Overview
ghcr.io/github/gh-aw-firewall/agent:0.28.1@sha256:5e3f6ee27eeae07195838b97ac4aa2f8aea42a7c55f1c0d3e17d8e88e294ad0d — 5 High vulnerabilities, 211 license policy violations (Ubuntu 22.04 base image packages + npm packages).
Key Metrics
| Severity |
Count |
| Critical |
0 |
| High |
5 |
| Medium/Low/Unknown |
not policy-blocking |
| License violations |
211 |
High severity vulnerabilities (5)
| Severity |
CVE/GHSA |
Package |
Installed |
Fixed |
| High |
GHSA-mwp4-54f8-5fhr |
ip-address |
10.2.0 |
10.3.1 |
| High |
GHSA-rgw5-rvv9-x895 |
brace-expansion |
5.0.7 |
5.0.9 |
| High |
GHSA-mh99-v99m-4gvg |
brace-expansion |
5.0.7 |
5.0.8 |
| High |
GO-2026-5026 |
stdlib (go1.26.5) |
go1.26.5 |
1.25.13, 1.26.6, 1.27.0-rc.3 |
| High |
GO-2026-5942 |
stdlib (go1.26.5) |
go1.26.5 |
1.26.6, 1.27.0-rc.3 |
License policy violations (211 packages)
All 211 flagged packages are standard Ubuntu 22.04 base-image system libraries (e.g. perl-base, php8.1-common, libnftnl11, libpam-modules-bin, openssl, dpkg, libgnutls30, gpg) and a small number of npm packages (minimatch, media-types). Flagged license families include GPL-1.0/2.0/3.0, LGPL-2.0/2.1/3.0, Artistic, BSD variants, and a handful of "no licenses found" / custom entries (libpam-modules-bin, libnfnetlink0, usrmerge, libpam-runtime, libcrypt1, e2fsprogs). No third-party application-level license violations were found; this is inherent to the Ubuntu base image.
Remediation
- Update the
brace-expansion and ip-address npm dependencies to the fixed versions listed above in the agent image's package.json / lockfile.
- Rebuild on a refreshed Go toolchain (
>=1.26.6 or >=1.27.0-rc.3) to close the stdlib CVEs.
- This workflow runs
gh aw compile --force-refresh-container-pins daily; a pin-refresh PR is the default remediation path for the base-image license findings — no action needed unless business requirements demand a distro switch (e.g. Alpine/distroless) to reduce the GPL/LGPL license footprint.
Generated by 🛡️ Daily Container Image Security Scan · auto · 246.3 AIC · ⌖ 6.66 AIC · ⊞ 7.2K · ◷
Overview
ghcr.io/github/gh-aw-firewall/agent:0.28.1@sha256:5e3f6ee27eeae07195838b97ac4aa2f8aea42a7c55f1c0d3e17d8e88e294ad0d— 5 High vulnerabilities, 211 license policy violations (Ubuntu 22.04 base image packages + npm packages).Key Metrics
High severity vulnerabilities (5)
License policy violations (211 packages)
All 211 flagged packages are standard Ubuntu 22.04 base-image system libraries (e.g.
perl-base,php8.1-common,libnftnl11,libpam-modules-bin,openssl,dpkg,libgnutls30,gpg) and a small number of npm packages (minimatch,media-types). Flagged license families include GPL-1.0/2.0/3.0, LGPL-2.0/2.1/3.0, Artistic, BSD variants, and a handful of "no licenses found" / custom entries (libpam-modules-bin,libnfnetlink0,usrmerge,libpam-runtime,libcrypt1,e2fsprogs). No third-party application-level license violations were found; this is inherent to the Ubuntu base image.Remediation
brace-expansionandip-addressnpm dependencies to the fixed versions listed above in the agent image's package.json / lockfile.>=1.26.6or>=1.27.0-rc.3) to close the stdlib CVEs.gh aw compile --force-refresh-container-pinsdaily; a pin-refresh PR is the default remediation path for the base-image license findings — no action needed unless business requirements demand a distro switch (e.g. Alpine/distroless) to reduce the GPL/LGPL license footprint.