Skip to content
Tools / stoatchat / Security

Security Deep Dive

stoatchat

Security posture and CVE patch evidence from tracked releases.

Back to Tool

33 high-severity dependency CVEs affects v0.14.3.

Review the dependency vulnerabilities below.

— Signed — SLSA — SBOM ✗ Security policy Weekly cadence · 2d median Active maintainer

Trust Signals — 2 of 9 Present

Evidence already collected from releases and repository metadata.

2/9 Present
Signed releases Unknown
Latest release artifact signature Latest release
—
SLSA provenance Unknown
Attestation predicate level Latest release
—
SBOM published Unknown
GitHub SBOM API Latest release
—
SECURITY.md Absent
GitHub repository metadata Repository policy
Checked: 14d ago
Release cadence: weekly Present
2d median over recent releases Release history
Latest release: 5d ago
Maintainer active Present
Recent commit activity Repository
Last commit: 8d ago
Checksums (SHA256SUMS) Not active yet
SHA256SUMS or equivalent Release asset
Latest release: 5d ago
GitHub Actions attestation Not active yet
actions/attest-build-provenance Workflow file
Latest release: 5d ago
Signing assets Not active yet
.sig, .crt, cosign.pub, or similar Release asset
Latest release: 5d ago
5.2/10 Security Score
Dependency Exposure 93 transitive dependency CVEs found in the latest SBOM.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.25 / 0.5

No EPSS data

freshness

1.00 / 1.0

1d stale

scorecard

2.00 / 4.0

⚠ Estimated — not yet collected

cve health

1.50 / 2.5

No open CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

1.50 / 1.5

No KEV exposure

supply chain risk

-1.50 / 10.0

Risk 66.9/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

6.0

25%

direct cves: clear cve scan: available

Release responsiveness

release responsiveness

10.0

5%

patch speed days: no_history

Dependency exposure

dependency exposure

3.3

10%

supply chain risk: 66.94 transitive cves: 0c/33h

Provenance trust

provenance trust

5.0

40%

scorecard score: estimated openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 1d

Operational risk

operational risk

8.5

10%

kev exposure: clear epss max: none
How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 66.9/100
0 Transitive critical CVEs
0 KEV-transitive CVEs
53% Dependency freshness

