Issues with monorepo CVE reporting

Open

#5,437 opened on Apr 4, 2025 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 5/5
Estimated time: Over a week
Newbie friendliness: 25/100

Issue type: Feature
Clarity: Needs clarification
Activity status: Stale
Tech stack: python
Domain: security

Research direction

Start by reviewing the linked llama-index monorepo and the referenced GHSA advisory edit. The issue names no repository file, test, or entry point, so first clarify how package attribution should work for monorepos and define completion as advisories no longer flagging unrelated packages.

Written by the indexing model from the issue text.

Description

Hey all!

Recently we've noticed that our python monorepo llama-index was flagged with a CVE (and there is likely more incoming in the future from huntr.com). While this is fine, GHSA seems to be incorrectly flagging our entire llama-index package for CVE's on completely different packages. This creates a lot of false noise for our users.

While I can open a PR to change this like this recently edited advisory I contributed here, it would be exhausting to keep up with this.

Is there a way that GHSA can better flag packages in our monorepo? Or will I have to change each one manually when they open?

Any help would be appreciated!

Dominant language: No language data
Stars: 2.5k
Forks: 772
Avg merge: 3d 15h
Merged PRs (30d): 46

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

OpenVEX statements carry no subcomponent package or version Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

NVIDIA/aicr#2945 · Opened Sep 23, 2026
Signed left-shift undefined behavior in `nbase/nbase_addrset.c` (`(1<<31)`, 4 sites) Open

Nmap

Difficulty 1/5 Under an hour Newbie friendliness 85/100

nmap/nmap#3514 · Opened Sep 23, 2026
CVE-2026-93748 (High) detected in http-cache-semantics-4.1.1.tgz Open

Mend: dependency security vulnerability untriaged

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

opensearch-project/OpenSearch-Dashboards#12806 · Opened Sep 23, 2026
False positive: TurkScan.com / TurkChain network Open

blocklist removal

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

MetaMask/eth-phishing-detect#296544 · Opened Sep 23, 2026
Usage of curl in mcr.microsoft.com/azure-functions/dotnet-isolated:4-dotnet-isolated10.0 Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

Azure/azure-functions-docker#1257 · Opened Sep 23, 2026

More Security issues