fad-checker 2.0.1 → 2.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (66) hide show
  1. package/CHANGELOG.md +50 -0
  2. package/README.md +91 -17
  3. package/completions/fad-checker.bash +1 -1
  4. package/completions/fad-checker.zsh +14 -1
  5. package/data/license-policy.json +97 -0
  6. package/fad-checker-report/cve-report.doc +630 -0
  7. package/fad-checker-report/cve-report.html +748 -0
  8. package/fad-checker.js +278 -53
  9. package/lib/cache-archive.js +3 -0
  10. package/lib/codecs/codec.interface.js +3 -0
  11. package/lib/codecs/composer/parse.js +3 -0
  12. package/lib/codecs/composer/registry.js +13 -5
  13. package/lib/codecs/composer.codec.js +3 -0
  14. package/lib/codecs/go/parse.js +65 -0
  15. package/lib/codecs/go/registry.js +74 -0
  16. package/lib/codecs/go.codec.js +76 -0
  17. package/lib/codecs/index.js +7 -2
  18. package/lib/codecs/maven/jar-scan.js +199 -0
  19. package/lib/codecs/maven.codec.js +17 -1
  20. package/lib/codecs/npm/collect.js +11 -0
  21. package/lib/codecs/npm/parse.js +3 -0
  22. package/lib/codecs/npm/registry.js +10 -2
  23. package/lib/codecs/npm.codec.js +3 -0
  24. package/lib/codecs/nuget/parse.js +3 -0
  25. package/lib/codecs/nuget/registry.js +11 -4
  26. package/lib/codecs/nuget.codec.js +3 -0
  27. package/lib/codecs/pypi/parse.js +7 -2
  28. package/lib/codecs/pypi/registry.js +24 -5
  29. package/lib/codecs/pypi.codec.js +3 -0
  30. package/lib/codecs/recipes.js +28 -1
  31. package/lib/codecs/ruby/parse.js +42 -0
  32. package/lib/codecs/ruby/registry.js +76 -0
  33. package/lib/codecs/ruby.codec.js +66 -0
  34. package/lib/codecs/select.js +3 -0
  35. package/lib/codecs/yarn.codec.js +3 -0
  36. package/lib/config.js +3 -0
  37. package/lib/core.js +3 -0
  38. package/lib/cpe.js +30 -5
  39. package/lib/csaf-export.js +159 -0
  40. package/lib/cve-download.js +3 -0
  41. package/lib/cve-match.js +12 -1
  42. package/lib/cve-report.js +157 -28
  43. package/lib/dep-record.js +15 -2
  44. package/lib/deps-descriptor.js +3 -0
  45. package/lib/epss.js +115 -0
  46. package/lib/gate.js +45 -0
  47. package/lib/json-export.js +110 -0
  48. package/lib/kev.js +88 -0
  49. package/lib/license-policy.js +110 -0
  50. package/lib/maven-license.js +52 -0
  51. package/lib/maven-repo.js +3 -0
  52. package/lib/maven-version.js +8 -3
  53. package/lib/nvd.js +13 -3
  54. package/lib/osv.js +68 -19
  55. package/lib/outdated.js +3 -0
  56. package/lib/priority.js +90 -0
  57. package/lib/purl.js +77 -0
  58. package/lib/retire.js +3 -0
  59. package/lib/sarif-export.js +134 -0
  60. package/lib/sbom-export.js +153 -0
  61. package/lib/scan-completeness.js +3 -0
  62. package/lib/snyk.js +3 -0
  63. package/lib/suppress.js +113 -0
  64. package/lib/transitive.js +3 -0
  65. package/lib/ui.js +3 -0
  66. package/package.json +48 -2
package/fad-checker-report/cve-report.doc ADDED
@@ -0,0 +1,630 @@
1
+ <html xmlns:o="urn:schemas-microsoft-com:office:office"
2
+ xmlns:w="urn:schemas-microsoft-com:office:word"
3
+ xmlns="http://www.w3.org/TR/REC-html40">
4
+ <head>
5
+ <meta charset="utf-8">
6
+ <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
7
+ <meta name="ProgId" content="Word.Document">
8
+ <meta name="Generator" content="Microsoft Word 15">
9
+ <title>FAD-Checker Report</title>
10
+ <!--[if gte mso 9]>
11
+ <xml>
12
+ <w:WordDocument>
13
+ <w:View>Print</w:View>
14
+ <w:Zoom>100</w:Zoom>
15
+ <w:DoNotOptimizeForBrowser/>
16
+ </w:WordDocument>
17
+ </xml>
18
+ <![endif]-->
19
+ <!--[if gte mso 9]>
20
+ <style>
21
+ @page WordSection1 {
22
+ size: 16838twips 11906twips;
23
+ mso-page-orientation: landscape;
24
+ margin: 567twips 567twips 567twips 567twips;
25
+ }
26
+ </style>
27
+ <![endif]-->
28
+ <style>
29
+ * { box-sizing: border-box; }
30
+ body { font-family: -apple-system, "Segoe UI", Roboto, sans-serif; color: #1f2937; margin: 24px; background: #f9fafb; }
31
+ .report-header { border-bottom: 3px solid #6366f1; padding-bottom: 16px; margin-bottom: 20px; }
32
+ h1 { margin: 0 0 4px 0; font-size: 28px; letter-spacing: -.5px; }
33
+ .report-subtitle { color: #6b7280; font-size: 14px; font-weight: 500; margin-bottom: 12px; letter-spacing: .3px; }
34
+ h2 { margin: 32px 0 12px; font-size: 20px; border-bottom: 2px solid #e5e7eb; padding-bottom: 6px; }
35
+ .meta { color: #6b7280; font-size: 13px; margin-bottom: 16px; }
36
+ .summary { display: flex; flex-wrap: wrap; gap: 12px; margin: 16px 0; }
37
+ .summary .card { padding: 10px 16px; border-radius: 6px; background: #fff; border: 1px solid #e5e7eb; min-width: 120px; }
38
+ .summary .card .v { font-size: 24px; font-weight: 700; }
39
+ .summary .card .l { font-size: 11px; text-transform: uppercase; color: #6b7280; letter-spacing: .5px; }
40
+ .summary .card.sev-critical { border-left: 4px solid #dc2626; }
41
+ .summary .card.sev-critical .v { color: #dc2626; }
42
+ .summary .card.sev-high { border-left: 4px solid #f97316; }
43
+ .summary .card.sev-high .v { color: #f97316; }
44
+ .summary .card.sev-medium { border-left: 4px solid #f59e0b; }
45
+ .summary .card.sev-medium .v { color: #b45309; }
46
+ .summary .card.sev-low { border-left: 4px solid #2563eb; }
47
+ .summary .card.sev-low .v { color: #2563eb; }
48
+ .summary .card.sev-vendored { border-left: 4px solid #6366f1; }
49
+ .summary .card.sev-warn { border-left: 4px solid #f59e0b; background: #fffbeb; }
50
+ .toc { position: sticky; top: 0; z-index: 50; background: #fff; border: 1px solid #e5e7eb; border-radius: 6px; padding: 8px 12px; margin: 16px 0; display: flex; flex-wrap: wrap; gap: 6px 14px; font-size: 12px; box-shadow: 0 1px 4px rgba(0,0,0,.04); }
51
+ .toc a { color: #4338ca; text-decoration: none; padding: 2px 6px; border-radius: 3px; }
52
+ .toc a:hover { background: #eef2ff; }
53
+ .exec-summary .exec-top { margin-top: 8px; padding-top: 10px; border-top: 1px dashed #e5e7eb; }
54
+ .exec-summary .exec-top-title { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .8px; color: #6b7280; margin-bottom: 6px; }
55
+ .exec-summary .exec-top-list { list-style: none; padding: 0; margin: 0; font-size: 12px; }
56
+ .exec-summary .exec-top-list li { display: flex; align-items: center; gap: 8px; padding: 3px 0; font-family: ui-monospace, monospace; }
