This repository was archived by the owner on Oct 7, 2026. It is now read-only.
Repository navigation
This repository was archived by the owner on Oct 7, 2026. It is now read-only.
🔒 [IBM OSPO Security Notification] — IBM/mcp-cli #256
Description
🔒 [IBM OSPO Security Notification] — IBM/mcp-cli
Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.
Attention: @chrishayuk
Dependabot Alerts
| Severity | CVE/GHSA | Package | Affected | Patched | Deadline | Fix PR |
|---|---|---|---|---|---|---|
| 🔴 critical | CVE-2026-63374 | anyio | < 4.14.2 | 4.14.2 | 2026-10-07 | — |
| 🟠 high | CVE-2026-69244 | aiohttp | <= 3.14.2 | 3.14.3 | 2026-10-30 | — |
| 🟠 high | CVE-2026-69247 | cryptography | >= 44.0.0, < 50.0.0 | 50.0.0 | 2026-10-30 | PR |
| 🟡 medium | CVE-2026-64847 | anyio | < 4.14.2 | 4.14.2 | 2026-12-29 | — |
| 🟡 medium | CVE-2026-97688 | urllib3 | >= 2.6.2, < 2.8.0 | 2.8.0 | 2027-01-05 | — |
Code Scanning Alerts
| Severity | Rule | Tool | Deadline |
|---|---|---|---|
| 🟠 high | js/client-side-unvalidated-url-redirection | CodeQL | 2026-10-29 |
| 🟠 high | js/client-side-unvalidated-url-redirection | CodeQL | 2026-10-29 |
| 🟠 high | js/client-side-unvalidated-url-redirection | CodeQL | 2026-10-29 |
| 🟠 high | js/client-side-unvalidated-url-redirection | CodeQL | 2026-10-29 |
| 🟠 high | js/client-side-unvalidated-url-redirection | CodeQL | 2026-10-29 |
| 🟠 high | js/xss | CodeQL | 2026-10-29 |
| 🟠 high | js/xss | CodeQL | 2026-10-29 |
| 🟠 high | js/xss | CodeQL | 2026-10-29 |
| 🟠 high | js/xss | CodeQL | 2026-10-29 |
| 🟠 high | js/xss | CodeQL | 2026-10-29 |
| 🟠 high | js/xss | CodeQL | 2026-10-29 |
| 🟠 high | js/xss | CodeQL | 2026-10-29 |
| 🟠 high | js/xss | CodeQL | 2026-10-29 |
| 🟡 medium | js/prototype-polluting-assignment | CodeQL | 2026-12-28 |
| 🟡 medium | js/incomplete-html-attribute-sanitization | CodeQL | 2026-12-28 |
| 🟡 medium | js/incomplete-html-attribute-sanitization | CodeQL | 2026-12-28 |
| 🟡 medium | js/incomplete-html-attribute-sanitization | CodeQL | 2026-12-28 |
Secret Scanning Alerts
No open secret scanning alerts.
Activity
security-ops-bot commentedon Sep 10, 2026
🔄 Dependabot Alert Changes
Added:
CVE-2026-69244(high),CVE-2026-69247(high)security-ops-bot commentedon Sep 11, 2026
🔄 Dependabot Alert Changes
Resolved:
CVE-2026-69244,CVE-2026-69247security-ops-bot commentedon Sep 12, 2026
🔄 Dependabot Alert Changes
Added:
CVE-2026-69244(high),CVE-2026-69247(high)security-ops-bot commentedon Sep 13, 2026
🔄 Dependabot Alert Changes
Resolved:
CVE-2026-69244,CVE-2026-69247security-ops-bot commentedon Sep 15, 2026
🔄 Dependabot Alert Changes
Added:
CVE-2026-69244(high),CVE-2026-69247(high)security-ops-bot commentedon Sep 16, 2026
🔄 Dependabot Alert Changes
Resolved:
CVE-2026-69244,CVE-2026-69247security-ops-bot commentedon Sep 18, 2026
🔄 Dependabot Alert Changes
Added:
CVE-2026-69244(high),CVE-2026-69247(high)[-]🔒 Security Alerts — IBM/mcp-cli[/-][+]🔒 [IBM OSPO Security Notification] — IBM/mcp-cli[/+]security-ops-bot commentedon Sep 19, 2026
🔄 Dependabot Alert Changes
Added:
CVE-2026-64847(medium),CVE-2026-63374(critical)security-ops-bot commentedon Sep 23, 2026
The following alert is approaching their SLA deadline with 3 days remaining. Please remediate before the deadline to avoid automatic repository archiving.
To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g.
#CVE-XXXX-YYYY) in the PR title.CVE-2026-63374@chrishayuk
security-ops-bot commentedon Sep 25, 2026
🔄 Dependabot Alert Changes
Resolved:
CVE-2026-69244,CVE-2026-69247,CVE-2026-64847,CVE-2026-63374security-ops-bot commentedon Sep 26, 2026
🔄 Dependabot Alert Changes
Added:
CVE-2026-69244(high),CVE-2026-69247(high),CVE-2026-64847(medium),CVE-2026-63374(critical)security-ops-bot commentedon Sep 29, 2026
🔄 Dependabot Alert Changes
Resolved:
CVE-2026-69244,CVE-2026-69247,CVE-2026-64847,CVE-2026-63374security-ops-bot commentedon Sep 29, 2026
🔄 Code & Secret Scanning Alert Changes
Added:
cs-42(code-scanning, medium),cs-41(code-scanning, high),cs-40(code-scanning, high),cs-39(code-scanning, high),cs-38(code-scanning, high),cs-37(code-scanning, high),cs-36(code-scanning, medium),cs-35(code-scanning, medium),cs-34(code-scanning, medium),cs-33(code-scanning, high),cs-32(code-scanning, high),cs-31(code-scanning, high),cs-30(code-scanning, high),cs-29(code-scanning, high),cs-28(code-scanning, high),cs-27(code-scanning, high),cs-26(code-scanning, high)Resolved:
cs-19(code-scanning),cs-18(code-scanning),cs-17(code-scanning)security-ops-bot commentedon Sep 30, 2026
🔄 Dependabot Alert Changes
Added:
CVE-2026-69244(high),CVE-2026-69247(high),CVE-2026-64847(medium),CVE-2026-63374(critical)security-ops-bot commentedon Oct 6, 2026
The following alert is approaching their SLA deadline with 1 day remaining. Please remediate before the deadline to avoid automatic repository archiving.
To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g.
#CVE-XXXX-YYYY) in the PR title.CVE-2026-63374@chrishayuk
security-ops-bot commentedon Oct 7, 2026
🔄 Dependabot Alert Changes
Added:
CVE-2026-97688(medium)security-ops-bot commentedon Oct 7, 2026
🔒 Repository Archived — IBM/mcp-cli
The following alert has exceeded their SLA deadline without being remediated. This repository has been archived.
CVE-2026-63374To request unarchiving, contact your security team and provide a remediation plan.
@chrishayuk