dependency-vulnerability-triage

Purpose

Triage and evaluate automated security alerts (Dependabot, Snyk, GitHub Advisory, Trivy) to determine true exploitability in your specific application context, distinguishing genuine high-risk threats from harmless dev-dependency false positives.

When to Use

• Reviewing a barrage of automated Dependabot or Snyk PRs.
• Preparing for security compliance reviews where open CVEs must be justified or remediated.
• Deciding whether a vulnerability requires an emergency out-of-band deployment.

What to Analyze

1. Vulnerability Mechanics: What exact function or API triggers the vulnerability (e.g. Prototype Pollution in lodash.merge, ReDoS in regex parser)?
2. Reachable Attack Surface: Does your application actually import and call the vulnerable function with untrusted user input?
3. Environment Scope: Is this package in dependencies (production runtime) vs devDependencies (build-time tooling)?
4. Available Fixes & Breaking Changes: Direct version bump vs Transitive dependency override (package.json#overrides or resolutions).
5. Mitigating Controls: Are WAF rules, schema validators, or input length limits already neutralizing the exploit vector?

Output Format

• Triage Matrix: [Package | CVE | CVSS Score | Reachable? | Severity in Context | Action].
• Exploitability Analysis: Clear reasoning on why the vulnerability is or isn't exploitable.
• Remediation Action Plan: Minimal patch or override syntax with zero breaking changes.

Avoid

• Blindly merging major version bumps without verifying breaking changes.
• Dismissing production runtime CVEs without verifying call paths.