Tools / umbrel / Security

Security Deep Dive

umbrel

Security posture and CVE patch evidence from tracked releases.

Back to Tool

1 actively-exploited dependency CVE affects 1.7.4.

KEV-listed CVEs are confirmed exploited in the wild — patch urgently.

Versions by Severity

CVEs are attributed to tracked releases published before the patch release.

6 versions tracked

Version	Published	C	H	M	L	KEV	Notes
1.7.4	2026-07-10	—	—	—	—	—	Latest
1.7.3	2026-05-12	—	—	—	—	—	Patches CVE-2025-31125
1.7.2	2026-05-05	—	—	1	—	KEV 1	—
1.7.1	2026-04-28	—	—	1	—	KEV 1	—
1.7.0	2026-04-27	—	—	1	—	KEV 1	—
1.5.0	2025-11-05	—	—	1	—	KEV 1	—

— Signed — SLSA — SBOM ✗ Security policy Weekly cadence · 7d median Active maintainer

Trust Signals — 2 of 9 Present

Evidence already collected from releases and repository metadata.

2/9 Present

Signed releases Unknown

Latest release artifact signature Latest release

—

SLSA provenance Unknown

Attestation predicate level Latest release

—

SBOM published Unknown

GitHub SBOM API Latest release

—

SECURITY.md Absent

GitHub repository metadata Repository policy

Checked: 14d ago

Release cadence: weekly Present

7d median over recent releases Release history

Latest release: 16d ago

Maintainer active Present

Recent commit activity Repository

Last commit: 16d ago

Checksums (SHA256SUMS) Not active yet

SHA256SUMS or equivalent Release asset

Latest release: 16d ago

GitHub Actions attestation Not active yet

actions/attest-build-provenance Workflow file

Latest release: 16d ago

Signing assets Not active yet

.sig, .crt, cosign.pub, or similar Release asset

Latest release: 16d ago

0.3/10 Security Score

3.9/10 Scorecard

Dependency Exposure 151 transitive dependency CVEs found in the latest SBOM. 11 critical.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.25 / 0.5

Max EPSS 0.588

freshness

1.00 / 1.0

9d stale

scorecard

1.56 / 4.0

Score 3.9/10

cve health

0.00 / 2.5

⚠ No direct scan — 11c/60h transitive CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

-1.50 / 1.5

KEV exposure detected

supply chain risk

-1.50 / 10.0

Risk 100.0/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

0.0

25%

direct cves: clear cve scan: estimated

Release responsiveness

release responsiveness

10.0

patch speed days: no_history

Dependency exposure

dependency exposure

0.0

10%

supply chain risk: 100.0 transitive cves: 11c/60h

Provenance trust

provenance trust

3.9

40%

scorecard score: 3.9 openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 9d

Operational risk

operational risk

1.5

10%

kev exposure: detected epss max: 0.588

How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 100.0/100

11 Transitive critical CVEs

1 KEV-transitive CVEs

53% Dependency freshness

Scorecard

Scorecard 3.9/10

OpenSSF Scorecard evaluates supply-chain security practices automatically. Score ≥ 6 is passing; ≥ 8 is excellent.

Check	Score	Reason
Maintained	10	30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Code-Review	0	Found 0/30 approved changesets -- score normalized to 0
Token-Permissions	0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	10	no dangerous workflow patterns detected
SAST	0	no SAST tool detected
Binary-Artifacts	10	no binaries found in the repo
Security-Policy	0	security policy file not detected
License	9	license file detected
Packaging	-1	packaging workflow not detected
Fuzzing	0	project is not fuzzed
Branch-Protection	0	branch protection not enabled on development/release branches
Signed-Releases	-1	no releases found
Pinned-Dependencies	2	dependency not pinned by hash detected -- score normalized to 2

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

CVE Patch History

Tracks CVEs that were addressed in tagged releases. Shorter gap between disclosure and patch = faster response. EPSS = predicted probability of exploitation in next 30 days (FIRST.org); colored at ≥90%ile and ≥50%ile.

CVEs Patched by Year

Critical High Medium Low

2026

CVE	Severity	EPSS	Disclosed	Fixed in	Days to fix	vs Ecosystem Median	KEV
CVE-2025-31125	MEDIUM	99%ile	—	1.7.3	—	—	KEV

KEV = CISA Known Exploited Vulnerabilities catalog — actively exploited in the wild.