57
+ .exec-summary .exec-cve-link { color: #1d4ed8; text-decoration: none; font-weight: 600; }
58
+ .exec-summary .exec-cve-link:hover { text-decoration: underline; }
59
+ .exec-summary .exec-ver { color: #6b7280; }
60
+ .exec-summary .exec-fix { color: #065f46; font-weight: 600; }
61
+ .fp-intro { background: #f3f4f6; border-left: 3px solid #6b7280; padding: 10px 14px; margin: 8px 0 16px; font-size: 12px; color: #4b5563; line-height: 1.5; }
62
+ td.prio { white-space: normal; }
63
+ td.prio .prio-band { white-space: nowrap; }
64
+ td.prio .kev-chip { display: block; margin-top: 3px; font-size: 10px; font-weight: 700; color: #7c0008; white-space: nowrap; }
65
+ td.prio .epss-chip { display: block; margin-top: 2px; font-size: 10px; color: #6b7280; font-family: ui-monospace, monospace; white-space: nowrap; }
66
+ .summary .card.sev-kev { border-left: 4px solid #7c0008; background: #fff1f2; }
67
+ .summary .card.sev-kev .v { color: #7c0008; }
68
+ .lic-group { margin: 14px 0; }
69
+ .lic-group .lic-h { font-size: 14px; margin: 8px 0 4px; padding: 4px 8px; border-radius: 4px; }
70
+ .lic-group .lic-n { font-size: 11px; color: #6b7280; font-weight: 500; }
71
+ .lic-group.lic-strong .lic-h { background: #fee2e2; color: #7c0008; }
72
+ .lic-group.lic-weak .lic-h { background: #fef3c7; color: #92400e; }
73
+ .lic-group.lic-unknown .lic-h { background: #e5e7eb; color: #374151; }
74
+ .lic-group.lic-ok .lic-h { background: #dcfce7; color: #065f46; }
75
+ td.cwe { font-family: ui-monospace, monospace; font-size: 11px; color: #4b5563; }
76
+ td.cwe .cwe-link { color: #6366f1; text-decoration: none; }
77
+ td.cwe .cwe-link:hover { text-decoration: underline; }
78
+ td.cwe .cwe-empty { color: #d1d5db; }
79
+ td.cwe .cwe-more { color: #9ca3af; font-style: italic; font-size: 10px; }
80
+ td.cwe .cwe-name { font-family: -apple-system, "Segoe UI", Roboto, sans-serif; font-size: 10px; color: #6b7280; line-height: 1.3; margin-top: 1px; max-width: 220px; }
81
+ .cwe-list { list-style: none; padding: 0; margin: 0; }
82
+ .cwe-list li { padding: 3px 0; font-size: 12px; line-height: 1.5; }
83
+ .cwe-list li .cwe-link { font-family: ui-monospace, monospace; color: #4338ca; text-decoration: none; font-weight: 600; }
84
+ .cwe-list li .cwe-link:hover { text-decoration: underline; }
85
+ .cwe-list li .cwe-name-inline { color: #374151; }
86
+ .cwe-list li .cwe-empty { color: #9ca3af; font-style: italic; }
87
+ /* CWE chip in the exec summary */
88
+ .exec-summary .exec-cwe { display: inline-flex; align-items: baseline; gap: 4px; font-size: 11px; color: #4b5563; background: #eef2ff; border: 1px solid #c7d2fe; padding: 1px 6px; border-radius: 3px; margin-left: 2px; }
89
+ .exec-summary .exec-cwe .exec-cwe-id { font-family: ui-monospace, monospace; font-weight: 600; color: #4338ca; }
90
+ .exec-summary .exec-cwe .exec-cwe-name { color: #4b5563; }
91
+ td.published { font-family: ui-monospace, monospace; font-size: 11px; color: #6b7280; white-space: nowrap; }
92
+ tr.cve-row.cpe-fp td { opacity: .55; }
93
+ .jump-badge { display: inline-block; padding: 1px 8px; border-radius: 4px; font-size: 10px; font-weight: 700; text-transform: uppercase; letter-spacing: .5px; }
94
+ .jump-badge.jump-major { background: #fee2e2; color: #991b1b; }
95
+ .jump-badge.jump-minor { background: #fef3c7; color: #92400e; }
96
+ .jump-badge.jump-patch { background: #e0f2fe; color: #075985; }
97
+ .jump-badge.jump-pre, .jump-badge.jump-unknown { background: #f3f4f6; color: #6b7280; }
98
+ tr.jump-patch td, tr.jump-pre td, tr.jump-unknown td { opacity: .75; }
99
+ tr.cve-row .cpe-tag { display: inline-block; margin-top: 2px; font-size: 9px; font-weight: 600; text-transform: uppercase; letter-spacing: .5px; background: #f3f4f6; color: #6b7280; padding: 1px 5px; border-radius: 3px; }
100
+ table { width: 100%; border-collapse: collapse; background: #fff; margin: 8px 0 24px; font-size: 13px; }
101
+ th, td { padding: 8px 10px; text-align: left; border-bottom: 1px solid #e5e7eb; vertical-align: top; }
102
+ th { background: #f3f4f6; font-weight: 600; font-size: 11px; text-transform: uppercase; letter-spacing: .5px; color: #4b5563; }
103
+ tr:nth-child(even) { background: #fafafa; }
104
+ td.dep { font-family: ui-monospace, monospace; font-size: 12px; }
105
+ .defined-in { margin-top: 4px; font-family: ui-monospace, monospace; font-size: 10px; color: #6b7280; line-height: 1.4; }
106
+ .defined-in .defined-label { color: #9ca3af; font-family: -apple-system, "Segoe UI", Roboto, sans-serif; text-transform: uppercase; letter-spacing: .4px; font-size: 9px; margin-right: 4px; }
107
+ .defined-in code { background: #f3f4f6; padding: 1px 4px; border-radius: 3px; color: #374151; word-break: break-all; }
108
+ code.path { font-family: ui-monospace, monospace; font-size: 0.9em; background: #f3f4f6; padding: 1px 6px; border-radius: 3px; color: #1f2937; font-weight: 400; }
109
+ .exec-summary { border: 1px solid #e5e7eb; border-radius: 8px; padding: 16px 20px; margin: 16px 0; background: #fff; display: flex; flex-direction: column; gap: 8px; }
110
+ .exec-summary .exec-head { display: flex; align-items: center; gap: 12px; }
111
+ .exec-summary .exec-level { font-size: 12px; font-weight: 700; letter-spacing: 1px; padding: 4px 12px; border-radius: 999px; }
112
+ .exec-summary .exec-title { font-size: 18px; font-weight: 600; color: #111827; }
113
+ .exec-summary .exec-copy-btn { margin-left: auto; }
114
+ .exec-summary .exec-meta { font-size: 12px; color: #6b7280; }
115
+ .exec-summary .exec-bullets { margin: 4px 0 0; padding-left: 22px; font-size: 13px; color: #374151; line-height: 1.6; }
116
+ .exec-summary.exec-critical { border-color: #dc2626; }
117
+ .exec-summary.exec-critical .exec-level { background: #dc2626; color: #fff; }
118
+ .exec-summary.exec-high { border-color: #f97316; }
119
+ .exec-summary.exec-high .exec-level { background: #f97316; color: #fff; }
120
+ .exec-summary.exec-medium { border-color: #f59e0b; }
121
+ .exec-summary.exec-medium .exec-level { background: #f59e0b; color: #fff; }
122
+ .exec-summary.exec-low { border-color: #2563eb; }
123
+ .exec-summary.exec-low .exec-level { background: #2563eb; color: #fff; }
124
+ .exec-summary.exec-info { border-color: #10b981; }
