OA010 message repeats a version once per advisory
Maintainers usually reply within 2 days
@HarshRajSinghania is already working on this.
Since Nov 8, 2026.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Stale
- Tech stack
- typescript
- Domain
- security
Research direction
Read src/overrides/detectors/oa010-vulnerable-floor.ts, especially how vulnerableVersions and versionList are built. Add a case with two advisories hitting the same version in tests/overrides/detectors/oa010.test.ts and verify the version appears once while remaining sorted with compareVersions. Confirm the finding’s severity, advisory IDs, and suggested range are unchanged; linked pull requests #1561 and #1562 indicate work is already underway.
Written by the indexing model from the issue text.
Description
What happens
When several advisories affect the same version, OA010's message lists that version once per advisory. On examples/ghost:
axios is floored to ..., which admits 1.15.2, 1.15.2, 1.15.2, ...
The finding itself is correct; only the message repeats.
Why
In src/overrides/detectors/oa010-vulnerable-floor.ts, versionList is built from hits, which has one entry per advisory and version pair. The detector already builds a de-duplicated vulnerableVersions set a few lines above it.
Done when
- Each vulnerable version appears once in the OA010 message, still sorted with
compareVersions. - A test in
tests/overrides/detectors/oa010.test.tswith two advisories hitting the same version fails on main and passes with the fix. - Nothing else in the finding changes (severity, advisory IDs, suggested range).
Note: #1552 is open and edits the same detector, so expect a small rebase if it lands first.
- Dominant language
- TypeScript
- Stars
- 786
- Forks
- 189
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 98
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OWASP/cve-lite-cli
-
[Bug] --rule silently accepts unrecognised or lowercase rule IDs, masking override findings and exiting 0Possibly taken @coder-Yash886 claimed this 2 days ago. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OWASP/cve-lite-cli#1536 · 1 comment ·
Maintainers usually reply within 2 days
-
[Bug] --base accepts another flag as its branch name and drops --offlinePossibly taken @vianmangal claimed this 12 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OWASP/cve-lite-cli#1430 · 1 comment · 1 reaction ·
Maintainers usually reply within 2 days
-
CVE Lite CLI — Public Adoption TrackerMay be free again @Darshan3690 claimed this 13 days ago, and no pull request is open. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
OWASP/cve-lite-cli#1396 · 2 comments ·
Maintainers usually reply within 2 days
-
chore: fix TypeScript code quality violations from May 2026 auditPossibly taken @dyk1454683243-sudo claimed this 50 days ago. Openenhancement good first issue help wanted refactor
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
OWASP/cve-lite-cli#420 · 21 comments ·
Maintainers usually reply within 2 days
-
[Bug]--fail-on passes silently when OSV advisory details can't be resolvedPossibly taken @Nachiket-Roy claimed this today. Openbug ci
Difficulty 4/5 3-5 days Newbie friendliness 30/100
OWASP/cve-lite-cli#1557 · 5 comments · 1 reaction ·
Maintainers usually reply within 2 days
All issues in OWASP/cve-lite-cli
Similar issues
-
clawsweeper:needs-maintainer-review clawsweeper:needs-product-decision clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:ux-friction issue-rating: 🦞 diamond lobster P2
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
openclaw/openclaw#195577 · 1 comment · 1 reaction ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
EKKOLearnAI/ekko-studio#3729 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
Supportseal/SupportSeal-app#98 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
eliasstravik/herdr-projects#845 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
cloudflare/skills#279 ·
Maintainers usually reply within 1 day