Dependency Vulnerabilities

3418 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

High

Medium

Low

Unknown

1 dependency vulnerabilities are in KEV.

CISA confirmed these vulnerabilities are actively exploited. Treat as critical priority.

Still affecting latest (59) All (151)

Critical 11 High 60 Medium 55 Low 24 Unknown 1

CVE	Severity	KEV	Dependency	Affected version	Cleared in release
CVE-2022-1650	critical	—	eventsource	1.1.0	1.7.3
CVE-2022-29078	critical	—	ejs	2.7.4	1.7.3
CVE-2022-37601	critical	—	loader-utils	0.2.17	1.7.3
CVE-2023-45133	critical	—	@babel/traverse	7.17.9	1.7.3
CVE-2025-24964	critical	—	vitest	2.1.2	1.7.3
CVE-2025-6545	critical	—	pbkdf2	3.1.2	1.7.3
CVE-2025-6547	critical	—	pbkdf2	3.1.2	1.7.3
CVE-2025-7783	critical	—	form-data	2.5.1	1.7.3
CVE-2025-9287	critical	—	cipher-base	1.0.4	1.7.3
CVE-2025-9288	critical	—	sha.js	2.4.11	1.7.3
GHSA-vjh7-7g9h-fjfh	critical	—	elliptic	6.5.4	1.7.3
CVE-2021-3749	high	—	axios	0.19.2	1.7.3
CVE-2021-3803	high	—	nth-check	1.0.2	1.7.3
CVE-2022-0155	high	—	follow-redirects	1.5.10	1.7.3
CVE-2022-24771	high	—	node-forge	0.10.0	1.7.3
CVE-2022-24772	high	—	node-forge	0.10.0	1.7.3
CVE-2022-25858	high	—	terser	4.8.0	1.7.3
CVE-2022-25883	high	—	semver	7.0.0	1.7.3
CVE-2022-3517	high	—	minimatch	3.0.4	1.7.3
CVE-2022-37599	high	—	loader-utils	2.0.2	1.7.3
CVE-2022-37603	high	—	loader-utils	2.0.2	1.7.3
CVE-2022-37620	high	—	html-minifier	3.5.21	1.7.3
CVE-2022-38900	high	—	decode-uri-component	0.2.0	1.7.3
CVE-2022-46175	high	—	json5	1.0.1	1.7.3
CVE-2023-43646	high	—	get-func-name	2.0.0	1.7.3
CVE-2023-46234	high	—	browserify-sign	4.2.1	1.7.3
CVE-2024-12905	high	—	tar-fs	2.1.1	1.7.3
CVE-2024-21536	high	—	http-proxy-middleware	0.19.1	1.7.3
CVE-2024-21538	high	—	cross-spawn	5.1.0	1.7.3
CVE-2024-29180	high	—	webpack-dev-middleware	3.7.3	1.7.3
CVE-2024-29415	high	—	ip	1.1.5	1.7.3
CVE-2024-37890	high	—	ws	6.2.2	1.7.3
CVE-2024-4068	high	—	braces	2.3.2	1.7.3
CVE-2024-45296	high	—	path-to-regexp	0.1.7	1.7.3
CVE-2024-45590	high	—	body-parser	1.20.0	1.7.3
CVE-2024-52798	high	—	path-to-regexp	0.1.7	1.7.3
CVE-2025-12758	high	—	validator	13.7.0	1.7.3
CVE-2025-12816	high	—	node-forge	0.10.0	1.7.3
CVE-2025-27152	high	—	axios	0.19.2	1.7.3
CVE-2025-27611	high	—	base-x	3.0.10	1.7.3
CVE-2025-48387	high	—	tar-fs	2.1.1	1.7.3
CVE-2025-59343	high	—	tar-fs	2.1.1	1.7.3
CVE-2025-64756	high	—	glob	10.4.5	1.7.3
CVE-2025-65945	high	—	jws	3.2.2	1.7.3
CVE-2025-66031	high	—	node-forge	0.10.0	1.7.3