125
+ .exec-summary.exec-info .exec-level { background: #10b981; color: #fff; }
126
+ .exec-summary.exec-unknown { border-color: #6b7280; }
127
+ .exec-summary.exec-unknown .exec-level { background: #6b7280; color: #fff; }
128
+ .defined-in .defined-more { color: #9ca3af; font-style: italic; }
129
+ td.cve a { color: #1d4ed8; text-decoration: none; font-family: ui-monospace, monospace; }
130
+ td.cve a:hover { text-decoration: underline; }
131
+ td.desc { color: #4b5563; max-width: 480px; }
132
+ .empty { color: #9ca3af; font-style: italic; padding: 12px 0; }
133
+ .warnings { background: #fffbeb; border: 1px solid #fcd34d; padding: 12px 16px; border-radius: 6px; margin: 16px 0; }
134
+ .warnings h3 { margin: 0 0 10px; font-size: 14px; color: #92400e; }
135
+ .warnings .warn-block { background: #fff; border-left: 3px solid #f59e0b; padding: 8px 12px; margin: 8px 0; border-radius: 0 4px 4px 0; }
136
+ .warnings .warn-block.warn-unresolved-versions { border-left-color: #ef4444; background: #fef2f2; }
137
+ .warnings .warn-block.warn-private-libs { border-left-color: #6366f1; background: #eef2ff; }
138
+ .warnings .warn-head { font-size: 13px; color: #92400e; margin-bottom: 4px; }
139
+ .warnings .warn-unresolved-versions .warn-head { color: #991b1b; }
140
+ .warnings .warn-private-libs .warn-head { color: #312e81; }
141
+ .warnings .warn-private-libs code { background: #e0e7ff; }
142
+ .warnings .warn-defined { font-size: 10px; color: #6b7280; margin-top: 2px; padding-left: 14px; }
143
+ .warnings .warn-defined code.path { background: #f3f4f6; color: #374151; font-size: 10px; padding: 1px 4px; }
144
+ .warnings .warn-defined-more { color: #9ca3af; font-style: italic; }
145
+ .warnings .count { color: #6b7280; font-weight: 400; }
146
+ .warnings .warn-path { font-size: 11px; color: #6b7280; margin-bottom: 4px; }
147
+ .warnings .warn-msg { font-size: 12px; color: #374151; line-height: 1.45; }
148
+ .warnings .warn-items { margin: 6px 0 0; padding-left: 18px; font-size: 11px; max-height: 180px; overflow: auto; }
149
+ .warnings .warn-items li { margin-bottom: 2px; }
150
+ .warnings .warn-items .more { color: #6b7280; font-style: italic; }
151
+ .warnings code { background: #fef3c7; padding: 1px 4px; border-radius: 3px; font-size: 11px; }
152
+ .warnings .warn-unresolved-versions code { background: #fecaca; }
153
+ .confidence { font-size: 10px; color: #9ca3af; text-transform: uppercase; }
154
+ .source { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 10px; background: #e5e7eb; color: #374151; margin: 1px 2px 1px 0; }
155
+ .source.both { background: #c7d2fe; color: #312e81; }
156
+ .source.snyk { background: #fce7f3; color: #831843; }
157
+ .source.osv { background: #dcfce7; color: #166534; }
158
+ .source.fad { background: #fef3c7; color: #92400e; }
159
+ .source.nvd { background: #cffafe; color: #155e75; }
160
+ .chip { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 10px; margin-left: 4px; }
161
+ .chip.transitive { background: #fef3c7; color: #92400e; }
162
+ .chip.direct { background: #d1fae5; color: #065f46; }
163
+ .chip.parent { background: #ddd6fe; color: #5b21b6; }
164
+ /* Maven / npm scope qualifiers added next to .chip.direct when relevant */
165
+ .chip.scope-test { background: #fee2e2; color: #991b1b; }
166
+ .chip.scope-provided { background: #fed7aa; color: #9a3412; }
167
+ .chip.scope-runtime { background: #cffafe; color: #155e75; }
168
+ .chip.scope-system { background: #f3f4f6; color: #4b5563; }
169
+ .chip.scope-dev { background: #fee2e2; color: #991b1b; }
170
+ .chip.scope-peer { background: #ede9fe; color: #5b21b6; }
171
+ .chip.scope-optional { background: #f3f4f6; color: #6b7280; }
172
+ .chip.scope-vendored { background: #e0e7ff; color: #3730a3; }
173
+ .via { font-size: 10px; color: #6b7280; margin-top: 2px; font-family: ui-monospace, monospace; max-width: 220px; word-break: break-all; }
174
+ h3 { margin: 24px 0 10px; font-size: 16px; color: #374151; }
175
+ details.report-section { margin: 28px 0 0; }
176
+ details.report-section[open] { margin-bottom: 8px; }
177
+ details.report-section > summary { cursor: pointer; list-style: none; user-select: none; outline: none; padding: 0; }
178
+ details.report-section > summary::-webkit-details-marker { display: none; }
179
+ details.report-section > summary h2 { margin: 0; display: flex; align-items: center; gap: 8px; }
180
+ details.report-section > summary h2::before { content: "▾"; color: #6366f1; font-size: 14px; transition: transform .15s ease; display: inline-block; }
181
+ details.report-section:not([open]) > summary h2::before { transform: rotate(-90deg); }
182
+ details.report-section > summary:hover h2 { color: #4338ca; }
183
+ details.report-subsection { margin: 16px 0 0; }
184
+ details.report-subsection > summary { cursor: pointer; list-style: none; user-select: none; outline: none; padding: 0; }
185
+ details.report-subsection > summary::-webkit-details-marker { display: none; }
186
+ details.report-subsection > summary h3 { margin: 0; display: flex; align-items: center; gap: 8px; }
187
+ details.report-subsection > summary h3::before { content: "▾"; color: #9ca3af; font-size: 12px; transition: transform .15s ease; display: inline-block; }
188
+ details.report-subsection:not([open]) > summary h3::before { transform: rotate(-90deg); }
189
+ details.report-subsection > summary:hover h3 { color: #4b5563; }
190
+ /* Hierarchical indentation: every subsection's content gets a padded,
191
+ bordered container. Nested subsections inherit + add to the indent so
192
+ children visually nest under their parent. */
193
+ details.report-subsection > div { padding-left: 22px; margin-left: 6px; border-left: 2px solid #f3f4f6; padding-top: 4px; }
194
+ details.report-subsection details.report-subsection > summary h3 { font-size: 14px; color: #4b5563; }
195
+ details.report-subsection details.report-subsection details.report-subsection > summary h3 { font-size: 13px; color: #6b7280; font-weight: 500; }
196
+ details.report-subsection details.report-subsection > div { border-left-color: #e5e7eb; }
197
+ details.report-subsection details.report-subsection details.report-subsection > div { border-left-color: #d1d5db; }
198
