Your app uses a library with a known vulnerability
Vulnerable dependency
What this means
Your app depends on a third-party library with a publicly documented vulnerability. A fix is usually available; the update simply has not been applied.
Why it matters
These vulnerabilities are published together with the way to exploit them and are searched for automatically across the internet. The fix is usually a version bump.
When this is not a problem
The vulnerable function may not be used by your code — the risk is then lower, but updating is still worthwhile.
How to fix it
- Update the package to a version where the vulnerability is fixed.
- If the update breaks something, record it and plan the migration.
- Review other dependencies of the same package.
Prompt for your AI agent
Update the listed dependencies to versions without known vulnerabilities and confirm the application still works.
How to verify the fix: run the dependency check again — no vulnerable versions should remain
Classification: CWE-1035 · A06:2021
References: osv.devcwe.mitre.org