[container-image-scan] Container findings for mcp/ast-grep:latest

[github-actions]

Summary

• Image: mcp/ast-grep:latest
• Pinned reference: mcp/ast-grep:latest@sha256:5fc3f2e9dcf2c019e92662f608b8d89e12134ed6d91e6f5461de6efd506a1e72
• Vulnerabilities: 44 total (6 Critical, 38 High)
• License violations: 168

Vulnerabilities

44 vulnerabilities (click to expand)

• Critical: CVE-2025-15467: libcrypto3@3.5.1-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• Critical: CVE-2025-15467: libssl3@3.5.1-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-45447: libcrypto3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-45447: libssl3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-9230: libcrypto3@3.5.1-r0 (fix: 3.5.4-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-9230: libssl3@3.5.1-r0 (fix: 3.5.4-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-31790: libcrypto3@3.5.1-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-31790: libssl3@3.5.1-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-42764: libcrypto3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-42764: libssl3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28388: libcrypto3@3.5.1-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28388: libssl3@3.5.1-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-34183: libcrypto3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-34183: libssl3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28389: libcrypto3@3.5.1-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28389: libssl3@3.5.1-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28390: libcrypto3@3.5.1-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28390: libssl3@3.5.1-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-34180: libcrypto3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-34180: libssl3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-69421: libcrypto3@3.5.1-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-69421: libssl3@3.5.1-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28387: libcrypto3@3.5.1-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28387: libssl3@3.5.1-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-69420: libcrypto3@3.5.1-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-69420: libssl3@3.5.1-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• High: GO-2026-4601: stdlib@go1.25.1 (fix: 1.25.8, 1.26.1) (https://go.dev/cl/752180)
• High: CVE-2026-7383: libcrypto3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-7383: libssl3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-45445: libcrypto3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-45445: libssl3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-9076: libcrypto3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-9076: libssl3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: GO-2026-4971: stdlib@go1.25.1 (fix: 1.25.10, 1.26.3) (https://go.dev/issue/79006)
• High: CVE-2025-69419: libcrypto3@3.5.1-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-69419: libssl3@3.5.1-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• Critical: CVE-2026-34182: libcrypto3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• Critical: CVE-2026-34182: libssl3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• Critical: CVE-2026-31789: libcrypto3@3.5.1-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• Critical: CVE-2026-31789: libssl3@3.5.1-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-34181: libcrypto3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-34181: libssl3@3.5.1-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-40200: musl@1.2.5-r10 (fix: 1.2.5-r12) ((security.alpinelinux.org/redacted)
• High: CVE-2026-40200: musl-utils@1.2.5-r10 (fix: 1.2.5-r12) ((security.alpinelinux.org/redacted)

Licenses

168 license policy violations (click to expand)

