template-finding

SCA Finding: <vuln_id> in <package_name>

Metadata

• **ID**: <finding_id>
• **Type**: sca-vulnerability
• **Package**: <package_name>@<version>
• **Ecosystem**: <ecosystem>
• **Vulnerability ID**: <vuln_id>
• **CVEs**: <cve_list>
• **Severity**: <high|medium|low>
• **Status**: confirmed-exploitable

Location

• **Lockfile**: <relative/path/to/lockfile>
• **Package**: <package_name>@<version>
• **Ecosystem**: <ecosystem>

Vulnerability Summary

<Copy the vulnerability summary from the OSV database. This should be 2-4 sentences describing what the vulnerability is, what it affects, and the potential impact.>

Exploitability Analysis

Usage Context

<Describe where and how this package is used in the codebase>

**Files Using Package**: <count>

• <file1>: <brief description of usage>
• <file2>: <brief description of usage>
• <file3>: <brief description of usage>

**Vulnerable Functions Called**:

• <vulnerable_function> at <file>:<line>
• <vulnerable_function2> at <file>:<line>

Attack Vector

<Describe step-by-step how an attacker could exploit this vulnerability in the context of this application>

**Entry Point**: <where attacker input enters - e.g., HTTP POST /api/endpoint> **Data Flow**: <how attacker data reaches the vulnerable code> **Exploit Payload**: <example of malicious input if applicable> **Impact**: <what the attacker achieves - RCE, data theft, etc.>

Exploitability Assessment

| Factor | Assessment | Evidence | |--------|------------|----------| | Package Used | Yes/No | <Import locations or "Not imported"> | | Vulnerable Function Called | Yes/No | <Call sites or "Function not used"> | | User Input Reaches Vuln | Yes/No | <Data flow description> | | Input Validation | Yes/No | <Validation details or "None"> | | Authentication Required | Yes/No | <Auth requirements - public, user, admin> | | Production Code | Yes/No | <Production/test/dev> | | Mitigations | None/Partial/Full | <Mitigation details if any> |

Severity Justification

**Base CVSS Score**: <base_score> (<cvss_vector_string>) **Contextual Severity**: <high|medium|low> **Adjustment Reasoning**: <Explain why severity was adjusted up or down from base score based on exploitability context>

**Attack Complexity**: <low|medium|high> **Privileges Required**: <none|low|high> **User Interaction**: <none|required> **Scope**: <unchanged|changed>

CVE Details

<For each CVE associated with this vulnerability:>

<CVE-ID>

• **Published**: <publication_date>
• **Modified**: <last_modified_date>
• **CVSS Score**: <cvss_score>
• **Description**: <cve_description>
• **References**:
• <reference_url_1>
• <reference_url_2>

Remediation

Immediate Action

<Specific steps to fix this vulnerability>

1. **Upgrade Package**

   # <ecosystem-specific command to upgrade>
   # Go:
   go get <package>@<fixed_version>
   go mod tidy

   # npm:
   npm install <package>@<fixed_version>

   # Python (poetry):
   poetry add <package>@<fixed_version>

   # Python (pip):
   pip install <package>==<fixed_version>
   pip freeze > requirements.txt

   # Ruby:
   bundle update <package>

   # Rust:
   cargo update <package>

Target version: `<package>@<fixed_version>`

2. **Verify Fix**

   wraith scan <lockfile>

Confirm that the vulnerability no longer appears in scan results.

3. **Test Application**

• <Test area 1 - functionality that uses this package>
• <Test area 2 - integration tests>
• <Test area 3 - end-to-end tests>

Alternative Remediation (if upgrade not possible)

**If breaking changes prevent immediate upgrade:**

• **Option 1: Apply mitigation controls**
• <Specific mitigation - e.g., add input validation wrapper>
• <Configuration change to disable vulnerable feature>

• **Option 2: Use version overrides**
• Go: Add `replace` directive in go.mod
• npm: Add `resolutions` in package.json
• Backport security patch to current version

• **Option 3: Remove dependency**
• If package is not critical, consider removing it
• Replace with alternative package without this vulnerability

Estimated Effort

• **Upgrade**: <hours/days>
• **Testing**: <hours/days>
• **Total**: <hours/days>

References

• OSV Entry: https://osv.dev/vulnerability/<vuln_id>
• <CVE links from aliases>
• <Advisory links from references>
• <Vendor security advisory links>

Code Context

Import Statement

<import statement from codebase showing how package is imported>

Vulnerable Usage

<5-10 lines of code showing the vulnerable function being called>

Data Flow

<Code showing how user input flows to the vulnerable function>

---

*Finding generated by Ghost Security SCA Scanner* *Exploitability confirmed by AI analysis on <timestamp>*