CVE-2025-68130	high	—	@trpc/server	11.1.1	1.7.3
CVE-2025-68154	high	—	systeminformation	5.25.11	1.7.3
CVE-2026-25639	high	—	axios	0.19.2	1.7.3
CVE-2026-26280	high	—	systeminformation	5.25.11	1.7.3
CVE-2026-26318	high	—	systeminformation	5.25.11	1.7.3
CVE-2026-26996	high	—	minimatch	3.1.2	1.7.3
CVE-2026-27606	high	—	rollup	4.57.1	1.7.3
CVE-2026-27903	high	—	minimatch	3.1.2	1.7.3
CVE-2026-27904	high	—	minimatch	3.1.2	1.7.3
CVE-2026-29063	high	—	immutable	4.0.0	1.7.3
CVE-2026-32141	high	—	flatted	2.0.2	1.7.3
CVE-2026-33228	high	—	flatted	2.0.2	1.7.3
CVE-2026-33671	high	—	picomatch	2.3.1	1.7.3
CVE-2026-33891	high	—	node-forge	0.10.0	1.7.3
CVE-2026-33894	high	—	node-forge	0.10.0	1.7.3
CVE-2026-33895	high	—	node-forge	0.10.0	1.7.3
CVE-2026-33896	high	—	node-forge	0.10.0	1.7.3
CVE-2026-39363	high	—	vite	6.4.1	1.7.3
CVE-2026-42033	high	—	axios	0.19.2	1.7.3
CVE-2026-42035	high	—	axios	0.19.2	1.7.3
CVE-2026-42043	high	—	axios	0.19.2	1.7.3
CVE-2026-44728	high	—	@babel/plugin-transform-modules-systemjs	7.17.8	1.7.3
CVE-2026-4800	high	—	lodash-es	4.17.23	1.7.3
CVE-2026-4800	high	—	lodash	4.17.21	1.7.3
CVE-2026-4867	high	—	path-to-regexp	0.1.7	1.7.3
GHSA-5c6j-r48x-rmvq	high	—	serialize-javascript	4.0.0	1.7.3
CVE-2020-28168	medium	—	axios	0.19.2	1.7.3
CVE-2022-0122	medium	—	node-forge	0.10.0	1.7.3
CVE-2022-0536	medium	—	follow-redirects	1.5.10	1.7.3
CVE-2022-24773	medium	—	node-forge	0.10.0	1.7.3
CVE-2022-25901	medium	—	cookiejar	2.1.3	1.7.3
CVE-2023-26115	medium	—	word-wrap	1.2.3	1.7.3
CVE-2023-26136	medium	—	tough-cookie	2.5.0	1.7.3
CVE-2023-26159	medium	—	follow-redirects	1.5.10	1.7.3
CVE-2023-28155	medium	—	request	2.88.2	1.7.3
CVE-2023-44270	medium	—	postcss	7.0.39	1.7.3
CVE-2023-45857	medium	—	axios	0.19.2	1.7.3
CVE-2024-28849	medium	—	follow-redirects	1.5.10	1.7.3
CVE-2024-29041	medium	—	express	4.18.0	1.7.3
CVE-2024-33883	medium	—	ejs	2.7.4	1.7.3
CVE-2024-4067	medium	—	micromatch	3.1.10	1.7.3
CVE-2024-6783	medium	—	vue-template-compiler	2.6.14	1.7.3
CVE-2025-13465	medium	—	lodash	4.17.21	1.7.3
CVE-2025-15284	medium	—	qs	6.5.3	1.7.3
CVE-2025-24010	medium	—	vite	5.4.8	1.7.3
CVE-2025-27789	medium	—	@babel/helpers	7.17.9	1.7.3
CVE-2025-27789	medium	—	@babel/runtime	7.17.9	1.7.3
CVE-2025-30208	medium	—	vite	5.4.8	1.7.3
CVE-2025-30359	medium	—	webpack-dev-server	3.11.3	1.7.3
CVE-2025-30360	medium	—	webpack-dev-server	3.11.3	1.7.3
CVE-2025-31125	medium	KEV	vite	5.4.8	1.7.4
CVE-2025-31486	medium	—	vite	5.4.8	1.7.3
