🚨 Security: Critical or high vulnerabilities in onchain-mcp container
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 48/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Active
- Tech stack
- docker, javascript, node.js
- Domain
- build-system, devops, security
Research direction
Start with the periodic-security-scan workflow and the Security tab findings for ghcr.io/stacklok/dockyard/npx/onchain-mcp:1.0.6; trace where fast-uri@3.1.5 enters the image and how its dependencies are updated. Done means the listed high vulnerabilities are resolved in the container scan and the build workflow no longer blocks publishing.
Written by the indexing model from the issue text.
Description
🚨 Security Scan Alert
A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.
- Image:
ghcr.io/stacklok/dockyard/npx/onchain-mcp:1.0.6 - Critical vulnerabilities: 0
- High vulnerabilities: 4
Details
See the Security tab for full details.
High Vulnerabilities
- GHSA-5jgf-p345-68v8 in
fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references - GHSA-jqff-g426-hqxp in
fast-uri@3.1.5: fast-uri vulnerable to host confusion via percent-encoded scheme normalization - GHSA-f65p-4m7j-42xc in
fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization - GHSA-fph4-wmhf-6fwf in
fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
Automated security scan from periodic-security-scan workflow
- Dominant language
- Go
- Stars
- 8
- Forks
- 7
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 62
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stacklok/dockyard
-
grype high security
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
grype high security
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
-
grype high security
Difficulty 3/5 1-2 days Newbie friendliness 62/100
-
grype high security
Difficulty 3/5 1-2 days Newbie friendliness 55/100
-
grype high security
Difficulty 3/5 1-2 days Newbie friendliness 50/100
All issues in stacklok/dockyard
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
-
enhancement needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
kind/cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
kubernetes-sigs/kueue#15947 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100