[container-image-scan] Container findings for mcp/context7

[github-actions]

Summary

• Image: mcp/context7
• Pinned reference: mcp/context7@sha256:1174e6a29634a83b2be93ac1fefabf63265f498c02c72201fe3464e687dd8836
• Vulnerabilities: 88 total (10 Critical, 78 High)
• License violations: 23

Vulnerabilities

88 vulnerabilities (click to expand)

• Critical: CVE-2025-15467: libcrypto3@3.5.0-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• Critical: CVE-2025-15467: libssl3@3.5.0-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-21710: node@22.16.0 (fix: 20.20.2, 22.22.2, 24.14.1, 25.8.2) ((nvd.nist.gov/redacted)
• High: CVE-2026-45447: libcrypto3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-45447: libssl3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-59465: node@22.16.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
• High: CVE-2025-55131: node@22.16.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
• High: GHSA-5j98-mcp5-4vw2: glob@10.4.5 (fix: 10.5.0) (GHSA-5j98-mcp5-4vw2)
• Critical: CVE-2025-55130: node@22.16.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
• High: CVE-2025-9230: libcrypto3@3.5.0-r0 (fix: 3.5.4-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-9230: libssl3@3.5.0-r0 (fix: 3.5.4-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-31790: libcrypto3@3.5.0-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-31790: libssl3@3.5.0-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-42764: libcrypto3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-42764: libssl3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28388: libcrypto3@3.5.0-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28388: libssl3@3.5.0-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-34183: libcrypto3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-34183: libssl3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28389: libcrypto3@3.5.0-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28389: libssl3@3.5.0-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28390: libcrypto3@3.5.0-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28390: libssl3@3.5.0-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-34180: libcrypto3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-34180: libssl3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-21637: node@22.16.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
• High: CVE-2025-69421: libcrypto3@3.5.0-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-69421: libssl3@3.5.0-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28387: libcrypto3@3.5.0-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28387: libssl3@3.5.0-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: GHSA-j3q9-mxjg-w52f: path-to-regexp@8.2.0 (fix: 8.4.0) (GHSA-j3q9-mxjg-w52f)
• High: CVE-2025-69420: libcrypto3@3.5.0-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-69420: libssl3@3.5.0-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-7383: libcrypto3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-7383: libssl3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-45445: libcrypto3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-45445: libssl3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-59466: node@22.16.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
• High: CVE-2026-9076: libcrypto3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-9076: libssl3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: GHSA-34x7-hfp2-rc4v: tar@6.2.1 (fix: 7.5.7) (GHSA-34x7-hfp2-rc4v)
• High: GHSA-34x7-hfp2-rc4v: tar@7.4.3 (fix: 7.5.7) (GHSA-34x7-hfp2-rc4v)
• High: GHSA-34x7-hfp2-rc4v: tar@7.4.3 (fix: 7.5.7) (GHSA-34x7-hfp2-rc4v)