• anstream@0.6.14 (no licenses found)
• anstyle@1.0.8 (no licenses found)
• futures-sink@0.3.30 (no licenses found)
• futures-util@0.3.30 (no licenses found)
• rustix@0.38.37 (no licenses found)
• tree-sitter-bash@0.21.0 (no licenses found)
• wasm-bindgen@0.2.92 (no licenses found)
• byteorder@1.5.0 (no licenses found)
• clap_derive@4.5.18 (no licenses found)
• futures-core@0.3.30 (no licenses found)
• libc@0.2.159 (no licenses found)
• mio@0.8.11 (no licenses found)
• once_cell@1.19.0 (no licenses found)
• tower-lsp-macros@0.9.0 (no licenses found)
• colorchoice@1.0.1 (no licenses found)
• futures-io@0.3.30 (no licenses found)
• log@0.4.21 (no licenses found)
• lsp-types@0.94.1 (no licenses found)
• signal-hook-mio@0.2.4 (no licenses found)
• tinyvec_macros@0.1.1 (no licenses found)
• strsim@0.11.1 (no licenses found)
• walkdir@2.5.0 (no licenses found)
• dyn-clone@1.0.17 (no licenses found)
• fxhash@0.2.1 (no licenses found)
• ryu@1.0.18 (no licenses found)
• syn@2.0.61 (no licenses found)
• termcolor@1.4.1 (no licenses found)
• tree-sitter-css@0.21.1 (no licenses found)
• tree-sitter-lua@0.1.0 (no licenses found)
• libapk2@2.14.9-r2 (GPL-2.0-only)
• form_urlencoded@1.2.1 (no licenses found)
• lock_api@0.4.12 (no licenses found)
• parking_lot@0.12.2 (no licenses found)
• signal-hook@0.3.17 (no licenses found)
• bitflags@2.5.0 (no licenses found)
• bstr@1.9.1 (no licenses found)
• itoa@1.0.11 (no licenses found)
• regex@1.11.0 (no licenses found)
• tracing-core@0.1.32 (no licenses found)
• unicode-segmentation@1.11.0 (no licenses found)
• alpine-baselayout@3.7.0-r0 (GPL-2.0-only)
• bit-set@0.8.0 (no licenses found)
• crossterm@0.25.0 (no licenses found)
• pin-utils@0.1.0 (no licenses found)
• tracing@0.1.40 (no licenses found)
• percent-encoding@2.3.1 (no licenses found)
• same-file@1.0.6 (no licenses found)
• tree-sitter-sequel@0.3.5 (no licenses found)
• unicode-bidi@0.3.15 (no licenses found)
• utf8parse@0.2.1 (no licenses found)
• alpine-baselayout-data@3.7.0-r0 (GPL-2.0-only)
• futures-channel@0.3.30 (no licenses found)
• ca-certificates-bundle@20250619-r0 (MPL-2.0)
• anstyle-parse@0.2.4 (no licenses found)
• ast-grep@0.28.1 (no licenses found)
• scopeguard@1.2.0 (no licenses found)
• ast-grep-core@0.28.1 (no licenses found)
• codespan-reporting@0.11.1 (no licenses found)
• crossbeam-deque@0.8.5 (no licenses found)
• fuzzy-matcher@0.3.7 (no licenses found)
• serde_derive@1.0.210 (no licenses found)
• tree-sitter-python@0.21.0 (no licenses found)
• zlib@1.3.1-r2 (Zlib)
• ssl_client@1.37.0-r18 (GPL-2.0-only)
• crossbeam-utils@0.8.19 (no licenses found)
• thread_local@1.1.8 (no licenses found)
• futures-macro@0.3.30 (no licenses found)
• quote@1.0.36 (no licenses found)
• tower@0.4.13 (no licenses found)
• aho-corasick@1.1.3 (no licenses found)
• futures-task@0.3.30 (no licenses found)
• httparse@1.8.0 (no licenses found)
• inquire@0.7.5 (no licenses found)
• tower-layer@0.3.2 (no licenses found)
• tree-sitter-java@0.21.0 (no licenses found)
• anstyle-query@1.0.3 (no licenses found)
• bytes@1.6.0 (no licenses found)
• cfg-if@1.0.0 (no licenses found)
• globset@0.4.15 (no licenses found)
• tree-sitter-go@0.21.2 (no licenses found)
• url@2.5.0 (no licenses found)
• scanelf@1.3.8-r1 (GPL-2.0-only)
• serde_derive_internals@0.29.0 (no licenses found)
• serde_json@1.0.128 (no licenses found)
• similar@2.6.0 (no licenses found)
• tree-sitter-c@0.21.4 (no licenses found)
• async-trait@0.1.80 (no licenses found)
• crossterm@0.28.1 (no licenses found)
• futures@0.3.30 (no licenses found)
• parking_lot_core@0.9.10 (no licenses found)
• regex-automata@0.4.8 (no licenses found)
• crossbeam-epoch@0.9.18 (no licenses found)
• serde_yaml@0.9.34+deprecated (no licenses found)