+ .toolbar { display: flex; gap: 8px; margin: 12px 0 8px; flex-wrap: wrap; align-items: center; }
199
+ .toolbar .btn { display: inline-flex; align-items: center; gap: 4px; padding: 5px 12px; font-size: 12px; background: #fff; border: 1px solid #d1d5db; border-radius: 4px; cursor: pointer; color: #374151; font-family: inherit; }
200
+ .toolbar .btn:hover { background: #f3f4f6; border-color: #9ca3af; }
201
+ .toolbar .btn.primary { background: #4f46e5; color: #fff; border-color: #4f46e5; }
202
+ .toolbar .btn.primary:hover { background: #4338ca; }
203
+ .toolbar .toolbar-label { font-size: 11px; color: #6b7280; }
204
+ /* Table copy controls — one toolbar per table */
205
+ .table-wrap { margin: 8px 0 24px; }
206
+ .table-wrap > table { margin: 0; }
207
+ .table-actions { display: flex; justify-content: flex-end; gap: 6px; margin-bottom: 4px; }
208
+ .btn-copy { display: inline-flex; align-items: center; gap: 4px; padding: 3px 10px; font-size: 11px; background: #fff; border: 1px solid #d1d5db; border-radius: 4px; cursor: pointer; color: #4b5563; font-family: inherit; transition: all .15s ease; }
209
+ .btn-copy:hover { background: #eef2ff; border-color: #6366f1; color: #4338ca; }
210
+ .btn-copy.flashing-ok { background: #10b981; color: #fff; border-color: #10b981; }
211
+ .btn-copy.flashing-err { background: #dc2626; color: #fff; border-color: #dc2626; }
212
+ .fix-recipe { background: #fff7ed; border: 1px solid #fed7aa; border-left: 4px solid #f97316; padding: 10px 14px; border-radius: 4px; margin: 6px 0; font-size: 12px; }
213
+ .fix-recipe code { display: block; background: #1f2937; color: #f3f4f6; padding: 8px 10px; border-radius: 3px; font-size: 11px; margin-top: 6px; white-space: pre; overflow-x: auto; }
214
+ .fix-recipe .recipe-title { font-weight: 600; margin-bottom: 2px; }
215
+ .fix-recipe .recipe-meta { color: #92400e; }
216
+ td.action { font-size: 11px; max-width: 280px; }
217
+ td.action .pin { font-family: ui-monospace, monospace; background: #f3f4f6; padding: 2px 4px; border-radius: 2px; }
218
+ td.action .update-hint { color: #6b7280; font-size: 10px; margin-top: 2px; }
219
+ tr.cve-row { cursor: pointer; }
220
+ tr.cve-row:hover { background: #eef2ff !important; }
221
+ tr.cve-row.open { background: #e0e7ff !important; }
222
+ tr.cve-row td:first-child::before { content: "▸"; display: inline-block; margin-right: 6px; color: #6b7280; transition: transform .15s ease; }
223
+ tr.cve-row.open td:first-child::before { transform: rotate(90deg); color: #6366f1; }
224
+ tr.detail-row { display: none; }
225
+ tr.detail-row.open { display: table-row; }
226
+ tr.detail-row > td { padding: 0; border-bottom: 2px solid #c7d2fe; background: #f9fafb; }
227
+ .detail-panel { background: #f9fafb; border-left: 4px solid #6366f1; padding: 16px 24px; font-size: 12px; line-height: 1.6; width: 100%; }
228
+ .detail-panel .panel-block { margin: 0; padding: 10px 0; border-bottom: 1px solid #e5e7eb; }
229
+ .detail-panel .panel-block:last-child { border-bottom: none; }
230
+ .detail-panel .panel-block .panel-title { font-size: 11px; color: #6b7280; text-transform: uppercase; letter-spacing: .5px; font-weight: 600; margin-bottom: 6px; }
231
+ .detail-panel .panel-block .panel-title .count { color: #9ca3af; text-transform: none; letter-spacing: 0; font-weight: 400; margin-left: 4px; }
232
+ .detail-panel .full-desc { white-space: pre-wrap; color: #1f2937; max-width: 1100px; line-height: 1.55; }
233
+ .detail-panel .cvss-vector { font-family: ui-monospace, monospace; font-size: 11px; background: #1f2937; color: #f3f4f6; padding: 4px 8px; border-radius: 3px; display: inline-block; }
234
+ .detail-panel .ref-group { margin: 6px 0; }
235
+ .detail-panel .ref-group .ref-label { display: inline-block; font-size: 10px; font-weight: 600; text-transform: uppercase; letter-spacing: .5px; padding: 1px 6px; border-radius: 3px; margin-right: 4px; }
236
+ .detail-panel .ref-group .ref-label.patch { background: #d1fae5; color: #065f46; }
237
+ .detail-panel .ref-group .ref-label.exploit { background: #fee2e2; color: #991b1b; }
238
+ .detail-panel .ref-group .ref-label.advisory { background: #dbeafe; color: #1e40af; }
239
+ .detail-panel .ref-group .ref-label.vendor { background: #ede9fe; color: #5b21b6; }
240
+ .detail-panel .ref-group .ref-label.third-party { background: #fef3c7; color: #92400e; }
241
+ .detail-panel .ref-group .ref-label.mailing { background: #f3f4f6; color: #4b5563; }
242
+ .detail-panel .ref-group .ref-label.fix { background: #d1fae5; color: #065f46; }
243
+ .detail-panel .ref-group .ref-label.web { background: #f3f4f6; color: #6b7280; }
244
+ .detail-panel .ref-group .ref-label.other { background: #f3f4f6; color: #6b7280; }
245
+ .detail-panel .ref-list { margin: 4px 0 8px; padding-left: 18px; max-height: 220px; overflow-y: auto; }
246
+ .detail-panel .ref-list li { font-size: 11px; word-break: break-all; line-height: 1.6; }
247
+ .detail-panel .ref-list a { color: #1d4ed8; text-decoration: none; }
248
+ .detail-panel .ref-list a:hover { text-decoration: underline; }
249
+ .detail-panel .kv { display: flex; gap: 16px; flex-wrap: wrap; }
250
+ .detail-panel .kv > div { min-width: 200px; }
251
+ .detail-panel .kv label { display: block; font-size: 10px; color: #6b7280; text-transform: uppercase; letter-spacing: .5px; }
252
+ .detail-panel .kv span { font-family: ui-monospace, monospace; font-size: 12px; }
253
+ .detail-panel .via-list { font-family: ui-monospace, monospace; font-size: 11px; color: #4b5563; max-height: 200px; overflow-y: auto; }
254
+ .detail-panel .via-list div { padding: 2px 0; }
255
+
256
+ @page WordSection1 {
257
+ size: 29.7cm 21cm;
258
+ mso-page-orientation: landscape;
259
+ margin: 1cm 1cm 1cm 1cm;
260
+ mso-header-margin: .5cm;
261
+ mso-footer-margin: .5cm;
262
+ mso-paper-source: 0;
263
+ }
264
+ div.WordSection1 { page: WordSection1; }
265
+ body { margin: 0; background: #fff; }
266
+ /* Tables: hard-fit to page width. table-layout:fixed forces Word to honour
267
+ width:100% even when content would naturally be wider. */
268
+ table { mso-table-lspace: 0; mso-table-rspace: 0; width: 100% !important; max-width: 100% !important; table-layout: fixed; font-size: 9pt; }
269
