● AVAILABLE NOW · $29 · card (ONE-TIME · 3 REBINDS)

Dependency Vulnerability Triage — Fix what is being exploited first.

Stop reading 59 advisories in severity order. Feed it a lockfile and get what is exploited in the wild first (CISA KEV), what is likely to be exploited next (EPSS), what simply has a patch, and what to monitor, with the lowest upgrade that clears each package.

SKU: dependency-vuln-triage · Skills: dependency-vuln-triage-setup + dependency-vuln-triage · Tested: 20 unit tests

⚡ Works in Grok Bot + Cursor + Claude Code + Any Terminal (Zero-Dep Python 3 CLI Included)

See Real Sample Output View in Homepage Catalog

What It Does

Parses package-lock.json (v1-v3), yarn.lock, Pipfile.lock, poetry.lock, pinned requirements.txt, Cargo.lock and go.sum.
Batch queries OSV.dev, merges GHSA/PYSEC/CVE aliases into one advisory, then adds FIRST EPSS v1 scores and CISA KEV listings.
Buckets: KEV_ACTIVE_EXPLOIT, HIGH_EPSS_URGENT (default threshold 0.10), PATCH_AVAILABLE, LOW_PRIORITY_MONITOR, plus a per-package upgrade plan.
Only package names and versions leave your machine. Exit code 1 on findings at --fail-on, 11 when a source is down so an outage never looks clean; Markdown or JSON output.

Live run against a real npm lockfile fixture

Sample disclosure: this is a representative sample, not a customer report. It was produced against public or fictional test targets; account and credential values are placeholders or redacted (for example wck_<REDACTED>), and no private keys, seed phrases or secrets are ever shown. Your own report will differ in content and length.

<!-- live run: python3 scripts/dependency_vuln_triage.py tests/fixtures/package-lock.json  (exit 1: findings at/above HIGH_EPSS_URGENT) -->
# Dependency vulnerability triage

- **File:** `package-lock.json`
- **Retrieved:** 2026-10-27 04:50:13 UTC | tool=dependency_vuln_triage v1.0
- **Packages checked:** 7 | **with advisories:** 6 | **advisories:** 59
- **Sources:** cisa_kev=200, epss=200, osv_querybatch=200, osv_vulns=200 | KEV catalog released 2026-10-26T22:24:24.6101Z
- **EPSS threshold:** 0.10

| Bucket | Advisories |
|---|---|
| `KEV_ACTIVE_EXPLOIT` | 1 |
| `HIGH_EPSS_URGENT` | 4 |
| `PATCH_AVAILABLE` | 54 |
| `LOW_PRIORITY_MONITOR` | 0 |

## KEV_ACTIVE_EXPLOIT (1)

| Package | Installed | Advisory | Severity | EPSS (pctl) | KEV | Fixed in |
|---|---|---|---|---|---|---|
| `vite` | 5.0.0 | CVE-2025-31125, GHSA-4r4m-qw57-chr8 | MODERATE | 0.6576 (99.3%) @2026-10-26 | added 2026-01-22 | 5.4.16 |

## HIGH_EPSS_URGENT (4)

| Package | Installed | Advisory | Severity | EPSS (pctl) | KEV | Fixed in |
|---|---|---|---|---|---|---|
| `vite` | 5.0.0 | CVE-2025-30208, GHSA-x574-m823-4x7w | MODERATE | 0.7477 (99.5%) @2026-10-26 | - | 5.4.15 |
| `vite` | 5.0.0 | CVE-2025-31486, GHSA-xcj6-pq6g-qj4x | MODERATE | 0.4046 (98.6%) @2026-10-26 | - | 5.4.17 |
| `lodash` | 4.17.15 | CVE-2021-23337, GHSA-35jh-r3h4-6jhm | HIGH | 0.2133 (97.6%) @2026-10-26 | - | 4.17.21 |
| `axios` | 0.21.0 | CVE-2026-44492, GHSA-pjwm-pj3p-43mv | HIGH | 0.1228 (96.2%) @2026-10-26 | - | 0.32.0 |

What It Does Not Do

Does not scan source code or judge reachability; EPSS is a probability estimate, not a verdict.
Never installs, upgrades or edits your project.
Never claims a project is secure.

Frequently Asked Questions

How do I prioritize which CVEs to patch first using CISA KEV and FIRST EPSS exploit probability scores?

Triage by exploitation evidence instead of severity order. The bot batch-queries OSV.dev, merges GHSA, PYSEC and CVE aliases into one advisory, then enriches each with FIRST EPSS v1 scores and CISA KEV listings. Advisories land in four buckets: KEV_ACTIVE_EXPLOIT (listed in CISA KEV, patch first), HIGH_EPSS_URGENT (EPSS at or above the default 0.10 threshold), PATCH_AVAILABLE (a fixed version exists) and LOW_PRIORITY_MONITOR. Each package also gets the lowest upgrade version that clears its advisories. EPSS is a probability estimate, not a verdict.

Which dependency lockfiles (package-lock.json, yarn.lock, Pipfile.lock, poetry.lock, requirements.txt, Cargo.lock, go.sum) are supported?

It natively parses 7 ecosystems out of the box: npm package-lock.json (v1-v3), yarn.lock, Python Pipfile.lock, poetry.lock, pinned requirements.txt, Rust Cargo.lock and Go go.sum. Output is Markdown or JSON, with exit code 1 on findings at --fail-on and 11 when a data source is down so an outage never looks clean.

Does the Dependency Vulnerability Triage bot upload proprietary source code or require paid scanner API keys?

No source code is uploaded. Only package names and versions leave your machine, sent to the public OSV.dev, FIRST EPSS and CISA KEV data sources, and the bot runs locally in your Grok Bot /workspace. It does not depend on a paid scanner subscription. The license is a one-time $29 purchase with up to 3 workspace-reset rebinds and no recurring fee.

What safety and refusal boundaries does the Dependency Vulnerability Triage bot enforce?

It does not scan your source code or judge whether a vulnerable function is reachable, and it treats EPSS as a probability rather than a verdict. It never installs, upgrades or edits your project, so every fix stays your decision. It never claims a project is secure, and when a data source is unreachable it exits with code 11 instead of reporting a clean result.

Licensing & Setup

One-time license, up to 3 workspace-reset rebinds. On Turn 1 the dependency-vuln-triage-setup skill verifies your agent key, binds your wcl_... code through the read-only license helper, and confirms the bot files are installed. The license code is never printed in chat.

One wcl_... key, two runtimes. Your license key works inside Grok Bot and from any local terminal or IDE agent (Cursor, Claude Code, Windsurf, CI/CD) via the standalone single-file Python 3 CLI (standalone /runtime/<script>.py CLI) — Python 3.10+ standard library only, zero pip install dependencies, with --json / --markdown output.