SCA Finding: in

Metadata

ID:

Type: sca-vulnerability

Package: @

Ecosystem:

Vulnerability ID:

CVEs:

Severity:

Status: confirmed-exploitable

Location

Lockfile:

Package: @

Ecosystem:

Vulnerability Summary

Exploitability Analysis

Usage Context

Files Using Package:

Vulnerable Functions Called:

at :

Attack Vector

Entry Point: Data Flow: Exploit Payload: Impact:

Exploitability Assessment

| Factor | Assessment | Evidence | |--------|------------|----------| | Package Used | Yes/No | | | Vulnerable Function Called | Yes/No | | | User Input Reaches Vuln | Yes/No | | | Input Validation | Yes/No | | | Authentication Required | Yes/No | | | Production Code | Yes/No | | | Mitigations | None/Partial/Full | |

Severity Justification

Base CVSS Score: () Contextual Severity: Adjustment Reasoning: Attack Complexity: Privileges Required: User Interaction: Scope:

CVE Details

Published:

Modified:

CVSS Score:

Description:

References:

- -

Remediation

Immediate Action

1. Upgrade Package ```bash # # Go: go get @ go mod tidy

# npm: npm install @

# Python (poetry): poetry add @

# Python (pip): pip install == pip freeze > requirements.txt

# Ruby: bundle update

# Rust: cargo update ``` Target version: `@`

2. Verify Fix ```bash wraith scan ``` Confirm that the vulnerability no longer appears in scan results.

3. Test Application - - -

Alternative Remediation (if upgrade not possible)

If breaking changes prevent immediate upgrade:

Option 1: Apply mitigation controls

- -

Option 2: Use version overrides

- Go: Add `replace` directive in go.mod - npm: Add `resolutions` in package.json - Backport security patch to current version

Option 3: Remove dependency

- If package is not critical, consider removing it - Replace with alternative package without this vulnerability

Estimated Effort

Upgrade:

Testing:

Total:

References

OSV Entry: https://osv.dev/vulnerability/

Code Context

Import Statement

``` ```

Vulnerable Usage

``` <5-10 lines of code showing the vulnerable function being called> ```

Data Flow

```


```
---
*Finding generated by Ghost Security SCA Scanner*
*Exploitability confirmed by AI analysis on *