+ th, td { padding: 4px 6px !important; font-size: 9pt; word-break: break-word; overflow-wrap: anywhere; }
270
+ th { font-size: 8pt; }
271
+ tr { page-break-inside: avoid; }
272
+ thead { display: table-header-group; }
273
+ h1, h2, h3, summary { page-break-after: avoid; }
274
+ details.report-section, details.report-subsection { page-break-inside: auto; }
275
+ /* Strip interactive affordances Word can't honour */
276
+ .toolbar, .toc { display: none !important; }
277
+ details > summary { cursor: default; list-style: none; }
278
+ details.report-section > summary h2::before,
279
+ details.report-subsection > summary h3::before { content: "" !important; display: none !important; }
280
+ tr.cve-row td:first-child::before { content: "" !important; display: none !important; }
281
+ tr.cve-row, tr.cve-row.open { background: #fff !important; cursor: default; }
282
+ /* Detail rows always shown (no JS toggling in Word) */
283
+ tr.detail-row { display: table-row !important; }
284
+ /* Remove shadows / sticky / hover effects that confuse Word */
285
+ .report-header, .exec-summary, .summary .card, .warnings { box-shadow: none !important; }
286
+ .fix-recipe code { white-space: pre-wrap; word-break: break-word; overflow-x: visible; font-size: 8pt; }
287
+ /* Long URLs and coordinates: wrap instead of overflow */
288
+ td.cve, td.dep, .via, .ref-list li, .defined-in code { word-break: break-word; overflow-wrap: anywhere; }
289
+ /* Tighter colour palette so Word prints cleanly */
290
+ tr:nth-child(even) { background: #fafafa; }
291
+ /* Detail panel: shrink so expanded CVE blocks don't dominate the page */
292
+ .detail-panel { padding: 8px 12px; font-size: 9pt; }
293
+ .detail-panel .full-desc { font-size: 9pt; line-height: 1.4; }
294
+ </style>
295
+ </head>
296
+ <body><div class="WordSection1">
297
+ <header class="report-header">
298
+ <h1>FAD-Checker Report</h1>
299
+ <div class="report-subtitle">Multi-ecosystem dependency security audit</div>
300
+ <div class="meta">
301
+ Project: <strong>emb</strong> · <code class="path">/tmp/emb</code><br>
302
+ Generated: 2026-06-01T11:50:17.518Z · fad-checker 2.0.2 · CVE data: 2026-06-01T09:36:42.393Z
303
+ </div>
304
+ </header>
305
+ <div class="exec-summary exec-medium">
306
+ <div class="exec-head">
307
+ <span class="exec-level">MEDIUM</span>
308
+ <span class="exec-title">Executive Summary</span>
309
+
310
+ </div>
311
+ <div class="exec-meta">3 dependencies scanned</div>
312
+ <ul class="exec-bullets">
313
+ <li><strong>2</strong> CVE in production deps (critical=0, high=0, medium=1, low=1)</li><li><strong>1</strong> scan-completeness alert — see chapter 0</li>
314
+ </ul>
315
+
316
+ </div>
317
+ <div class="summary"><div class="card sev-critical"><div class="v">0</div><div class="l">Critical</div></div><div class="card sev-high"><div class="v">0</div><div class="l">High</div></div><div class="card sev-medium"><div class="v">1</div><div class="l">Medium</div></div><div class="card sev-low"><div class="v">1</div><div class="l">Low</div></div><div class="card"><div class="v">2</div><div class="l">Total CVEs</div></div><div class="card"><div class="v">2</div><div class="l">in Direct</div></div><div class="card"><div class="v">0</div><div class="l">in Transitive</div></div><div class="card sev-vendored"><div class="v">0</div><div class="l">Vendored JS</div></div><div class="card"><div class="v">0</div><div class="l">EOL</div></div><div class="card"><div class="v">0</div><div class="l">Obsolete</div></div><div class="card"><div class="v">0</div><div class="l">Outdated</div></div><div class="card sev-warn"><div class="v">1</div><div class="l">Scan alerts</div></div></div>
318
+ <nav class="toc"><a href="#ch0">0. Warnings</a><a href="#ch1">1. Prod CVE (2)</a><a href="#ch1e">1B. Embedded (3)</a><a href="#ch2">2. Vendored JS (0)</a><a href="#ch3">3. Dev CVE (0)</a><a href="#ch4">4. EOL (0)</a><a href="#ch5">5. Obsolete (0)</a><a href="#ch6">6. Outdated (0)</a><a href="#ch7">7. Licenses (0)</a><a href="#ch8">8. Fix Recos</a></nav>
319
+
320
+
321
+ <details class="report-section" open id="ch0">
322
+ <summary><h2>0. Warnings & scan-completeness (1)</h2></summary>
323
+ <div><div class="warnings warnings-chapter"><div class="warn-block warn-embedded-jar">
324
+ <div class="warn-head">⚠️ <strong>embedded-jar</strong></div>
325
+
326
+ <div class="warn-msg">embedded archive with no resolvable Maven coordinate (not scanned): dist/app.jar!/BOOT-INF/lib/mystery.jar</div>
327
+
328
+ </div></div></div>
329
+ </details>
330
+ <details class="report-section" open id="ch1">
331
+ <summary><h2>1. CVE Vulnerabilities — production (2)</h2></summary>
332
+ <div><details class="report-subsection" open>
333
+ <summary><h3>1.a Maven (2)</h3></summary>
334
+ <div><details class="report-subsection" open>
335
+ <summary><h3>1.a.0 All (2)</h3></summary>
336
+ <div><details class="report-subsection" open>
337
+ <summary><h3>All — direct (2)</h3></summary>
338
+ <div><table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed"><colgroup><col style="width:9%"><col style="width:7%"><col style="width:9%"><col style="width:14%"><col style="width:9%"><col style="width:6%"><col style="width:22%"><col style="width:10%"><col style="width:14%"></colgroup><thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
339
+ <tbody><tr class="cve-row open">
340
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
341
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">5.5</div></td>
342
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2023-2976" target="_blank">CVE-2023-2976</a><div class="confidence">probable</div></td>
343
+ <td class="dep">com.google.guava:<br>guava<br><span style="color:#6b7280">30.0-jre</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code></div></td>
344
+ <td class="cwe"><span class="cwe-empty">—</span></td>
345
+ <td class="published">—</td>
346
+ <td class="desc">Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the defaul…</td>
347
+ <td class="dep">32.0.0</td>
348
+ <td><span class="source fad">fad</span></td>
349
+
350
+ </tr>
351
+ <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
352
+ <div class="panel-title">Description</div>
353
+ <div><div class="full-desc">Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
