gh-aw-node contains vulnerable packages and released component pins need refresh

[loganrosen]

Summary

A final-image scan of the artifacts selected by gh-aw v0.82.14 found:

1. Vulnerable packages in the gh-aw-owned gh-aw-node image.
2. Component pins referencing releases with findings tracked in their owning repositories.

This issue tracks the gh-aw-owned image and the integration work needed after clean component releases become available. It does not duplicate remediation ownership from the component repositories.

An independent follow-up scan also confirmed that gh-aw-mcpg v0.4.3, currently selected on main, remains affected. Updating from v0.4.1 to v0.4.3 alone does not resolve the MCP gateway findings.

gh-aw-owned finding

gh-aw-node

Affected image:

ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b

Package	Installed version	Reported fixed version	Finding
libcrypto3 / libssl3	3.5.6-r0	3.5.7+	Multiple OpenSSL advisories
musl	1.2.6-r2	To be confirmed for this image	CVE-2026-40200
tar	7.5.13	7.5.19+	Package advisory
brace-expansion	5.0.5	5.0.7+	Package advisory
sigstore	4.1.0	4.1.1+	Package advisory
undici	6.25.0	6.27.0+	Package advisory

The safe-output MCP runtime primarily executes Node, local JavaScript, and git, so some npm-network findings may not be reachable in normal operation. The affected packages nevertheless remain present in the published image.

Verification should record the exact advisory ID, scanner severity, package path, and runtime applicability for every finding. In particular, the gh-aw-node Alpine release must be checked before treating musl 1.2.6-r2 as vulnerable: Alpine 3.24 records that revision as fixed for CVE-2026-40200.

Related component findings

• Agent and API-proxy images: github/gh-aw-firewall#6504
• Squid image license inventory: github/gh-aw-firewall#6506
• MCP gateway image: github/gh-aw-mcpg#9836
• GitHub MCP server fixes: github/github-mcp-server#2927

The Squid issue concerns license inventory rather than vulnerable packages. It is listed here only as a gh-aw-firewall release-readiness dependency, not as CVE remediation. The GitHub MCP server fixes are merged, but a patch release containing them is still pending.

Verified gh-aw-mcpg v0.4.3 status

The July 22, 2026 follow-up scan covered both immutable platform images:

Index:       sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83
linux/amd64: sha256:a257bf876a4ce12745a84427c1ff4aedd029ccc4547bc1d11a6f313eb1ab777a
linux/arm64: sha256:3774c57e8aacc2c6dcc65fee605c5a2e66d405c010916533c1fef18f52c12d93

Both platforms produced the same results:

• GO-2026-4970, GO-2026-5037, and GO-2026-5038 originate from /usr/bin/docker, not awmg.
• Alpine 3.24.1 musl 1.2.6-r2 is fixed for CVE-2026-40200, so that original finding does not apply to v0.4.3.
• Additional current matches affect Docker CLI, awmg dependencies, and BusyBox. Full attribution is recorded in github/gh-aw-mcpg#9836.

Released pins

gh-aw v0.82.14 selects:

• gh-aw-firewall v0.27.37
• gh-aw-mcpg v0.4.1
• github-mcp-server v1.6.0
• gh-aw-node digest 529d02eb...

Current main selects gh-aw-mcpg v0.4.3, but that update is not present in v0.82.14 and v0.4.3 is independently verified as still affected.

For this investigation, the baseline is v0.82.14 and the supported target is the latest non-prerelease gh-aw release available when remediation is published. Final-image verification should cover both linux/amd64 and linux/arm64.

Work that can proceed immediately

• Resolve and record the immutable platform digests for the current gh-aw-node image.
• Generate a final-image SBOM and vulnerability report for each supported platform.
• Record every finding's advisory ID, severity, installed version, fixed version, package path, and runtime applicability.
• Confirm whether CVE-2026-40200 applies to the gh-aw-node image's Alpine package.
• Refresh the gh-aw-node base/runtime packages and npm dependencies as needed.
• Publish and verify an immutable gh-aw-node digest whose remaining findings have documented applicability.

Release-blocked integration work

• Update gh-aw-firewall after releases addressing #6504 and the release-readiness work in #6506.
• Update gh-aw-mcpg to a release newer than v0.4.3 that addresses or documents the findings in github/gh-aw-mcpg#9836.
• Update github-mcp-server after a patch release containing github/github-mcp-server#2927.
• Publish a gh-aw release with the reviewed component pins and immutable gh-aw-node digest.
• Verify the final selected artifacts for both supported platforms.

Reproduction context

The gh-aw-node findings were observed using:

• Syft v1.46.0
• Grype v0.115.0

IMAGE='ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b'

syft --platform linux/amd64 "$IMAGE" -o syft-json=sbom.json
grype sbom:sbom.json

The image is multi-architecture, so package inventories may differ by platform.

Completion criteria

A supported gh-aw release references reviewed component releases and an immutable gh-aw-node digest whose remaining findings have documented applicability.

[pelikhan]

https://github.com/github/gh-aw/tasks/5fc8bc10-1d6f-4639-95b1-4ae61ca30f75

[pelikhan]

@lpcox

[pelikhan]

Fixed in v0.83.1

[loganrosen]

This issue should be reopened because the release-level completion criteria are not met in v0.83.1.

Verified against release commit 6268b9870d9f3bd9ce7526cb9d9cac988ffcfa35 and current main 839ce1a8c97f4ac5b8697523aaede2f2a82988f3; both still select the same pre-remediation artifacts:

Component	v0.83.1 and current main
github-mcp-server	v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3
gh-aw-node	sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b
gh-aw-firewall	v0.27.38 (agent cb928eb6..., api-proxy cd614562..., cli-proxy c30c5319..., squid 6c19094d...)
gh-aw-mcpg	v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83

The firewall v0.27.39 and mcpg v0.4.4 updates are tracked in #47596 and open PR #47597. Separately, the successful post-#47405 publish run produced refreshed multi-platform gh-aw-node digest sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748, but that digest has not been embedded. github-mcp-server v1.7.0 is available at sha256:c491ffdf6f4c85cb5397021bc655edb8ab825c6f5f568e7597d77a1bd7c4d308, but its bump also still needs tracking.

This umbrella issue should remain open until a supported gh-aw release embeds the reviewed component releases and refreshed gh-aw-node digest, then verifies those selected artifacts.