Vulnerable third-party dependency
Why is this an issue?
Using open-source components with known vulnerabilities is a critical security risk identified in the OWASP Top 10. Attackers actively scan for applications using vulnerable libraries and exploit known weaknesses.
Risks include:
Remote code execution
Data breaches
Cross-site scripting
Denial of service
Examples
Example of incorrect package.json (vulnerable dependency):
{
"dependencies": {
"lodash": "4.17.15"
}
}
Example of correct package.json (patched dependency):
{
"dependencies": {
"lodash": "4.17.21"
}
}
Example of incorrect Visualforce (vulnerable library):
<apex:includeScript value="{!URLFOR($Resource.jQuery, 'jquery-1.6.2.min.js')}"/>
Example of correct Visualforce (updated library):
<apex:includeScript value="{!URLFOR($Resource.jQuery, 'jquery-3.7.1.min.js')}"/>
How can I fix violations?
Update the library: Upgrade to a patched version that fixes the vulnerability.
Replace the library: If no patch is available, consider alternative libraries without known vulnerabilities.
Remove if unused: If the library is not essential, remove it entirely.
Apply mitigations: If you cannot update immediately, implement compensating controls to reduce risk.
When should I disable this rule?
You should rarely disable this rule. However, you may dismiss specific violations if:
The vulnerability does not apply to your usage of the library
You have implemented compensating controls that mitigate the risk
Resources