• wasm-bindgen-shared@0.2.92 (no licenses found)
• auto_impl@1.2.0 (no licenses found)
• clap_complete@4.5.33 (no licenses found)
• tower-lsp@0.20.0 (no licenses found)
• tree-sitter-json@0.21.0 (no licenses found)
• unsafe-libyaml@0.2.11 (no licenses found)
• errno@0.3.8 (no licenses found)
• newline-converter@0.3.0 (no licenses found)
• pin-project-internal@1.1.5 (no licenses found)
• regex-syntax@0.8.5 (no licenses found)
• signal-hook-registry@1.4.2 (no licenses found)
• tower-service@0.3.2 (no licenses found)
• tree-sitter-ruby@0.21.0 (no licenses found)
• ansi_term@0.12.1 (no licenses found)
• anyhow@1.0.89 (no licenses found)
• ast-grep-dynamic@0.28.1 (no licenses found)
• clap@4.5.20 (no licenses found)
• serde_repr@0.1.19 (no licenses found)
• slab@0.4.9 (no licenses found)
• bitflags@1.3.2 (no licenses found)
• tracing-attributes@0.1.27 (no licenses found)
• tree-sitter@0.22.6 (no licenses found)
• tree-sitter-cpp@0.22.3 (no licenses found)
• ast-grep-language@0.28.1 (no licenses found)
• bit-vec@0.8.0 (no licenses found)
• hashbrown@0.14.5 (no licenses found)
• idna@0.5.0 (no licenses found)
• tinyvec@1.6.0 (no licenses found)
• linux-raw-sys@0.4.14 (no licenses found)
• busybox-binsh@1.37.0-r18 (GPL-2.0-only)
• indexmap@2.5.0 (no licenses found)
• pin-project-lite@0.2.14 (no licenses found)
• tree-sitter-html@0.20.4 (no licenses found)
• tree-sitter-rust@0.21.2 (no licenses found)
• tree-sitter-yaml@0.6.1 (no licenses found)
• libgcc@14.2.0-r6 (GPL-2.0-or-later, LGPL-2.1-or-later)
• equivalent@1.0.1 (no licenses found)
• memchr@2.7.2 (no licenses found)
• proc-macro2@1.0.82 (no licenses found)
• tokio@1.40.0 (no licenses found)
• tokio-util@0.7.11 (no licenses found)
• tree-sitter-dart@0.0.4 (no licenses found)
• unicode-ident@1.0.12 (no licenses found)
• ast-grep-config@0.28.1 (no licenses found)
• clap_builder@4.5.20 (no licenses found)
• thiserror-impl@1.0.64 (no licenses found)
• tree-sitter-javascript@0.21.4 (no licenses found)
• tree-sitter-typescript@0.21.2 (no licenses found)
• unicode-width@0.1.12 (no licenses found)
• wasm-bindgen-backend@0.2.92 (no licenses found)
• busybox@1.37.0-r18 (GPL-2.0-only)
• atty@0.2.14 (no licenses found)
• dashmap@6.1.0 (no licenses found)
• ignore@0.4.23 (no licenses found)
• mio@1.0.1 (no licenses found)
• thiserror@1.0.64 (no licenses found)
• tree-sitter-php@0.23.0 (no licenses found)
• clap_lex@0.7.0 (no licenses found)
• dashmap@5.5.3 (no licenses found)
• musl-utils@1.2.5-r10 (GPL-2.0-or-later)
• apk-tools@2.14.9-r2 (GPL-2.0-only)
• serde@1.0.210 (no licenses found)
• unicode-normalization@0.1.23 (no licenses found)
• ast-grep-lsp@0.28.1 (no licenses found)
• bumpalo@3.15.0 (no licenses found)
• heck@0.5.0 (no licenses found)
• pin-project@1.1.5 (no licenses found)
• schemars@0.8.21 (no licenses found)
• schemars_derive@0.8.21 (no licenses found)
• smallvec@1.13.2 (no licenses found)
• wasm-bindgen-macro-support@0.2.92 (no licenses found)
• is_terminal_polyfill@1.70.0 (no licenses found)
• libloading@0.8.5 (no licenses found)
• tree-sitter-facade-sg@0.22.2 (no licenses found)
• wasm-bindgen-macro@0.2.92 (no licenses found)

Remediation

• Rebase on a patched base OS image to resolve the Critical severity CVEs affecting core system libraries (libc/openssl/perl-base or equivalent, per the vulnerability list above).
• Upgrade all affected packages to their listed fixed versions to address the remaining High-severity findings.
• Review flagged GPL/LGPL and other non-permissive licenses against project license policy.

Generated by 🛡️ Daily Container Image Security Scan · auto · 445.4 AIC · ⌖ 18.1 AIC · ⊞ 6.5K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 4.46 AIC · ⌖ 5.04 AIC · ⊞ 11.7K · ◷