az9713/cve-lite-on-piRunning OWASP cve-lite-cli against the pi monorepo: scan journey and key finding (vitest CVE-2026-47429).
A short write-up of running CVE Lite CLI against the pi monorepo, and what it found.
This experiment was prompted by the article "OWASP CVE Lite CLI – New Tool to Scan for Vulnerabilities in Your Projects" (CyberSecurityNews).
CVE Lite CLI is a developer-friendly, local command-line scanner for JavaScript/TypeScript projects. Instead of installing or running your dependencies, it reads your lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, or bun.lockb), collects every resolved package version, and checks those versions against the OSV (Open Source Vulnerabilities) database. It then prints prioritized findings and , and exits non-zero when urgent issues exist — making it easy to drop into CI. It supports npm, pnpm, Yarn, and Bun.
We ran CVE Lite CLI against the pi monorepo and recorded the full journey — setup, the scan pipeline, the discovery, and suggested remediation — in pi-main-cve-lite-journey.md.
| Component | Repository | Version |
|---|---|---|
| Scanner | OWASP/cve-lite-cli | 1.19.2 (run from a local source build; upstream latest at scan time: 1.20.0) |
| Target | earendil-works/pi (pi-monorepo) | 0.0.3 |
Advisory source: OSV (https://api.osv.dev) · Packages parsed: 443 from package-lock.json
1 CRITICAL vulnerability —
[email protected]
| Field | Value |
|---|---|
| Package | vitest (direct dev dependency) |
| Installed | 3.2.4 |
| Severity | CRITICAL — CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| Advisory | GHSA-5xrq-8626-4rwp / CVE-2026-47429 |
| Issue | When the Vitest UI server is listening, a path-traversal bypass (\\?\\..\\) allows arbitrary file read/execute — Windows-specific, or when the UI/API server is network-exposed |
| Fixed in | 3.2.6 |
| Declared in | packages/agent, packages/ai, packages/coding-agent |
Suggested fix (not applied — this is a report-only study):
npm install -w packages/agent -w packages/ai -w packages/coding-agent [email protected]
See the full report for the scan pipeline internals, validation details, risk-based mitigations, and scope/limitations: pi-main-cve-lite-journey.md.
README.md — this overviewpi-main-cve-lite-journey.md — the detailed scan journey and findings reportThis repository documents a one-off security scan for educational purposes. No remediation was applied to the upstream pi project.