Vulnerability Reportcheckmarx/ast-cli:2.3.68

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker controlling a malicious server that the CLI contacts could send a crafted compressed response that crashes the CLI or corrupts its memory during a scan, potentially leading to code execution in the scanning environment. The main concern is CVE-2026-111497, which the analysis does not tie to any special configuration, so it should be assumed to apply in normal operation. The image's exposed-surface findings include several high-severity items, so they cannot be dismissed, even though none are known to be actively exploited. Because the container exposes no ports and runs as a nonroot user, the practical exposure depends on the trust placed in the servers it connects to.