• High: GHSA-3ppc-4f35-3m26: minimatch@9.0.5 (fix: 9.0.6) (GHSA-3ppc-4f35-3m26)
• High: CVE-2026-56848: node@22.16.0 (fix: 22.23.2, 24.18.1, 26.5.1) ((nvd.nist.gov/redacted)
• High: CVE-2026-56846: node@22.16.0 (fix: 22.23.2, 24.18.1) ((nvd.nist.gov/redacted)
• High: GHSA-w48q-cv73-mx4w: @modelcontextprotocol/sdk@1.12.3 (fix: 1.24.0) (GHSA-w48q-cv73-mx4w)
• High: GHSA-7r86-cg39-jmmj: minimatch@9.0.5 (fix: 9.0.7) (GHSA-7r86-cg39-jmmj)
• Critical: GHSA-23hp-3jrh-7fpw: tar@6.2.1 (fix: 7.5.19) (GHSA-23hp-3jrh-7fpw)
• Critical: GHSA-23hp-3jrh-7fpw: tar@7.4.3 (fix: 7.5.19) (GHSA-23hp-3jrh-7fpw)
• Critical: GHSA-23hp-3jrh-7fpw: tar@7.4.3 (fix: 7.5.19) (GHSA-23hp-3jrh-7fpw)
• High: GHSA-23c5-xmqv-rm74: minimatch@9.0.5 (fix: 9.0.7) (GHSA-23c5-xmqv-rm74)
• High: CVE-2025-69419: libcrypto3@3.5.0-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-69419: libssl3@3.5.0-r0 (fix: 3.5.5-r0) ((security.alpinelinux.org/redacted)
• High: GHSA-8r9q-7v3j-jr4g: @modelcontextprotocol/sdk@1.12.3 (fix: 1.25.2) (GHSA-8r9q-7v3j-jr4g)
• High: GHSA-8x88-c5mf-7j5w: tar@6.2.1 (fix: 7.5.18) (GHSA-8x88-c5mf-7j5w)
• High: GHSA-8x88-c5mf-7j5w: tar@7.4.3 (fix: 7.5.18) (GHSA-8x88-c5mf-7j5w)
• High: GHSA-8x88-c5mf-7j5w: tar@7.4.3 (fix: 7.5.18) (GHSA-8x88-c5mf-7j5w)
• High: GHSA-qffp-2rhf-9h96: tar@6.2.1 (fix: 7.5.10) (GHSA-qffp-2rhf-9h96)
• High: GHSA-qffp-2rhf-9h96: tar@7.4.3 (fix: 7.5.10) (GHSA-qffp-2rhf-9h96)
• High: GHSA-qffp-2rhf-9h96: tar@7.4.3 (fix: 7.5.10) (GHSA-qffp-2rhf-9h96)
• Critical: CVE-2026-34182: libcrypto3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• Critical: CVE-2026-34182: libssl3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: GHSA-rgw5-rvv9-x895: brace-expansion@2.0.1 (fix: 2.1.4) (GHSA-rgw5-rvv9-x895)
• High: GHSA-8qq5-rm4j-mr97: tar@6.2.1 (fix: 7.5.3) (GHSA-8qq5-rm4j-mr97)
• High: GHSA-8qq5-rm4j-mr97: tar@7.4.3 (fix: 7.5.3) (GHSA-8qq5-rm4j-mr97)
• High: GHSA-8qq5-rm4j-mr97: tar@7.4.3 (fix: 7.5.3) (GHSA-8qq5-rm4j-mr97)
• High: GHSA-mh99-v99m-4gvg: brace-expansion@2.0.1 (fix: 2.1.3) (GHSA-mh99-v99m-4gvg)
• High: GHSA-3jxr-9vmj-r5cp: brace-expansion@2.0.1 (fix: 2.1.2) (GHSA-3jxr-9vmj-r5cp)
• Critical: CVE-2026-31789: libcrypto3@3.5.0-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• Critical: CVE-2026-31789: libssl3@3.5.0-r0 (fix: 3.5.6-r0) ((security.alpinelinux.org/redacted)
• High: GHSA-mwp4-54f8-5fhr: ip-address@9.0.5 (fix: 10.3.1) (GHSA-mwp4-54f8-5fhr)
• High: GHSA-83g3-92jg-28cx: tar@6.2.1 (fix: 7.5.8) (GHSA-83g3-92jg-28cx)
• High: GHSA-83g3-92jg-28cx: tar@7.4.3 (fix: 7.5.8) (GHSA-83g3-92jg-28cx)
• High: GHSA-83g3-92jg-28cx: tar@7.4.3 (fix: 7.5.8) (GHSA-83g3-92jg-28cx)
• High: GHSA-9ppj-qmqm-q256: tar@6.2.1 (fix: 7.5.11) (GHSA-9ppj-qmqm-q256)
• High: GHSA-9ppj-qmqm-q256: tar@7.4.3 (fix: 7.5.11) (GHSA-9ppj-qmqm-q256)
• High: GHSA-9ppj-qmqm-q256: tar@7.4.3 (fix: 7.5.11) (GHSA-9ppj-qmqm-q256)
• High: GHSA-345p-7cg4-v4c7: @modelcontextprotocol/sdk@1.12.3 (fix: 1.26.0) (GHSA-345p-7cg4-v4c7)
• High: GHSA-r6q2-hw4h-h46w: tar@6.2.1 (fix: 7.5.4) (GHSA-r6q2-hw4h-h46w)
• High: GHSA-r6q2-hw4h-h46w: tar@7.4.3 (fix: 7.5.4) (GHSA-r6q2-hw4h-h46w)
• High: GHSA-r6q2-hw4h-h46w: tar@7.4.3 (fix: 7.5.4) (GHSA-r6q2-hw4h-h46w)
• High: CVE-2026-34181: libcrypto3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-34181: libssl3@3.5.0-r0 (fix: 3.5.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-40200: musl@1.2.5-r10 (fix: 1.2.5-r12) ((security.alpinelinux.org/redacted)
• High: CVE-2026-40200: musl-utils@1.2.5-r10 (fix: 1.2.5-r12) ((security.alpinelinux.org/redacted)
• High: GHSA-52v5-jr5w-gjxr: sigstore@3.0.0 (fix: 4.1.1) (GHSA-52v5-jr5w-gjxr)
• High: CVE-2026-58043: node@22.16.0 (fix: 22.23.2, 24.18.1, 26.5.1) ((nvd.nist.gov/redacted)