354
+
355
+ Even though the security vulnerability is fixed in version 32.0.0, we recommend…</div></div>
356
+ </div><div class="panel-block">
357
+ <div class="panel-title">Metadata</div>
358
+ <div><div class="kv"><div><label>Base score</label><span>5.5 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 55/100</span></div><div><label>Fix version</label><span>32.0.0</span></div><div><label>Match confidence</label><span>probable</span></div><div><label>Sources</label><span>fad</span></div></div></div>
359
+ </div><div class="panel-block">
360
+ <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
361
+ <div><div class="via-list"><div>pom.xml</div></div></div>
362
+ </div></div></td></tr>
363
+ <tr class="cve-row open">
364
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#2563eb;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">LOW</span></td>
365
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#3b82f6;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">LOW</span><div class="confidence">3.3</div></td>
366
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2020-8908" target="_blank">CVE-2020-8908</a><div class="confidence">probable</div></td>
367
+ <td class="dep">com.google.guava:<br>guava<br><span style="color:#6b7280">30.0-jre</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code></div></td>
368
+ <td class="cwe"><span class="cwe-empty">—</span></td>
369
+ <td class="published">—</td>
370
+ <td class="desc">A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir()…</td>
371
+ <td class="dep">32.0</td>
372
+ <td><span class="source fad">fad</span></td>
373
+
374
+ </tr>
375
+ <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
376
+ <div class="panel-title">Description</div>
377
+ <div><div class="full-desc">A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been…</div></div>
378
+ </div><div class="panel-block">
379
+ <div class="panel-title">Metadata</div>
380
+ <div><div class="kv"><div><label>Base score</label><span>3.3 (LOW)</span></div><div><label>Priority</label><span>LOW · 33/100</span></div><div><label>Fix version</label><span>32.0</span></div><div><label>Match confidence</label><span>probable</span></div><div><label>Sources</label><span>fad</span></div></div></div>
381
+ </div><div class="panel-block">
382
+ <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
383
+ <div><div class="via-list"><div>pom.xml</div></div></div>
384
+ </div></div></td></tr></tbody>
385
+ </table></div>
386
+ </details><details class="report-subsection" open>
387
+ <summary><h3>All — transitive (0)</h3></summary>
388
+ <div><div class="empty">No CVEs matched.</div></div>
389
+ </details></div>
390
+ </details><details class="report-subsection" open>
391
+ <summary><h3>By pom.xml (1 file)</h3></summary>
392
+ <div><details class="report-subsection" open>
393
+ <summary><h3><code class="path">pom.xml</code> (2)</h3></summary>
394
+ <div><table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed"><colgroup><col style="width:9%"><col style="width:7%"><col style="width:9%"><col style="width:14%"><col style="width:9%"><col style="width:6%"><col style="width:22%"><col style="width:10%"><col style="width:14%"></colgroup><thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
395
+ <tbody><tr class="cve-row open">
396
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
397
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">5.5</div></td>
398
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2023-2976" target="_blank">CVE-2023-2976</a><div class="confidence">probable</div></td>
399
+ <td class="dep">com.google.guava:<br>guava<br><span style="color:#6b7280">30.0-jre</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code></div></td>
400
+ <td class="cwe"><span class="cwe-empty">—</span></td>
401
+ <td class="published">—</td>
402
+ <td class="desc">Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the defaul…</td>
403
+ <td class="dep">32.0.0</td>
404
+ <td><span class="source fad">fad</span></td>
405
+
406
+ </tr>
407
+ <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
408
+ <div class="panel-title">Description</div>
409
+ <div><div class="full-desc">Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
410
+
411
+ Even though the security vulnerability is fixed in version 32.0.0, we recommend…</div></div>
412
+ </div><div class="panel-block">
413
+ <div class="panel-title">Metadata</div>
414
+ <div><div class="kv"><div><label>Base score</label><span>5.5 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 55/100</span></div><div><label>Fix version</label><span>32.0.0</span></div><div><label>Match confidence</label><span>probable</span></div><div><label>Sources</label><span>fad</span></div></div></div>
415
+ </div><div class="panel-block">
416
+ <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
417
+ <div><div class="via-list"><div>pom.xml</div></div></div>
418
+ </div></div></td></tr>
419
+ <tr class="cve-row open">
420
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#2563eb;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">LOW</span></td>
421
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#3b82f6;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">LOW</span><div class="confidence">3.3</div></td>
422
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2020-8908" target="_blank">CVE-2020-8908</a><div class="confidence">probable</div></td>
423
+ <td class="dep">com.google.guava:<br>guava<br><span style="color:#6b7280">30.0-jre</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code></div></td>
424
+ <td class="cwe"><span class="cwe-empty">—</span></td>
425
+ <td class="published">—</td>
426
+ <td class="desc">A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir()…</td>
427
+ <td class="dep">32.0</td>
428
+ <td><span class="source fad">fad</span></td>
429
+
430
+ </tr>
431
+ <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
432
+ <div class="panel-title">Description</div>
433
+ <div><div class="full-desc">A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been…</div></div>
434
+ </div><div class="panel-block">
435
+ <div class="panel-title">Metadata</div>
436
