Unpinned GitHub Actions Version
About A06:2021 — Vulnerable Components
Modern apps pull in hundreds of npm packages, and any one of them can introduce a vulnerability. The Equifax breach was a single outdated Struts library. Log4Shell affected millions of apps.
Impact: A vulnerable dependency in your tree is a vulnerability in your app, even if your code is perfect. Severity ranges from minor (denial of service) to critical (remote code execution). The blast radius is whatever the package can access — for server-side packages, that's usually everything.
How to fix it: Run `npm audit` (or equivalent) in CI and block builds on critical findings. Subscribe to security advisories for your major dependencies. Use Dependabot or Renovate to keep things current. Pin transitive dependencies when an advisory is open.
Common patterns in this category:
- Dependencies with known CVEs at the time of build
- Major versions behind upstream
- Unmaintained packages with no recent commits
- Packages installed from untrusted registries or forks
- Build tools and CI dependencies left out of audit scope
Framework mapping
Findings from this rule map to the following framework controls. This is an informational mapping, not an audit, certification, or attestation.
See the full compliance coverage page for how every rule maps to OWASP Top 10 and CWE, and which rules also carry informational SOC 2 and ISO 27001 cross-references.
VC121 is part of the full 223-rule set on paid plans (from $19/mo)
The free, no-signup scan (paste code, upload a file, or npx xploitscan@latest scan .) runs 30 core rules.