{
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "yof",
          "informationUri": "https://yof.io",
          "semanticVersion": "1.0.0",
          "rules": [
            {
              "id": "inside.dep_vulnerable_now",
              "name": "insideDepVulnerableNow",
              "shortDescription": {
                "text": "A package your app installs has a known serious vulnerability"
              },
              "fullDescription": {
                "text": "The weakness is public, with a published fix. Attackers scan for apps that still run the old version."
              },
              "help": {
                "text": "The weakness is public, with a published fix. Attackers scan for apps that still run the old version.\n\nWhat to do: A package version pinned in my lockfile has a known serious vulnerability (the advisory id and the first fixed version are given above). Upgrade that package to the fixed version or newer, update the lockfile with my package manager (do not edit the lockfile by hand), run the install and the tests, and tell me if the upgrade needs code changes.\n\nReferences: CWE-1395: Dependency on Vulnerable Third-Party Component; OWASP A06:2021: Vulnerable and Outdated Components; CVSS v4.0 9.3 (Critical), typical for this kind of finding; the advisory has the exact score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "markdown": "The weakness is public, with a published fix. Attackers scan for apps that still run the old version.\n\n**What to do:** A package version pinned in my lockfile has a known serious vulnerability (the advisory id and the first fixed version are given above). Upgrade that package to the fixed version or newer, update the lockfile with my package manager (do not edit the lockfile by hand), run the install and the tests, and tell me if the upgrade needs code changes.\n\n**References:**\n- CWE-1395: Dependency on Vulnerable Third-Party Component\n- OWASP A06:2021: Vulnerable and Outdated Components\n- CVSS v4.0 9.3 (Critical), typical for this kind of finding; the advisory has the exact score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "tags": [
                  "security",
                  "yof",
                  "external/cwe/cwe-1395",
                  "owasp-a06-2021"
                ],
                "security-severity": "9.3",
                "cvss": {
                  "version": "4.0",
                  "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                  "score": 9.3,
                  "rating": "Critical",
                  "baseline": true
                },
                "precision": "high"
              }
            }
          ]
        }
      },
      "automationDetails": {
        "id": "yof/inside/"
      },
      "versionControlProvenance": [
        {
          "repositoryUri": "https://github.com/example-shop/storefront",
          "revisionId": "0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c",
          "branch": "main"
        }
      ],
      "results": [
        {
          "ruleId": "inside.dep_vulnerable_now",
          "ruleIndex": 0,
          "level": "error",
          "message": {
            "text": "A package your app installs has a known serious vulnerability. The weakness is public, with a published fix. Attackers scan for apps that still run the old version. Package minimist 1.2.5; advisories GHSA-xvch-5gv4-984h, CVE-2021-44906; first fixed version 1.2.6."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "package-lock.json",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "startLine": 812
                }
              }
            }
          ],
          "partialFingerprints": {
            "yofFinding/v1": "sample-inside.dep_vulnerable_now"
          },
          "properties": {
            "package": "minimist",
            "ecosystem": "npm",
            "installedVersion": "1.2.5",
            "advisories": [
              {
                "id": "GHSA-xvch-5gv4-984h",
                "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h"
              },
              {
                "id": "CVE-2021-44906",
                "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906"
              }
            ],
            "firstFixedVersion": "1.2.6",
            "manifests": [
              "package.json"
            ]
          }
        }
      ]
    }
  ]
}