Dependency CVE triage

Twelve alerts on Monday morning are not twelve emergencies. This skill sorts them by whether the vulnerable code can run in this application.

When to use

• On the output of composer audit, npm audit, pip-audit, or a Dependabot digest.
• Before a security questionnaire that asks about open CVEs.

Input

The alert list (package, version, advisory id, severity, fixed version), the lockfile, and read access to the code (to check reachability).

Process — per alert

1. What is vulnerable: from the advisory text, the function or feature, and the condition (attacker-controlled input? specific config?).
2. Reachable? Is the package a direct or transitive dependency, and does the app call the vulnerable code path? Grep for the imports/functions the advisory names. Transitive + unreachable is the common case.
3. Exploitable here? Does the app pass untrusted input into that path? Is the vulnerable feature enabled?
4. Fix cost: is the fixed version a patch/minor (cheap) or a major (a planned upgrade)?
5. Decision: fix now (reachable + exploitable, or trivial patch), schedule (reachable but not exploitable, or major bump), accept with note (unreachable; record why, revisit on next upgrade).

Rules

• Severity scores are a starting point, not a decision. A critical CVE in an unreachable path is a note; a medium one in the request path is a fix.
• Write the reachability evidence (the grep, the file) — "not used" must be checkable.
• Never recommend disabling the audit or ignoring an advisory without a written reason and a revisit date.
• Do not include exploit details beyond what the advisory states.

Output format

## 12 alerts → 2 fix now · 4 schedule · 6 accept

### Fix now
- **guzzlehttp/psr7 < 2.6.3 — header injection (GHSA-…)** · direct dep · reachable: webhook sender builds headers from user config (app/Services/Webhook.php:52) · fix: patch bump → run suite.

### Schedule
- **symfony/http-foundation — session fixation** · reachable · not exploitable: sessions regenerate on login (AuthController) · fix is minor bump; take it with next release.

### Accept (revisit 2026-10)
- **phpunit/phpunit — XML external entity** · dev-only, never runs in production.

License

MIT