CWE-1395: Dependency on Vulnerable Third-Party Component

The product has a dependency on a third-party component that contains one or more known vulnerabilities.

Many products are large enough or complex enough that part of their functionality uses libraries, modules, or other intellectual property developed by third parties who are not the product creator. For example, even an entire operating system might be from a third-party supplier in some hardware products. Whether open or closed source, these components may contain publicly known vulnerabilities or hidden functionality such as malware that could be exploited by adversaries to compromise the product.

Consequences

• Confidentiality, Integrity, Availability: Varies by Context

How to prevent it

• Requirements, Policy: In some industries such as healthcare [REF-1320] [REF-1322] or technologies such as the cloud [REF-1321], it might be unclear about who is responsible for applying patches for third-party vulnerabilities: the vendor, the operator/customer, or a separate service. Clarifying roles and responsibilities can be important to minimize confusion or unnecessary delay when third-party vulnerabilities are disclosed.
• Requirements: Require a Bill of Materials for all components and sub-components of the product. For software, require a Software Bill of Materials (SBOM) [REF-1247] [REF-1311].
• Architecture and Design, Implementation, Integration, Manufacturing: Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships."
• Operation, Patching and Maintenance: Actively monitor when a third-party component vendor announces vulnerability patches; fix the third-party component as soon as possible; and make it easy for operators/customers to obtain and apply the patch.
• Operation, Patching and Maintenance: Continuously monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, etc.

Recent advisories

• GHSA-78g4-xqwv-q3g8 — Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
• GHSA-2464-fhr4-w9xw — Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
• GHSA-wq5f-xc86-pv6w — sharp : Vulnerability in librsvg dependency CVE-2026-96889
• GHSA-788w-68h3-cvxp — Ghost: Remote Code Execution via Bookmark Card Images
• GHSA-vcvr-r3jv-pc5j — Next.js: Remote Code Execution in next/og ImageResponse
• GHSA-2xp9-vwfh-vxw4 — Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
• GHSA-f88m-g3jw-g9cj — sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
• GHSA-6vxv-wg6j-5qwp — Gogs: XSS in .ipynb files renderer due to outdated notebookjs
• GHSA-537c-gmf6-5ccf — Vulnerable OpenSSL included in cryptography wheels
• GHSA-46wh-3698-f2cx — Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)
• GHSA-q382-vc8q-7jhj — Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk
• GHSA-gv8r-9rw9-9697 — Traefik affected by TLS ClientAuth Bypass on HTTP/3
• GHSA-26gq-grmh-6xm6 — Gogs vulnerable to Stored XSS via Mermaid diagrams
• GHSA-5j59-xgg2-r9c4 — Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
• GHSA-w37m-7fhw-fmv9 — Next Server Actions Source Code Exposure

All advisories for CWE-1395