Package vulnerabilities
Kristján Oddsson
Workbrew detects known vulnerabilities (CVEs) in packages installed across your fleet and reports them in the Workbrew Console. This page describes the Vulnerabilities page, which packages Workbrew reports on, the severity levels it assigns from CVSS scores, and the thresholds available on a Vulnerability Patching policy. To set up automatic patching, see Automatically patch vulnerable packages.
Vulnerabilities page
The Vulnerabilities page lists the packages in your fleet that a known vulnerability affects. It is split into tabs by package type, Formulae and Casks. Each row is one affected package rather than one CVE, so a package carrying several CVEs appears once.
| Column | Contents |
|---|---|
| Vulnerabilities | The CVEs affecting the package. Expand vulnerabilities opens the full detail for every row at once. |
| Formula or Cask | The package name. |
| Outdated Devices | The Devices running an affected version. |
| Upgrade | Opens a new Brew Command, prefilled to upgrade the package on those Devices. |
| Homebrew/core Version or Homebrew/cask Version | The version Homebrew ships now, which is the version an upgrade moves to. |
Search filters the list. An Export Data button appears when your plan includes data export.
Every Workspace sees the affected package names and how many Devices are outdated. The CVE identifiers, the Homebrew version column, and the Upgrade button need a plan that includes vulnerability details. Without it, those cells show a prompt to update your plan instead.
The Workbrew Console dashboard carries a Fleet Security Status panel with the number of open vulnerabilities and the number resolved so far.
Which packages Workbrew reports on
A package reaches the Vulnerabilities page only when all of the following hold. These are reporting rules rather than patching rules, so a package that fails any one of them is neither listed nor patched.
- The package came from
homebrew/coreorhomebrew/cask. Packages from third-party Taps are never reported, because Workbrew has no official Homebrew version to compare them against. - The installed version is behind the version Homebrew ships. A formula Homebrew has disabled is reported even when it is not outdated.
- The version Homebrew ships fixes the vulnerability. A CVE with no patched release yet stays hidden until one exists.
- The advisory has not been marked incorrect or will-not-patch.
Severity levels
Workbrew reads the CVSS vector published in each advisory and assigns a severity of Critical, High, Medium, or Low. An advisory with no usable CVSS vector, or one that scores 0.0, is unscored.
Patching thresholds
A Vulnerability Patching policy sets a minimum severity for each package type. Anything at or above the threshold is patched automatically.
| Threshold | Meaning |
|---|---|
| Off | The package type is never patched automatically |
| All | Every vulnerability, including unscored ones |
| Low | CVSS 0.1 and higher |
| Medium | CVSS 4.0 and higher |
| High | CVSS 7.0 and higher |
| Critical | CVSS 9.0 and higher |
Each package type carries its own threshold, so you can patch formulae at Medium and above while patching casks only at Critical.
Related docs
- Automatically patch vulnerable packages - set up a Vulnerability Patching policy
- How vulnerability patching works - when patching runs and what qualifies a package for it
- Using brew outdated with Workbrew to list outdated casks - audit outdated software from the command line
- Declare policies to block software packages - block forbidden formulae, casks, and licenses
- Getting started with Workbrew - Workspace setup and Device onboarding