Skip to content
This repository was archived by the owner on Oct 7, 2026. It is now read-only.
This repository was archived by the owner on Oct 7, 2026. It is now read-only.

🔒 [IBM OSPO Security Notification] — IBM/mcp-cli #256

Open
Open
🔒 [IBM OSPO Security Notification] — IBM/mcp-cli#256
Labels
security

Description

@security-ops-bot
security-ops-bot
bot
opened on Sep 9, 2026

🔒 [IBM OSPO Security Notification] — IBM/mcp-cli

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

Attention: @chrishayuk

Dependabot Alerts

Severity CVE/GHSA Package Affected Patched Deadline Fix PR
🔴 critical CVE-2026-63374 anyio < 4.14.2 4.14.2 2026-10-07 —
🟠 high CVE-2026-69244 aiohttp <= 3.14.2 3.14.3 2026-10-30 —
🟠 high CVE-2026-69247 cryptography >= 44.0.0, < 50.0.0 50.0.0 2026-10-30 PR
🟡 medium CVE-2026-64847 anyio < 4.14.2 4.14.2 2026-12-29 —
🟡 medium CVE-2026-97688 urllib3 >= 2.6.2, < 2.8.0 2.8.0 2027-01-05 —

Code Scanning Alerts

Severity Rule Tool Deadline
🟠 high js/client-side-unvalidated-url-redirection CodeQL 2026-10-29
🟠 high js/client-side-unvalidated-url-redirection CodeQL 2026-10-29
🟠 high js/client-side-unvalidated-url-redirection CodeQL 2026-10-29
🟠 high js/client-side-unvalidated-url-redirection CodeQL 2026-10-29
🟠 high js/client-side-unvalidated-url-redirection CodeQL 2026-10-29
🟠 high js/xss CodeQL 2026-10-29
🟠 high js/xss CodeQL 2026-10-29
🟠 high js/xss CodeQL 2026-10-29
🟠 high js/xss CodeQL 2026-10-29
🟠 high js/xss CodeQL 2026-10-29
🟠 high js/xss CodeQL 2026-10-29
🟠 high js/xss CodeQL 2026-10-29
🟠 high js/xss CodeQL 2026-10-29
🟡 medium js/prototype-polluting-assignment CodeQL 2026-12-28
🟡 medium js/incomplete-html-attribute-sanitization CodeQL 2026-12-28
🟡 medium js/incomplete-html-attribute-sanitization CodeQL 2026-12-28
🟡 medium js/incomplete-html-attribute-sanitization CodeQL 2026-12-28

Secret Scanning Alerts

No open secret scanning alerts.

Activity

  1. security-ops-bot
    added
    security
    on Sep 9, 2026

  2. security-ops-bot commented on Sep 10, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 10, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-69244 (high), CVE-2026-69247 (high)

  3. security-ops-bot commented on Sep 11, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 11, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2026-69244, CVE-2026-69247

  4. security-ops-bot commented on Sep 12, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 12, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-69244 (high), CVE-2026-69247 (high)

  5. security-ops-bot commented on Sep 13, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 13, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2026-69244, CVE-2026-69247

  6. security-ops-bot commented on Sep 15, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 15, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-69244 (high), CVE-2026-69247 (high)

  7. security-ops-bot commented on Sep 16, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 16, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2026-69244, CVE-2026-69247

  8. security-ops-bot commented on Sep 18, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 18, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-69244 (high), CVE-2026-69247 (high)

  9. security-ops-bot
    changed the title [-]🔒 Security Alerts — IBM/mcp-cli[/-] [+]🔒 [IBM OSPO Security Notification] — IBM/mcp-cli[/+] on Sep 18, 2026

  10. security-ops-bot commented on Sep 19, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 19, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-64847 (medium), CVE-2026-63374 (critical)

  11. security-ops-bot commented on Sep 23, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 23, 2026 – with security-ops-bot
    Author

    ⚠️ SLA Warning — IBM/mcp-cli

    The following alert is approaching their SLA deadline with 3 days remaining. Please remediate before the deadline to avoid automatic repository archiving.

    To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g. #CVE-XXXX-YYYY) in the PR title.

    Alert Severity Deadline
    CVE-2026-63374 critical 2026-09-26

    @chrishayuk

  12. security-ops-bot commented on Sep 25, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 25, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2026-69244, CVE-2026-69247, CVE-2026-64847, CVE-2026-63374

  13. security-ops-bot commented on Sep 26, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 26, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-69244 (high), CVE-2026-69247 (high), CVE-2026-64847 (medium), CVE-2026-63374 (critical)

  14. security-ops-bot commented on Sep 29, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 29, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2026-69244, CVE-2026-69247, CVE-2026-64847, CVE-2026-63374

  15. security-ops-bot commented on Sep 29, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 29, 2026 – with security-ops-bot
    Author

    🔄 Code & Secret Scanning Alert Changes

    Added: cs-42 (code-scanning, medium), cs-41 (code-scanning, high), cs-40 (code-scanning, high), cs-39 (code-scanning, high), cs-38 (code-scanning, high), cs-37 (code-scanning, high), cs-36 (code-scanning, medium), cs-35 (code-scanning, medium), cs-34 (code-scanning, medium), cs-33 (code-scanning, high), cs-32 (code-scanning, high), cs-31 (code-scanning, high), cs-30 (code-scanning, high), cs-29 (code-scanning, high), cs-28 (code-scanning, high), cs-27 (code-scanning, high), cs-26 (code-scanning, high)

    Resolved: cs-19 (code-scanning), cs-18 (code-scanning), cs-17 (code-scanning)

  16. security-ops-bot commented on Sep 30, 2026

    @security-ops-bot
    security-ops-botbot
    on Sep 30, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-69244 (high), CVE-2026-69247 (high), CVE-2026-64847 (medium), CVE-2026-63374 (critical)

  17. security-ops-bot commented on Oct 6, 2026

    @security-ops-bot
    security-ops-botbot
    on Oct 6, 2026 – with security-ops-bot
    Author

    ⚠️ SLA Warning — IBM/mcp-cli

    The following alert is approaching their SLA deadline with 1 day remaining. Please remediate before the deadline to avoid automatic repository archiving.

    To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g. #CVE-XXXX-YYYY) in the PR title.

    Alert Severity Deadline
    CVE-2026-63374 critical 2026-10-07

    @chrishayuk

  18. security-ops-bot commented on Oct 7, 2026

    @security-ops-bot
    security-ops-botbot
    on Oct 7, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-97688 (medium)

  19. security-ops-bot commented on Oct 7, 2026

    @security-ops-bot
    security-ops-botbot
    on Oct 7, 2026 – with security-ops-bot
    Author

    🔒 Repository Archived — IBM/mcp-cli

    The following alert has exceeded their SLA deadline without being remediated. This repository has been archived.

    Alert Severity Deadline
    CVE-2026-63374 critical 2026-10-07

    To request unarchiving, contact your security team and provide a remediation plan.

    @chrishayuk

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    security

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions