Security and Compliance
Reference

Package vulnerabilities

Kristján Oddsson

All plans

Workbrew detects known vulnerabilities (CVEs) in packages installed across your fleet, whether they came from Homebrew, npm, VS Code or are macOS applications, and reports them in the Workbrew Console. This page describes the Vulnerabilities page, which packages Workbrew reports on, the severity levels it assigns from CVSS scores, and the thresholds available on a Vulnerability Patching policy. To set up automatic patching, see Automatically patch vulnerable packages.

Vulnerabilities page

The Vulnerabilities page lists the packages in your fleet that a known vulnerability affects. Every source shares a single list, with a filter to narrow it to one. Each row is one affected package rather than one CVE, so a package carrying several CVEs appears once.

ColumnContents
VulnerabilitiesThe CVEs affecting the package.
PackageThe package name, linked to its page in the Workbrew Console.
SourceWhere the package came from: Homebrew Formula, Homebrew Cask, npm Package, macOS App, or VS Code Extension.
Affected DevicesThe Devices running an affected version.
UpgradeOpens a new Command, prefilled to upgrade the package on those Devices. Not available for macOS Apps, which Workbrew reports on but does not manage.
Latest VersionThe version Homebrew ships now, which is the version an upgrade moves to.

Search filters the list, and two dropdowns narrow it further, one by severity and one by source. Expand vulnerabilities opens the full CVE detail for every row at once, and Collapse vulnerabilities closes it again. An Export Data button appears on Business and Enterprise plans.

On the free Team plan the page shows a summary only: one row per affected package with its vulnerability count, source, and number of affected Devices. The package name, CVE identifiers, latest version, Upgrade button, search and filters need the Vulnerability Patching upgrade, or a Business or Enterprise plan.

The Workbrew Console dashboard carries a Fleet Security Status panel with the number of open vulnerabilities and the number resolved so far.

Which packages Workbrew reports on

Homebrew vulnerabilities come from advisories matched against the package's CPE identifier. npm, VS Code extension and macOS App vulnerabilities come from the OSV and NVD databases. A Homebrew package reaches the Vulnerabilities page only when all of the following hold. These are reporting rules rather than patching rules, so a package that fails any one of them is neither listed nor patched.

  • The package came from homebrew/core or homebrew/cask. Packages from third-party Taps are never reported, because Workbrew has no official Homebrew version to compare them against.
  • The installed version is behind the version Homebrew ships. A formula Homebrew has disabled is reported even when it is not outdated.
  • The version Homebrew ships fixes the vulnerability. A CVE with no patched release yet stays hidden until one exists.
  • The advisory has not been marked incorrect or will-not-patch.

Severity levels

Workbrew reads the CVSS vector published in each advisory and assigns a severity of Critical, High, Medium, or Low. An advisory with no usable CVSS vector, or one that scores 0.0, is unscored.

Patching thresholds

A Vulnerability Patching policy sets a minimum severity for each source that Workbrew can patch: Homebrew formulae, Homebrew casks, npm packages and VS Code extensions. Anything at or above the threshold is patched automatically.

ThresholdMeaning
OffThe package type is never patched automatically
AllEvery vulnerability, including unscored ones
LowCVSS 0.1 and higher
MediumCVSS 4.0 and higher
HighCVSS 7.0 and higher
CriticalCVSS 9.0 and higher

Each source carries its own threshold, so you can patch formulae and npm packages at Medium and above while holding casks at Critical.