dependency-cve-audit

name	dependency-cve-audit
description	Assess direct and transitive dependency vulnerabilities for actual applicability, exploitability, and safe remediation. Use when a cve/advisory affects a dependency.
license	MIT
metadata	{"category":"security","origin":"custom-synthesis","revision":"1.1.0"}

Dependency Cve Audit

Trigger

• A release or audit requires an SBOM and vulnerability review.
• Automated scanners report noisy findings.

Inputs

• Lockfiles/SBOM
• Runtime and deployment context
• Scanner results
• Vendor advisories and fixed versions

Procedure

1. Generate or verify an exact dependency inventory.
2. Use current primary advisories: vendor, ecosystem, NVD/CVE record, and maintainer security notice.
3. Map vulnerable version ranges to resolved installed versions.
4. Determine whether the vulnerable feature/path is present and reachable.
5. Assess exploit prerequisites, compensating controls, and asset impact.
6. Choose remediation: upgrade, patch, remove, configure, isolate, or temporarily mitigate.
7. Test compatibility and verify scanner resolution.
8. Document accepted risk with expiry and owner.

Output contract

• Applicability matrix
• Prioritized remediation plan
• Upgrade/test evidence
• Time-bounded exceptions

Quality gates

• No CVE is dismissed solely because it is transitive.
• No critical upgrade is applied blindly without compatibility tests.
• Severity and exploitability are separate fields.
• Advisory data is current and cited.

Handoffs and dependencies

• secrets-and-supply-chain
• operations/release-coordinator
• documentation/release-notes

Boundaries

• Do not publish exploit code or live target details.
• Do not treat a scanner score as final risk.
• Do not leave “temporary” exceptions without expiry.