OWASP/cve-lite-cli v1.36.1

v1.36.1 - The recommended fix version could itself be vulnerable

on GitHub

Fixed

• The recommended fix version could be a version that is still vulnerable. Two separate defects, either enough on its own. When several advisories affected the installed version, the lowest of their fixed versions was returned rather than the highest, so @hono/node-server@2.0.0 was told to upgrade to 2.0.5 when only 2.0.10 clears both advisories against it. Separately, the candidate was only checked against advisories affecting the version you already have, so an advisory introduced at or above the fix version was invisible: tmp@0.2.5 was told to upgrade to 0.2.6, which is the exact version another advisory introduces, while the same scan reported tmp@0.2.6 as vulnerable.

• The npm advisory source read fields npm does not send. It looked for ghsa_id, cve_ids and patched_versions; the bulk endpoint sends id, url, title, severity, vulnerable_versions, cwe and cvss. Every advisory therefore arrived under a private identifier and was counted a second time beside the same advisory from OSV, every advisory carried a range with no upper bound, and the request asked about one version per package while the answer was applied to all of them. postcss carries advisories capped at <=8.5.22, <8.5.10, <=8.5.11 and <=8.5.17, and all four were reported against 8.5.23, 8.5.25 and 8.5.26, versions the same scan was recommending as the fix.

• Caret ranges below 1.0.0 were treated as "same major". npm anchors the caret to the leftmost non-zero component, so ^0.25.0 means >=0.25.0 <0.26.0 and ^0.0.3 means >=0.0.3 <0.0.4. This also decides which versions an override is considered to admit, so it affected OA010.

• EPSS enrichment stopped at 100 CVEs. FIRST.org caps a response at 100 rows and the whole list was sent as one query, so a project past that lost scores, priority signals and the EPSS column on everything beyond the cap. Queries are now chunked, and one failing batch no longer discards the rest.

• The pull request delta comment matched on its marker alone and ignored authorship, so it could adopt and rewrite a comment written by something else.

Upgrading

Your counts may go down. On a 4,879 package monorepo, advisories fell from 414 to 235 and findings from 100 to 94. Every dropped finding was verified clean against both OSV and npm's own advisory endpoint, and a sweep of all 4,879 packages now agrees with OSV exactly, with nothing missed and nothing reported that OSV does not have.

Validation

• npm test
• npm run build

Contributors

• @prx-my for the caret rule below 1.0.0
• @MRX-72 for the EPSS batching fix