brotli-cve-check

Scans a project or container image for CVE-2026-111497, a buffer overflow in the Brotli decoder. It rates the criticality as Critical, High, or Medium and lists the steps to fix it.

The repo ships two pieces:

• Script (skills/brotli-cve-check/scripts/brotli_check.py): does the actual scan, rating, and remediation. It needs only Python 3.11+ and no dependencies, so it runs in CI as well.
• Skill (skills/brotli-cve-check/SKILL.md): an AI agent runs the script, reads your k8s, terraform, compose files, and README to work out how exposed the system is, then runs the script again with that exposure.

Install

Claude Code plugin

/plugin marketplace add Apaonum/brotli-cve-check
/plugin install brotli-cve-check@brotli-cve-check

To pick up new versions, run /plugin marketplace update brotli-cve-check.

Any agent (Claude Code, Cursor, Codex, Copilot, ...) via the skills CLI

npx skills add Apaonum/brotli-cve-check

Manual

git clone https://github.com/Apaonum/brotli-cve-check
ln -s "$PWD/brotli-cve-check/skills/brotli-cve-check" ~/.claude/skills/brotli-cve-check

Use

With the skill installed, ask your agent to "check this project for the Brotli CVE".

To run the script directly:

python3 skills/brotli-cve-check/scripts/brotli_check.py <project> \
  [--exposure internet|internal|none] \
  [--python <venv>/bin/python] \
  [--image <image>] \
  [--json]

--exposure	Criticality	Deadline	When
internet	Critical	24 hours	Takes requests from the internet, calls partner or third-party APIs, or fetches URLs supplied by users
internal	High	7 days	Takes data from other systems or partners over an internal network or VPN, or processes customer personal data
none	Medium	≤ 30 days	Build/CI images, dev machines, batch jobs that read only internal data
(omitted)	Critical	24 hours	Exposure is unknown, so the tool assumes the higher level

Exit codes: 0 clean, 1 vulnerable or needs verification, 2 scan error.

What it checks

• requirements*.txt, pyproject.toml, poetry.lock, uv.lock, Pipfile.lock: Brotli 1.0.3–1.2.0 (except the backported fixes 1.0.10 and 1.1.1) and brotlicffi < 1.2.1.0
• Dockerfile: base images on Debian unstable (sid), and base images not pinned by digest
• --image: runs the container and checks libbrotli1 with dpkg --compare-versions (bookworm needs ≥ 1.0.9-2+deb12u1, trixie needs ≥ 1.1.0-2+deb13u1). It also checks the Python packages inside the image, and runs trivy if it is installed. Needs docker.
• --python: checks the packages actually installed in that interpreter

CI example

- run: python3 skills/brotli-cve-check/scripts/brotli_check.py . --exposure internet --json

Test

python3 skills/brotli-cve-check/scripts/test_brotli_check.py

Limits

• On other distros (Ubuntu, RHEL, Alpine), --image reports the installed version and marks it "verify". Compare that version against the distro's own security tracker.
• When a project has a Dockerfile but you don't pass --image, the result is "needs verification", because the scan never sees the OS library inside the image.

License

MIT