+ <div><div class="kv"><div><label>Base score</label><span>3.3 (LOW)</span></div><div><label>Priority</label><span>LOW · 33/100</span></div><div><label>Fix version</label><span>32.0</span></div><div><label>Match confidence</label><span>probable</span></div><div><label>Sources</label><span>fad</span></div></div></div>
437
+ </div><div class="panel-block">
438
+ <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
439
+ <div><div class="via-list"><div>pom.xml</div></div></div>
440
+ </div></div></td></tr></tbody>
441
+ </table></div>
442
+ </details></div>
443
+ </details></div>
444
+ </details></div>
445
+ </details>
446
+ <details class="report-section" open id="ch1e">
447
+ <summary><h2>1B. Embedded binaries — JAR/WAR/EAR (3)</h2></summary>
448
+ <div><div class="fp-intro">Maven coordinates discovered inside committed <code>.jar</code>/<code>.war</code>/<code>.ear</code> binaries (vendored libs, fat-jars) — not declared in any <code>pom.xml</code>. Patch by rebuilding/replacing the containing archive.</div><div class="eco-block"><h3 class="eco-h">📦 dist/app.jar <span class="eco-count">(3)</span></h3><table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed"><colgroup><col style="width:9%"><col style="width:7%"><col style="width:9%"><col style="width:14%"><col style="width:9%"><col style="width:6%"><col style="width:22%"><col style="width:10%"><col style="width:14%"></colgroup><thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
449
+ <tbody><tr class="cve-row open">
450
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
451
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
452
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68161" target="_blank">CVE-2025-68161</a><div class="confidence">exact</div></td>
453
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</code></div></td>
454
+ <td class="cwe"><span class="cwe-empty">—</span></td>
455
+ <td class="published">—</td>
456
+ <td class="desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#…</td>
457
+ <td class="dep">2.25.3</td>
458
+ <td><span class="source fad">fad</span></td>
459
+
460
+ </tr>
461
+ <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
462
+ <div class="panel-title">Description</div>
463
+ <div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html…</div></div>
464
+ </div><div class="panel-block">
465
+ <div class="panel-title">Metadata</div>
466
+ <div><div class="kv"><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad</span></div></div></div>
467
+ </div><div class="panel-block">
468
+ <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
469
+ <div><div class="via-list"><div>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</div></div></div>
470
+ </div></div></td></tr>
471
+ <tr class="cve-row open">
472
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 11%</div></td>
473
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.9</div></td>
474
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34480" target="_blank">CVE-2026-34480</a><div class="confidence">exact</div></td>
475
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</code></div></td>
476
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-116: Improper Encoding or Escaping of Output">CWE-116</a><div class="cwe-name">Improper Encoding or Escaping of Output</div></td>
477
+ <td class="published">2026-04-10</td>
478
+ <td class="desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#char…</td>
479
+ <td class="dep">2.25.4</td>
480
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
481
+
482
+ </tr>
483
+ <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
484
+ <div class="panel-title">Description</div>
485
+ <div><div class="full-desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
486
+
487
+ The impact depends on the StAX implementation in use:
488
+
489
+ * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
490
+ * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
491
+
492
+
493
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.</div></div>
494
+ </div><div class="panel-block">
495
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(1)</span></div>
496
+ <div><ul class="cwe-list"><li>
497
+ <a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link">CWE-116</a>
498
+ <span class="cwe-name-inline">— Improper Encoding or Escaping of Output</span>
499
+ </li></ul></div>
500
+ </div><div class="panel-block">
501
+ <div class="panel-title">Metadata</div>
502
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.9 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 57.3/100</span></div><div><label>EPSS</label><span>0.0% prob · 11th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-04-24</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
503
+ </div><div class="panel-block">
504
+ <div class="panel-title">External links <span class="count">(6)</span></div>
505
+ <div><div class="ref-group">
506
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
507
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4077" target="_blank">https://github.com/apache/logging-log4j2/pull/4077</a></li></ul>
508
+ </div><div class="ref-group">
509
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
510
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb" target="_blank">https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34480" target="_blank">https://logging.apache.org/security.html#CVE-2026-34480</a></li></ul>
511
+ </div><div class="ref-group">
512
+ <span class="ref-label third-party">Third-party advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
513
+ <ul class="ref-list"><li><a href="http://www.openwall.com/lists/oss-security/2026/04/10/9" target="_blank">http://www.openwall.com/lists/oss-security/2026/04/10/9</a></li></ul>
514
+ </div><div class="ref-group">
515
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
516
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout" target="_blank">https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout</a></li></ul>
517
+ </div></div>
518
+ </div><div class="panel-block">
519
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
520
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
521
+ </div><div class="panel-block">
522
+ <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
523
