="vulnerability_critical"
51-
line="14"
52-
message="Insecure dependency npm/axios@0.21.0 (CVE-2026-40175: axios: Axios: Remote Code Execution via Prototype Pollution escalation) (update to 0.31.0)"
53-
severity="error"
54-
/>
55-
</file>
56-
57-
<file name="javascript/yarn.lock">
58-
<error
59-
source="vulnerability_critical"
60-
line="5"
61-
message="Insecure dependency npm/axios@0.21.0 (CVE-2025-62718: axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization) (update to 0.31.0)"
62-
severity="error"
63-
/>
64-
<error
65-
source="vulnerability_critical"
66-
line="5"
67-
message="Insecure dependency npm/axios@0.21.0 (CVE-2026-40175: axios: Axios: Remote Code Execution via Prototype Pollution escalation) (update to 0.31.0)"
68-
severity="error"
69-
/>
70-
</file>
71-
7242
<file name="python/Pipfile.lock">
7343
<error
7444
source="vulnerability_critical"

‎docs/multiple-tests/pattern-vulnerability-high/results.xml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -115,13 +115,19 @@
115115
<error
116116
source="vulnerability_high"
117117
line="5"
118-
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32280: During chain building, the amount of work that is done is not correctl ...) (update to 1.25.9)"
118+
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32280: crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building) (update to 1.25.9)"
119119
severity="high"
120120
/>
121121
<error
122122
source="vulnerability_high"
123123
line="5"
124-
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32282: golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root) (update to 1.25.9)"
124+
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32281: crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation) (update to 1.25.9)"
125+
severity="high"
126+
/>
127+
<error
128+
source="vulnerability_high"
129+
line="5"
130+
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32283: If one side of the TLS connection sends multiple key update messages p ...) (update to 1.25.9)"
125131
severity="high"
126132
/>
127133
</file>

‎docs/multiple-tests/pattern-vulnerability-medium/results.xml‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -209,19 +209,25 @@
209209
<error
210210
source="vulnerability_medium"
211211
line="3"
212-
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32281: crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation) (update to 1.25.9)"
212+
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32288: archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously-crafted archive) (update to 1.25.9)"
213213
severity="warning"
214214
/>
215215
<error
216216
source="vulnerability_medium"
217217
line="3"
218-
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32288: archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously-crafted archive) (update to 1.25.9)"
218+
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32289: html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals) (update to 1.25.9)"
219219
severity="warning"
220220
/>
221221
<error
222222
source="vulnerability_medium"
223223
line="3"
224-
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32289: html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals) (update to 1.25.9)"
224+
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2025-22870: golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net) (update to 1.23.7)"
225+
severity="warning"
226+
/>
227+
<error
228+
source="vulnerability_medium"
229+
line="3"
230+
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32282: golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root) (update to 1.25.9)"
225231
severity="warning"
226232
/>
227233
</file>
@@ -287,6 +293,18 @@
287293
message="Insecure dependency npm/axios@0.21.0 (CVE-2020-28168: nodejs-axios: allows an attacker to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address) (update to 0.21.1)"
288294
severity="warning"
289295
/>
296+
<error
297+
source="vulnerability_medium"
298+
line="14"
299+
message="Insecure dependency npm/axios@0.21.0 (CVE-2025-62718: axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization) (update to 0.31.0)"
300+
severity="warning"
301+
/>
302+
<error
303+
source="vulnerability_medium"
304+
line="14"
305+
message="Insecure dependency npm/axios@0.21.0 (CVE-2026-40175: axios: Axios: Remote Code Execution via Prototype Pollution escalation) (update to 0.31.0)"
306+
severity="warning"
307+
/>
290308
<error
291309
source="vulnerability_medium"
292310
line="14"
@@ -314,6 +332,18 @@
314332
message="Insecure dependency npm/axios@0.21.0 (CVE-2023-45857: axios: exposure of confidential data stored in cookies) (update to 0.28.0)"
315333
severity="warning"
316334
/>
335+
<error
336+
source="vulnerability_medium"
337+
line="5"
338+
message="Insecure dependency npm/axios@0.21.0 (CVE-2025-62718: axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization) (update to 0.31.0)"
339+
severity="warning"
340+
/>
341+
<error
342+
source="vulnerability_medium"
343+
line="5"
344+
message="Insecure dependency npm/axios@0.21.0 (CVE-2026-40175: axios: Axios: Remote Code Execution via Prototype Pollution escalation) (update to 0.31.0)"
345+
severity="warning"
346+
/>
317347
<error
318348
source="vulnerability_medium"
319349
line="12"

0 commit comments

Comments
 (0)