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

Dependency Vulnerabilities

3299 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

0

High

33

Medium

26

Low

13

Unknown

21

Still affecting latest (25) All (93)
High 33 Medium 26 Low 13 Unknown 21
CVE Severity KEV Dependency Affected version Cleared in release
CVE-2021-45710 high — tokio 0.2.25 v0.13.0
CVE-2023-43669 high — tungstenite 0.17.3 v0.13.0
CVE-2025-12816 high — node-forge 1.3.1 v0.13.0
CVE-2025-27152 high — axios 0.26.1 v0.13.0
CVE-2025-66031 high — node-forge 1.3.1 v0.13.0
CVE-2026-25639 high — axios 0.26.1 v0.13.0
CVE-2026-26996 high — minimatch 3.1.2 v0.13.0
CVE-2026-27903 high — minimatch 3.1.2 v0.13.0
CVE-2026-27904 high — minimatch 3.1.2 v0.13.0
CVE-2026-29074 high — svgo 3.3.2 v0.13.0
CVE-2026-33671 high — picomatch 2.3.1 v0.13.0
CVE-2026-33891 high — node-forge 1.3.1 v0.13.0
CVE-2026-33894 high — node-forge 1.3.1 v0.13.0
CVE-2026-33895 high — node-forge 1.3.1 v0.13.0
CVE-2026-33896 high — node-forge 1.3.1 v0.13.0
CVE-2026-41676 high — openssl 0.10.76 v0.13.0
CVE-2026-41678 high — openssl 0.10.76 v0.13.0
CVE-2026-41681 high — openssl 0.10.76 v0.13.0
CVE-2026-41898 high — openssl 0.10.76 v0.13.0
CVE-2026-42033 high — axios 0.26.1 v0.13.0
CVE-2026-42035 high — axios 0.26.1 v0.13.0
CVE-2026-42043 high — axios 0.26.1 v0.13.0
CVE-2026-42327 high — openssl 0.10.76 v0.13.0
CVE-2026-44728 high — @babel/plugin-transform-modules-systemjs 7.28.5 v0.13.0
CVE-2026-4800 high — lodash 4.17.21 v0.13.0
CVE-2026-4867 high — path-to-regexp 0.1.12 v0.13.0
CVE-2026-6321 high — fast-uri 3.1.0 v0.13.0
CVE-2026-6322 high — fast-uri 3.1.0 v0.13.0
GHSA-22q8-ghmq-63vf high — libgit2-sys 0.14.2+1.5.1 v0.13.0
GHSA-3v94-mw7p-v465 high — hickory-proto 0.25.2 v0.13.0
GHSA-5c6j-r48x-rmvq high — serialize-javascript 6.0.2 v0.13.0
GHSA-82j2-j2ch-gfr8 high — rustls-webpki 0.103.10 v0.13.0
RUSTSEC-2024-0013 high — libgit2-sys 0.14.2+1.5.1 v0.13.0
CVE-2023-45857 medium — axios 0.26.1 v0.13.0
CVE-2023-49092 medium — rsa 0.7.2 v0.13.0
CVE-2024-12224 medium — idna 0.2.3 v0.13.0
CVE-2025-13465 medium — lodash 4.17.21 v0.13.0
CVE-2025-15284 medium — qs 6.13.0 v0.13.0
CVE-2025-62718 medium — axios 0.26.1 v0.13.0
CVE-2025-64718 medium — js-yaml 3.14.1 v0.13.0
CVE-2025-66030 medium — node-forge 1.3.1 v0.13.0
CVE-2025-66400 medium — mdast-util-to-hast 13.2.0 v0.13.0
CVE-2025-69873 medium — ajv 6.12.6 v0.13.0
CVE-2026-2950 medium — lodash 4.17.21 v0.13.0
CVE-2026-33672 medium — picomatch 2.3.1 v0.13.0
CVE-2026-33750 medium — brace-expansion 1.1.12 v0.13.0
CVE-2026-34043 medium — serialize-javascript 6.0.2 v0.13.0
CVE-2026-40175 medium — axios 0.26.1 v0.13.0
CVE-2026-41305 medium — postcss 8.5.6 v0.13.0
CVE-2026-42034 medium — axios 0.26.1 v0.13.0
CVE-2026-42036 medium — axios 0.26.1 v0.13.0
CVE-2026-42038 medium — axios 0.26.1 v0.13.0
CVE-2026-42039 medium — axios 0.26.1 v0.13.0
CVE-2026-42041 medium — axios 0.26.1 v0.13.0
CVE-2026-42042 medium — axios 0.26.1 v0.13.0
CVE-2026-44662 medium — openssl 0.10.76 v0.13.0
GHSA-pwjx-qhcg-rvj4 medium — rustls-webpki 0.102.8 v0.13.0
GHSA-q2qq-hmj6-3wpp medium — hickory-proto 0.25.2 v0.13.0
GHSA-r4q5-vmmm-2653 medium — follow-redirects 1.15.11 v0.13.0
CVE-2025-68157 low — webpack 5.102.1 v0.13.0
CVE-2025-68458 low — webpack 5.102.1 v0.13.0
CVE-2026-21895 low — rsa 0.7.2 v0.13.0
CVE-2026-2391 low — qs 6.13.0 v0.13.0
CVE-2026-41677 low — openssl 0.10.76 v0.13.0
CVE-2026-42040 low — axios 0.26.1 v0.13.0
GHSA-4q83-7cq4-p6wg low — tokio 0.2.25 v0.13.0
GHSA-965h-392x-2mh5 low — rustls-webpki 0.103.10 v0.13.0
GHSA-cq8v-f236-94qc low — rand 0.9.2 v0.13.0
GHSA-g98v-hv3f-hcfr low — atty 0.2.14 v0.13.0
GHSA-j39j-6gw9-jw6h low — git2 0.16.1 v0.13.0
GHSA-rr8g-9fpq-6wmg low — tokio 0.2.25 v0.13.0
GHSA-xgp8-3hg3-c2mh low — rustls-webpki 0.103.10 v0.13.0
RUSTSEC-2021-0145 unknown — atty 0.2.14 v0.13.0
RUSTSEC-2023-0005 unknown — tokio 0.2.25 v0.13.0
RUSTSEC-2024-0320 unknown — yaml-rust 0.4.5 v0.13.0
RUSTSEC-2024-0370 unknown — proc-macro-error 1.0.4 v0.13.0
RUSTSEC-2024-0375 unknown — atty 0.2.14 v0.13.0
RUSTSEC-2024-0384 unknown — instant 0.1.13 v0.13.0
RUSTSEC-2024-0436 unknown — paste 1.0.15 v0.13.0
RUSTSEC-2025-0023 unknown — tokio 0.2.25 v0.13.0
RUSTSEC-2025-0052 unknown — async-std 1.13.2 v0.13.0
RUSTSEC-2025-0057 unknown — fxhash 0.2.1 v0.13.0
RUSTSEC-2025-0134 unknown — rustls-pemfile 1.0.4 v0.13.0
RUSTSEC-2025-0141 unknown — bincode 1.3.3 v0.13.0
RUSTSEC-2026-0008 unknown — git2 0.16.1 v0.13.0
RUSTSEC-2026-0049 unknown — rustls-webpki 0.102.8 v0.13.0
RUSTSEC-2026-0097 unknown — rand 0.9.2 v0.13.0
RUSTSEC-2026-0098 unknown — rustls-webpki 0.103.10 v0.13.0
RUSTSEC-2026-0099 unknown — rustls-webpki 0.103.10 v0.13.0
RUSTSEC-2026-0104 unknown — rustls-webpki 0.103.10 v0.13.0
RUSTSEC-2026-0105 unknown — core2 0.4.0 v0.13.0
RUSTSEC-2026-0118 unknown — hickory-proto 0.25.2 v0.13.0
RUSTSEC-2026-0119 unknown — hickory-proto 0.25.2 v0.13.0

Showing 93 of 93

Beta — feedback welcome: [email protected]