+ <div><div class="via-list"><div>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</div></div></div>
524
+ </div></div></td></tr>
525
+ <tr class="cve-row open">
526
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 12%</div></td>
527
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
528
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34477" target="_blank">CVE-2026-34477</a><div class="confidence">exact</div></td>
529
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</code></div></td>
530
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
531
+ <td class="published">2026-04-10</td>
532
+ <td class="desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systempr…</td>
533
+ <td class="dep">2.25.4</td>
534
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
535
+
536
+ </tr>
537
+ <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
538
+ <div class="panel-title">Description</div>
539
+ <div><div class="full-desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the &lt;Ssl&gt; element.
540
+
541
+ Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
542
+
543
+ A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
544
+
545
+ * An SMTP, Socket, or Syslog appender is in use.
546
+ * TLS is configured via a nested &lt;Ssl&gt; element.
547
+ * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
548
+ This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
549
+
550
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.</div></div>
551
+ </div><div class="panel-block">
552
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
553
+ <div><ul class="cwe-list"><li>
554
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
555
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
556
+ </li><li>
557
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
558
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
559
+ </li></ul></div>
560
+ </div><div class="panel-block">
561
+ <div class="panel-title">Metadata</div>
562
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 52.8/100</span></div><div><label>EPSS</label><span>0.0% prob · 12th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-05-06</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
563
+ </div><div class="panel-block">
564
+ <div class="panel-title">External links <span class="count">(5)</span></div>
565
+ <div><div class="ref-group">
566
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
567
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4075" target="_blank">https://github.com/apache/logging-log4j2/pull/4075</a></li></ul>
568
+ </div><div class="ref-group">
569
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
570
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34477" target="_blank">https://logging.apache.org/security.html#CVE-2026-34477</a></li></ul>
571
+ </div><div class="ref-group">
572
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">1 link</span>
573
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4" target="_blank">https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4</a></li></ul>
574
+ </div><div class="ref-group">
575
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">1 link</span>
576
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li></ul>
577
+ </div></div>
578
+ </div><div class="panel-block">
579
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
580
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
581
+ </div><div class="panel-block">
582
+ <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
583
+ <div><div class="via-list"><div>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</div></div></div>
584
+ </div></div></td></tr></tbody>
585
+ </table></div></div>
586
+ </details>
587
+ <details class="report-section" id="ch2" open>
588
+ <summary><h2>2. Vendored JS scan — retire.js (0)</h2></summary>
589
+ <div><div class="empty">No vulnerable vendored JavaScript files detected (or retire.js was skipped).</div></div>
590
+ </details>
591
+ <details class="report-section" id="ch3" open>
592
+ <summary><h2>3. CVE in dev dependencies (0)</h2></summary>
593
+ <div><div class="empty">No CVE matches.</div></div>
594
+ </details>
595
+ <details class="report-section" open id="ch4">
596
+ <summary><h2>4. End-of-Life Frameworks (0)</h2></summary>
597
+ <div><div class="empty">No end-of-life frameworks detected.</div></div>
598
+ </details>
599
+ <details class="report-section" open id="ch5">
600
+ <summary><h2>5. Obsolete / Deprecated Libraries (0)</h2></summary>
601
+ <div><div class="empty">No obsolete / deprecated libraries detected.</div></div>
602
+ </details>
603
+ <details class="report-section" open id="ch6">
604
+ <summary><h2>6. Outdated Libraries (0)</h2></summary>
605
+ <div><div class="empty">No outdated libraries (or --allLibs not set).</div></div>
606
+ </details>
607
+ <details class="report-section" id="ch7" open>
608
+ <summary><h2>7. Licenses (0)</h2></summary>
609
+ <div><div class="empty">No license data resolved (offline, or registries returned none).</div></div>
610
+ </details>
611
+ <details class="report-section" id="ch8" open>
612
+ <summary><h2>8. Fix Recommendations</h2></summary>
613
+ <div><details class="report-subsection" open>
614
+ <summary><h3>7.0 Direct deps to update (1)</h3></summary>
615
+ <div><div class="fp-intro">Every direct dep with at least one CVE matched. The "Pin to ≥" column shows the highest fix-version declared across the CVEs for that dep. When that's missing, the dep needs a manual triage (no clean fix is published).</div><table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed">
616
+ <thead><tr><th>Worst sev</th><th>Direct dependency</th><th>Current</th><th>Pin to ≥</th><th>Maven Central latest</th><th>CVEs covered</th></tr></thead>
617
+ <tbody><tr>
618
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span></td>
619
+ <td class="dep">com.google.guava:guava</td>
620
+ <td class="dep">30.0-jre</td>
621
+ <td class="dep"><span style="color:#065f46;font-weight:600">32.0.0</span></td>
622
+ <td class="dep"><span style="color:#9ca3af">—</span></td>
623
+ <td class="confidence">2 CVE: CVE-2023-2976, CVE-2020-8908</td>
624
+ </tr></tbody>
625
+ </table></div>
626
+ </details></div>
627
+ </details>
628
+
629
+ </div></body>
630
+ </html>