Skip to content

VULNERABILITY_PATCH_LOG.md

Latest commit

 

History

History
87 lines (70 loc) · 4.31 KB

VULNERABILITY_PATCH_LOG.md

File metadata and controls

87 lines (70 loc) · 4.31 KB
Raw

Vulnerability Patch Log

This document tracks the vulnerabilities found in the grype report and their patch status.

Summary

  • Total vulnerabilities: 40
  • Date of scan: March 5, 2026

Vulnerability Details

# Package Vulnerability Severity Fixed In Patched? Notes
1 minimist (1.2.5) GHSA-xvch-5gv4-984h Critical 1.2.6
2 minimist (1.2.5) CVE-2021-44906 Critical -
3 babel-traverse (6.26.0) GHSA-67hx-6x53-jw92 Critical -
4 sorcery (0.10.0) CVE-2020-11052 Critical 0.15.0
5 decode-uri-component (0.2.0) GHSA-w573-4hg7-7wgq High 0.2.1
6 decode-uri-component (0.2.0) CVE-2022-38900 High -
7 minimatch (3.0.4) GHSA-f8q6-p94x-37v3 High 3.0.5
8 minimatch (3.0.4) CVE-2022-3517 High -
9 ansi-regex (3.0.0) GHSA-93q8-gq69-wqmw High 3.0.1
10 ansi-regex (3.0.0) CVE-2021-3807 High -
11 base (0.11.2) CVE-2009-4591 High -
12 base (0.11.2) CVE-2009-4592 High -
13 braces (2.3.2) GHSA-grv7-fg5c-xmjg High 3.0.3
14 glob-parent (2.0.0) CVE-2020-28469 High 5.1.2
15 lodash (4.17.20) GHSA-35jh-r3h4-6jhm High 4.17.21
16 lodash (4.17.20) CVE-2021-23337 High -
17 rollup (0.41.6) GHSA-gcx4-mw62-g8wm High 2.79.2
18 typescript (2.8.1) CVE-2020-1416 High -
19 ansi-regex (4.1.0) GHSA-93q8-gq69-wqmw High 4.1.1
20 ansi-regex (4.1.0) CVE-2021-3807 High -
21 braces (3.0.2) GHSA-grv7-fg5c-xmjg High 3.0.3
22 glob-parent (5.1.1) GHSA-ww39-953v-wcq6 High 5.1.2
23 glob-parent (5.1.1) CVE-2020-28469 High -
24 path-parse (1.0.5) CVE-2021-23343 High -
25 braces (1.8.5) GHSA-grv7-fg5c-xmjg High 3.0.3
26 decode-uri-component (0.2.0) CVE-2022-38778 Medium -
27 micromatch (3.1.10) GHSA-952p-6rrq-rcjv Medium 4.0.8
28 base (0.11.2) CVE-2009-4590 Medium -
29 base (0.11.2) CVE-2014-2980 Medium -
30 lodash (4.17.20) GHSA-29mw-wpgm-hmr9 Medium 4.17.21
31 lodash (4.17.20) CVE-2020-28500 Medium -
32 nanoid (3.1.12) GHSA-qrpm-p2h7-hrv2 Medium 3.1.31
33 nanoid (3.1.12) CVE-2021-23566 Medium -
34 micromatch (2.3.11) GHSA-952p-6rrq-rcjv Medium 4.0.8
35 path-parse (1.0.5) GHSA-hj48-42vr-x3v9 Medium 1.0.7
36 slash (1.0.0) CVE-2002-1647 Medium -
37 braces (1.8.5) CVE-2018-1109 Medium -
38 braces (1.8.5) GHSA-cwfw-4gq5-mrqx Low 2.3.1
39 braces (1.8.5) GHSA-g95f-p29q-9xw4 Low 2.3.1
40 debug (4.2.0) GHSA-gxpj-cx7g-858c Low 4.3.1

Patch Actions Taken

March 5, 2026

1. Updated @modelcontextprotocol/sdk from ^1.13.2 to ^1.27.1

  • Impact: Patched 40 vulnerabilities from transitive dependencies
  • Details: The old version of the MCP SDK used ajv@6.12.6 which depended on uri-js@4.4.1. The uri-js package bundled its own yarn.lock file containing vulnerable versions of many packages (minimist, lodash, braces, glob-parent, etc.). Upgrading to the latest MCP SDK (1.27.1) uses ajv@8.17.1 which uses fast-uri instead of uri-js, eliminating all these vulnerabilities.

2. Added npm overrides for diff and serialize-javascript

  • diff: Overridden from mocha's transitive dependency (^7.0.0) to ^8.0.3
    • Impact: Patched 1 low severity vulnerability (GHSA-73rr-hh4g-fpgx - DoS)
  • serialize-javascript: Overridden to ^7.0.4
    • Impact: Patched 1 high severity vulnerability (GHSA-5c6j-r48x-rmvq - RCE)

Final Result

  • Original vulnerabilities: 40
  • After MCP SDK upgrade: 8
  • After overrides: 0

Patched Vulnerabilities Summary

Package Vulnerability Severity Patch Method
All 40 from uri-js chain Various (see original report) Critical/High/Medium Updated @modelcontextprotocol/sdk to 1.27.1
diff (6.0.0-8.0.2) GHSA-73rr-hh4g-fpgx Low npm override to ^8.0.3
serialize-javascript (<=7.0.2) GHSA-5c6j-r48x-rmvq High npm override to ^7.0.4