Repository navigation
Open source code package in a code repository causing multiple Critical/High exploitable vulnerabilities #11
Description
Activity
Opened #14 (partial). It is a lockfile-only refresh:
universal-github-app-jwt1.1.0→1.2.0, which is already allowed by the existing range, bringsjsonwebtoken8.5.1→9.0.3 andjws3.2.2→4.0.1. That clears every high-severity runtime advisoryyarn auditreports, including CVE-2022-23539, CVE-2025-65945 and CVE-2022-25883. The Wiz body doesn't name the package it flags (Wiz posture issue29ccf336-…), so this issue stays open until the Wiz rescan confirms it. Moderate@octokit/*anduuidadvisories still need major bumps and remain open. CI: Test is red only at the pre-existing README prettier check, and Wiz Vulnerability Scanner is still red.
🔐 Security Remediation Task: Open source code package in a code repository causing multiple Critical/High exploitable vulnerabilities
stroeer/github-app-token/maingithub.com##stroeer/github-app-token##mainFinding
The following code branch contains an open source code package which is responsible for multiple Critical/ High vulnerabilities in code. Please review the relevant file path and relevant package for an update to resolve the vulnerabilities.
Code vulnerabilities with this severity should be addressed in the specific SLA below
🤖 Green Agent
View Wiz Issue
Wiz Issue ID: 29ccf336-36e1-4d5e-ba34-ce958b0c3f94
Source Workflow: Wiz Issues → GitHub (Green Agent)