CVE-2025-32395	medium	—	vite	5.4.8	1.7.3
CVE-2025-32996	medium	—	http-proxy-middleware	1.3.1	1.7.3
CVE-2025-32997	medium	—	http-proxy-middleware	1.3.1	1.7.3
CVE-2025-46565	medium	—	vite	5.4.8	1.7.3
CVE-2025-56200	medium	—	validator	13.7.0	1.7.3
CVE-2025-62522	medium	—	vite	5.4.8	1.7.3
CVE-2025-62718	medium	—	axios	0.19.2	1.7.3
CVE-2025-64718	medium	—	js-yaml	4.1.0	1.7.3
CVE-2025-66030	medium	—	node-forge	0.10.0	1.7.3
CVE-2025-69873	medium	—	ajv	6.12.6	1.7.3
CVE-2026-2739	medium	—	bn.js	4.12.0	1.7.3
CVE-2026-2950	medium	—	lodash	4.17.21	1.7.3
CVE-2026-2950	medium	—	lodash-es	4.17.23	1.7.3
CVE-2026-31808	medium	—	file-type	16.5.4	1.7.3
CVE-2026-33672	medium	—	picomatch	2.3.1	1.7.3
CVE-2026-33750	medium	—	brace-expansion	1.1.11	1.7.3
CVE-2026-34043	medium	—	serialize-javascript	4.0.0	1.7.3
CVE-2026-39365	medium	—	vite	6.4.1	1.7.3
CVE-2026-40175	medium	—	axios	0.19.2	1.7.3
CVE-2026-41305	medium	—	postcss	7.0.39	1.7.3
CVE-2026-41691	medium	—	i18next-http-backend	2.2.2	1.7.3
CVE-2026-42034	medium	—	axios	0.19.2	1.7.3
CVE-2026-42036	medium	—	axios	0.19.2	1.7.3
CVE-2026-42038	medium	—	axios	0.19.2	1.7.3
CVE-2026-42039	medium	—	axios	0.19.2	1.7.3
CVE-2026-42041	medium	—	axios	0.19.2	1.7.3
CVE-2026-42042	medium	—	axios	0.19.2	1.7.3
GHSA-67mh-4wv8-2f99	medium	—	esbuild	0.21.5	1.7.3
GHSA-r4q5-vmmm-2653	medium	—	follow-redirects	1.5.10	1.7.3
CVE-2017-16137	low	—	debug	3.2.6	1.7.3
CVE-2023-42282	low	—	ip	1.1.5	1.7.3
CVE-2024-42459	low	—	elliptic	6.5.4	1.7.3
CVE-2024-42460	low	—	elliptic	6.5.4	1.7.3
CVE-2024-42461	low	—	elliptic	6.5.4	1.7.3
CVE-2024-43796	low	—	express	4.18.0	1.7.3
CVE-2024-43799	low	—	send	0.18.0	1.7.3
CVE-2024-43800	low	—	serve-static	1.15.0	1.7.3
CVE-2024-47764	low	—	cookie	0.4.1	1.7.3
CVE-2024-48948	low	—	elliptic	6.5.4	1.7.3
CVE-2024-48949	low	—	elliptic	6.5.4	1.7.3
CVE-2024-9506	low	—	vue	2.6.14	1.7.3
CVE-2025-14505	low	—	elliptic	6.5.4	1.7.3
CVE-2025-54798	low	—	tmp	0.0.33	1.7.3
CVE-2025-58751	low	—	vite	5.4.8	1.7.3
CVE-2025-58752	low	—	vite	5.4.8	1.7.3
CVE-2025-5889	low	—	brace-expansion	1.1.11	1.7.3
CVE-2025-7339	low	—	on-headers	1.0.2	1.7.3
CVE-2026-2391	low	—	qs	6.10.3	1.7.3
CVE-2026-24001	low	—	diff	3.5.0	1.7.3
CVE-2026-3449	low	—	@tootallnate/once	1.1.2	1.7.3
CVE-2026-42040	low	—	axios	0.19.2	1.7.3
GHSA-5rrq-pxf6-6jx5	low	—	node-forge	0.10.0	1.7.3
GHSA-gf8q-jrpm-jvxq	low	—	node-forge	0.10.0	1.7.3
MAL-2025-21003	unknown	—	fs	0.0.1-security	1.7.3

Showing 151 of 151