Licenses

23 license policy violations (click to expand)

• musl-utils@1.2.5-r10 (GPL-2.0-or-later)
• alpine-baselayout-data@3.7.0-r0 (GPL-2.0-only)
• ssl_client@1.37.0-r18 (GPL-2.0-only)
• libgcc@14.2.0-r6 (GPL-2.0-or-later, LGPL-2.1-or-later)
• busybox@1.37.0-r18 (GPL-2.0-only)
• libapk2@2.14.9-r2 (GPL-2.0-only)
• qrcode-terminal@0.12.0 (Apache 2.0)
• scanelf@1.3.8-r1 (GPL-2.0-only)
• npm@10.9.2 (Artistic-2.0)
• chownr@3.0.0 (BlueOak-1.0.0)
• ca-certificates-bundle@20241121-r2 (MPL-2.0)
• package-json-from-dist@1.0.1 (BlueOak-1.0.0)
• spdx-license-ids@3.0.20 (CC0-1.0)
• zlib@1.3.1-r2 (Zlib)
• spdx-exceptions@2.5.0 (CC-BY-3.0)
• yallist@5.0.0 (BlueOak-1.0.0)
• apk-tools@2.14.9-r2 (GPL-2.0-only)
• libstdc++@14.2.0-r6 (GPL-2.0-or-later, LGPL-2.1-or-later)
• busybox-binsh@1.37.0-r18 (GPL-2.0-only)
• path-scurry@1.11.1 (BlueOak-1.0.0)
• jackspeak@3.4.3 (BlueOak-1.0.0)
• alpine-baselayout@3.7.0-r0 (GPL-2.0-only)
• node@22.16.0 (no licenses found)

Remediation

• Rebase on a patched base OS image to resolve the Critical severity CVEs affecting core system libraries (see list above for exact packages/CVEs).
• Upgrade all affected packages/dependencies to their listed fixed versions to address the remaining High-severity findings.
• Review the flagged license violations against project license policy.

Generated by 🛡️ Daily Container Image Security Scan · auto · 445.4 AIC · ⌖ 18.1 AIC · ⊞ 6.5K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.41 AIC · ⌖ 4.21 AIC · ⊞ 11.6K · ◷