← Scan another repo

github.com/nvm-sh/nvm

@ 65ded65d46c1

Submitted 8/4/2026, 10:25:54 AM · Status: ok

Risk grade
C
32 / 100
Findings
14
0 critical1 high9 medium4 low0 info0 on CISA KEV0ATT&CK
Showing 14 of 14 findings

Findings

  • Detected jwt: Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data
    Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
    gitleaks
  • Ensure that APT isn't used
    Ensure that APT isn't used on /Dockerfile.RUN
    checkovDockerfile:32
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /Dockerfile.
    checkovDockerfile:1
  • Ensure that sudo isn't used
    Ensure that sudo isn't used on /Dockerfile.RUN
    checkovDockerfile:32
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Tests: nvm install with set -e)
    checkov.github/workflows/nvm-install-test.yml:8
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Update nodejs.org)
    checkov.github/workflows/nodejs-org.yml:9
  • Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)
    grypeCVE-2026-32947EPSS 0.3%
  • Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)
    grypeCVE-2026-32946EPSS 0.3%
  • Harden-Runner allows evasion of 'disable-sudo' policy
    grypeCVE-2025-32955EPSS 0.2%
  • Harden-Runner: Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)
    grypeCVE-2026-25598EPSS 0.3%
  • Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`
    grypeCVE-2024-52587EPSS 2.7%
  • No HEALTHCHECK defined
    You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
    trivyDockerfile:0
  • RUN using 'wget' and 'curl'
    Avoid using both 'wget' and 'curl' since these tools have the same effect.
    trivyDockerfile:63
  • RUN using 'wget' and 'curl'
    Avoid using both 'wget' and 'curl' since these tools have the same effect.
    trivyDockerfile:79

This report is public.