Package vulnerabilities
Kristján Oddsson
Workbrew detects known vulnerabilities (CVEs) in packages installed across your fleet and reports them in the Workbrew Console. This page describes the Vulnerabilities page, which packages Workbrew reports on, the severity levels it assigns from CVSS scores, and the thresholds available on a Vulnerability Patching policy. To set up automatic patching, see Automatically patch vulnerable packages.
Vulnerabilities page
The Vulnerabilities page lists the packages in your fleet that a known vulnerability affects. Formulae and casks share a single list. Each row is one affected package rather than one CVE, so a package carrying several CVEs appears once.
| Column | Contents |
|---|---|
| Vulnerabilities | The CVEs affecting the package. |
| Package | The package name, linked to its page in the Workbrew Console. |
| Source | Whether the package is a formula or a cask. |
| Affected Devices | The Devices running an affected version. |
| Upgrade | Opens a new Brew Command, prefilled to upgrade the package on those Devices. |
| Latest Version | The version Homebrew ships now, which is the version an upgrade moves to. |
Search filters the list, and two dropdowns narrow it further, one by severity and one by package type. Expand vulnerabilities opens the full CVE detail for every row at once, and Collapse vulnerabilities closes it again. An Export Data button appears when your plan includes data export.
The table above needs a plan that includes vulnerability details. Without it the page still lists one row per affected package, with the number of vulnerabilities it carries, whether it is a formula or a cask, and how many Devices are affected. The package name, the CVE identifiers, the Latest Version column, the Upgrade button, and the search and filter controls are all withheld, and the page links to your plan settings instead.
The Workbrew Console dashboard carries a Fleet Security Status panel with the number of open vulnerabilities and the number resolved so far.
Which packages Workbrew reports on
A package reaches the Vulnerabilities page only when all of the following hold. These are reporting rules rather than patching rules, so a package that fails any one of them is neither listed nor patched.
- The package came from
homebrew/coreorhomebrew/cask. Packages from third-party Taps are never reported, because Workbrew has no official Homebrew version to compare them against. - The installed version is behind the version Homebrew ships. A formula Homebrew has disabled is reported even when it is not outdated.
- The version Homebrew ships fixes the vulnerability. A CVE with no patched release yet stays hidden until one exists.
- The advisory has not been marked incorrect or will-not-patch.
Severity levels
Workbrew reads the CVSS vector published in each advisory and assigns a severity of Critical, High, Medium, or Low. An advisory with no usable CVSS vector, or one that scores 0.0, is unscored.
Patching thresholds
A Vulnerability Patching policy sets a minimum severity for each package type. Anything at or above the threshold is patched automatically.
| Threshold | Meaning |
|---|---|
| Off | The package type is never patched automatically |
| All | Every vulnerability, including unscored ones |
| Low | CVSS 0.1 and higher |
| Medium | CVSS 4.0 and higher |
| High | CVSS 7.0 and higher |
| Critical | CVSS 9.0 and higher |
Each package type carries its own threshold, so you can patch formulae at Medium and above while patching casks only at Critical.
Related docs
- Automatically patch vulnerable packages - set up a Vulnerability Patching policy
- How vulnerability patching works - when patching runs and what qualifies a package for it
- Using brew outdated with Workbrew to list outdated casks - audit outdated software from the command line
- Declare policies to block software packages - block forbidden formulae, casks, and licenses
- Getting started with Workbrew - Workspace setup and Device onboarding