cve-known-vulnerabilities

# Local CVE Dependency Assessment Audit dependencies without modifying application files. Do not call an assessment or CVE MCP tool. ## Inputs - `workspace-path`: Absolute project root. - `output-path`: Required JSON result path supplied by the assessment catalog. - `scan-scope`: `direct` (default) or `all`. ## 1. Detect Ecosystem - Maven/Gradle project → advisory ecosystem `maven`. - `.sln`, `.slnx`, or project files → `nuget`. - `package.json` → `npm`. - If none apply, write `[]` to `output-path` and stop. ## 2. Collect Dependencies Prefer project wrappers and structured command output. Never edit manifests or lock files. ### Maven/Gradle - Maven: run `./mvnw dependency:list -DoutputAbsoluteArtifactId=true`; add `-DexcludeTransitive=true` for direct scope. Fall back to `mvn`, then static `pom.xml` parsing. - Gradle: run `./gradlew dependencies --configuration runtimeClasspath`; fall back to `gradle`, then static `build.gradle`/`build.gradle.kts` parsing. - Coordinate format: `groupId:artifactId:version`. ### NuGet - Run `dotnet list package --format json`; add `--include-transitive` for all scope. - If no solution exists at the root, target each discovered project explicitly. - Fall back to `PackageReference`, `Directory.Packages.props`, and `packages.config` parsing. - Coordinate format: `PackageName@version`. ### npm - Run `npm list --json`; add `--depth=0` for direct scope. - Fall back to `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, then `package.json`. - Coordinate format: `package-name@version`. For each dependency retain its manifest path and 1-based declaration line when directly declared; use line `0` for transitive dependencies. ## 3. Query GitHub Advisories Batch coordinates in groups of at most 30. Use `gh api` when available: ```text /advisories?ecosystem=<maven|nuget|npm>&affects=<url-encoded-coordinates>&per_page=100 ``` Follow pagination. If `gh` is unavailable, use the GitHub REST API with `GITHUB_TOKEN` when present. Never use general web search for vulnerability conclusions. If one batch fails, record the error and continue remaining batches. A failed query must not silently become a clean scan: return a wrapper with `status: partial` and the failed batch details instead of `[]`. ## 4. Normalize Results - Ignore withdrawn advisories. - Use `cve_id`, falling back to `ghsa_id`. - Deduplicate the same advisory across dependency batches. - Map severity: critical/high → `mandatory`; medium → `optional`; low/unknown → `potential`. - Group all affected dependencies for one advisory into one finding. - Include advisory URL, vulnerable range, first patched version, and manifest evidence. ## Output On a complete scan, write a flat JSON array to `output-path`; use `[]` only when every query succeeded and no vulnerability was found: ```json [ { "id": "CVE-2024-0001", "name": "Advisory summary", "status": "FOUND", "category": "CVE", "severity": "mandatory", "storyPoint": 1, "evidence": { "files": ["pom.xml:42"], "explanation": "Advisory URL, affected coordinates, vulnerable range, and patched version" } } ] ``` When any advisory batch fails, write: ```json { "input_name": "CVE dependency assessment", "analysis_method": "GitHub Security Advisories API", "status": "partial", "result": { "finding": "CVE scan completed with one or more failed advisory batches", "confidence": "low", "evidence": ["<failure details>"], "values": ["<all successfully returned FOUND findings>"] } } ``` Write the output exactly once using a temporary file followed by atomic rename. Return only the output path and concise counts to the parent assessment.