Issues

• security: validate repo-configured npm registry URLs against private networks (SSRF)

  bugenhancement
  OWASP/cve-lite-cli#1571 · Filter by author Nachiket-Roy opened on Nov 9, 2026
  1

• security: sanitize package names and summaries in stdout against workflow command injection

  bug
  OWASP/cve-lite-cli#1570 · Filter by author Nachiket-Roy opened on Nov 9, 2026
  1

• fix: wrap package names in backticks in PR summaries to prevent account mentions

  bugci
  OWASP/cve-lite-cli#1569 · Filter by author Nachiket-Roy opened on Nov 9, 2026
  1

• security: disable SQLite trusted_schema in LocalAdvisoryDatabase

  bugenhancement
  OWASP/cve-lite-cli#1567 · Filter by author Nachiket-Roy opened on Nov 9, 2026

• OA010 message repeats a version once per advisory

  buggood first issue
  OWASP/cve-lite-cli#1560 · Filter by author sonukapoor opened on Nov 8, 2026

• [Bug]--fail-on passes silently when OSV advisory details can't be resolved

  bugci
  OWASP/cve-lite-cli#1557 · Filter by author Nachiket-Roy opened on Nov 8, 2026
  5

• [Feature] Advisory DB metadata in both SBOM formats

  enhancement
  OWASP/cve-lite-cli#1554 · Filter by author Nachiket-Roy opened on Nov 7, 2026
  1

• fix(overrides): OA010 raiseFloor breaches semver ceiling on 0.x and 0.0.x caret overrides

  bug
  OWASP/cve-lite-cli#1550 · Filter by author muntasir-396 opened on Nov 7, 2026
  4

• fix(overrides): OA009 treats < and <= upper-bound ranges as met floors, falsely removing valid overrides

  bug
  OWASP/cve-lite-cli#1549 · Filter by author muntasir-396 opened on Nov 7, 2026

• Resolve workspace paths for transitive remediation

  bugparser
  OWASP/cve-lite-cli#1548 · Filter by author coderabbitai opened on Nov 6, 2026
  3

• fix(overrides): OA008 ignores npm: alias overrides, missing unmaterialized floors

  bug
  OWASP/cve-lite-cli#1542 · Filter by author muntasir-396 opened on Nov 6, 2026

• fix(yarn): negated workspace patterns are ignored on Yarn Berry

  bughelp wantedparser
  OWASP/cve-lite-cli#1538 · Filter by author sonukapoor opened on Nov 6, 2026
  3

• fix(yarn): Berry fix commands use yarn upgrade, which Berry does not support

  bughelp wanted
  OWASP/cve-lite-cli#1537 · Filter by author sonukapoor opened on Nov 6, 2026
  4

• [Bug] Yarn workspace glob produces unscoped fix command

  bugparser
  OWASP/cve-lite-cli#1531 · Filter by author vianmangal opened on Nov 5, 2026
  1

• [Bug] --report= silently disables HTML report generation

  bug
  OWASP/cve-lite-cli#1523 · Filter by author vianmangal opened on Nov 4, 2026

• [Bug] --report consumes the project path when placed before it

  bug
  OWASP/cve-lite-cli#1522 · Filter by author vianmangal opened on Nov 4, 2026
  1

• fix(cli): an unrecognised --min-severity value is silently accepted and table falls back to critical

  bug
  OWASP/cve-lite-cli#1518 · Filter by author muntasir-396 opened on Nov 4, 2026
  2

• fix(python): a PyPI upgrade target is not checked against other advisories' windows

  bugin-house
  OWASP/cve-lite-cli#1516 · Filter by author sonukapoor opened on Nov 4, 2026
  1

• [Bug] LC001 misses EPL, EUPL, OSL, CDDL and CPL licenses listed in the shipped feature

  bug
  OWASP/cve-lite-cli#1510 · Filter by author vianmangal opened on Nov 4, 2026
  1

• [Bug] --prod-only --check-licenses includes npm dev-only dependencies in license findings

  bugparser
  OWASP/cve-lite-cli#1509 · Filter by author vianmangal opened on Nov 4, 2026
  1

• fix(cli): reject missing or unknown advisories subcommand instead of scanning it as directory

  bug
  OWASP/cve-lite-cli#1501 · Filter by author muntasir-396 opened on Nov 3, 2026
  1

• [Bug] --fix does not guard against option-shaped package names from a lockfile

  bug
  OWASP/cve-lite-cli#1492 · Filter by author S3DFX-CYBER opened on Nov 3, 2026
  1

• test: clear the pre-existing test type errors so the gate can require a clean tree

  documentationenhancement
  OWASP/cve-lite-cli#1491 · Filter by author prx-my opened on Nov 3, 2026
  1

• fix(output): keep stdout report-only in one place and print the gate reason to stderr

  bugenhancementhelp wanted
  OWASP/cve-lite-cli#1465 · Filter by author sonukapoor opened on Nov 1, 2026
  2

• research: Rust (Cargo) support

  help wantedresearch
  OWASP/cve-lite-cli#1464 · Filter by author sonukapoor opened on Nov 1, 2026
  5