Vulnerability Reportcheckmarx/ast-cli:latest

checkmarx/ast-cli:latestcheckmarx/ast-cli:2.3.68

digestsha256:b53719f0c91ad2076feb78e3dc7a295638f8f646bbfa99c18efcdefef4449754

Executive Summary

Last scanned: Oct 27, 2026

Threat ScoreCAUTION• The image has 7 exposed-surface vulnerabilities; 3 have severity 7.0 or higher, with a maximum of 7.45.• CVE-2026-111497 (Brotli out-of-bounds write) appears in three packages (libbrotlicommon1, libbrotlidec1, libbrotlienc1) and is rated MEDIUM contextual importance with RCE impact.• The CLI makes outbound API calls, so a malicious or compromised server could send a crafted compressed response that reaches the vulnerable decoder.• No findings are listed as known exploited (exposed_known_exploited is 0), and the image has a reliable trust score of 90.• The 4 post-exploit-only findings have a maximum severity of 2.92 and do not drive this verdict.

60/100CAUTION

ReputationPOPULAR COMMUNITY• High Reputation Community Image (11M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker controlling a malicious server that the CLI contacts could send a crafted compressed response that crashes the CLI or corrupts its memory during a scan, potentially leading to code execution in the scanning environment. The main concern is CVE-2026-111497, which the analysis does not tie to any special configuration, so it should be assumed to apply in normal operation. The image's exposed-surface findings include several high-severity items, so they cannot be dismissed, even though none are known to be actively exploited. Because the container exposes no ports and runs as a nonroot user, the practical exposure depends on the trust placed in the servers it connects to.

Vulnerabilities

Vulnerability Log

11 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-111497	HIGH7.45	libbrotlicommon1 1.2.0-r6 fixed in 1.2.0-r7	36.0% High Exploitation Risk	Directly ExposedContext importance: MEDIUM
CVE-2026-111497	HIGH7.45	libbrotlidec1 1.2.0-r6 fixed in 1.2.0-r7	36.0% High Exploitation Risk	Directly ExposedContext importance: MEDIUM
CVE-2026-111497	HIGH7.45	libbrotlienc1 1.2.0-r6 fixed in 1.2.0-r7	36.0% High Exploitation Risk	Directly ExposedContext importance: MEDIUM
CVE-2026-111943	MEDIUM5.44	ca-certificates-bundle 20260909-r2 fixed in 20260909-r3	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2025-11579	MEDIUM4.42	github.com/nwaples/rardecode v1.1.3 No fix yet	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.58.0 No fix yet	—	Directly Exposed
CVE-2026-33481	LOW3.18	github.com/anchore/syft v1.21.0 fixed in 1.42.3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-33997	LOW2.92	github.com/docker/docker v28.0.3+incompatible fixed in 29.3.1	0.4% Theoretical Threat	Post-Exploit
CVE-2026-41567	LOW2.59	github.com/docker/docker v28.0.3+incompatible No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-42306	LOW2.59	github.com/docker/docker v28.0.3+incompatible No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-41568	LOW2.16	github.com/docker/docker v28.0.3+incompatible No fix yet	0.1% Theoretical Threat	Post-Exploit

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.