Executive summary

GitHub code scanning currently shows 79 open Trivy alerts (tool=Trivy) against this repo, almost entirely from the optional Docker image (python:3.12-slim + busybox-static + pandas), not from the Python CLI or the host-native deploy/ path.

Paths: 78× library/vhc-simplifier (container OS/image) · 1× pip METADATA (site-packages).

Ship-risk vs noise

• Real ship path if operators run Docker: README + docker-compose.yml document docker build / Compose as a first-class runtime. There is no published GHCR/Docker Hub image; operators build locally. The scanned image (vhc-simplifier:trivy-scan in .github/workflows/trivy.yml) is that same Dockerfile. Compose already hardens with read_only, cap_drop: ALL, no-new-privileges.
• Most CRITICAL/HIGH are scanner debt, not app-reachable: the CLI is Python (vhc_simplifier.py). It does not invoke perl, mount/nsenter, systemd-homed, or BusyBox ash. Debian 13 (trixie) lists no official fixed version for the OS CVEs (<no-dsa> / minor). apt-get upgrade / a rebuild on today’s python:3.12-slim will not clear them.
• Host-native systemd deploy (deploy/) is unaffected by these container OS packages. Prefer it when Docker image CVE noise is unacceptable.
• Only clear, safe upgrade found: pip CVE-2026-13346 (MEDIUM, Fixed Version 26.2.0) — see draft PR fix: upgrade Docker image pip to ≥26.2.0 (CVE-2026-13346) #35.

Intentionally not suppressed. No .trivyignore and no Trivy workflow ignore list. Blanket ignores would hide future fixable OS/app findings. Track here until Debian publishes trixie updates, then rebuild.

Live alert API was not readable from this triage token (code-scanning 403; public /security/code-scanning 404). Inventory below is from the maintainer snapshot plus Debian Security Tracker as of 2026-09-12, cross-checked against the last successful scheduled Trivy image job (run 33946666983, 2026-09-05, Debian 13.6, 88 OS packages). Weekly cron is 0 5 * * 6 (next after that run: 2026-09-12 05:00 UTC).

P0 — perl-base CRITICAL + related perl CVEs

What it is: perl-base is a Debian Essential leftover from python:3.12-slim. The app never calls Perl.

Reachability: CVE-2026-13221 is a regex-trie overflow requiring >65535 fixed-string alternation branches. CVE-2026-57432 is pack/unpack OOB read from an untrusted template. CVE-2026-57433 is Storable deserialization of a crafted blob. None of those are on the VHC CSV/JSON → artifact path.

Do not: pin an unofficial/sid perl, or invent a .trivyignore without a Debian fix.

Do: wait for a trixie DSA / 5.40.1-6+deb13u* (or a newer official slim tag that includes it), then rebuild.

P1 — util-linux 4-CVE cluster (36 HIGH alerts)

Four CVEs × the util-linux binary package family pulled by python:3.12-slim:

util-linux, mount, login, libuuid1, libsmartcols1, libmount1, liblastlog2-2, libblkid1, bsdutils → 36 alerts.

Reachability: requires local unprivileged access plus mount/nsenter features the CLI never uses. Compose drops all capabilities and uses a read-only rootfs. Not the VHC parser attack surface.

Do: wait for Debian 13 util-linux ≥ 2.42.3 (or a backported deb13u*), rebuild slim.

P2 — other HIGHs

P3 — mediums / lows / unknown (including the one fixable finding)

Recommended remediations

1. Merge the pip pin (fix: upgrade Docker image pip to ≥26.2.0 (CVE-2026-13346) #35) so the only fix-available finding is closed on the next image scan.
2. Wait for Debian 13 (trixie) security updates, then rebuild on a fresher python:3.12-slim (prefer digest pin after the rebuild is known-good). Do not apt-get install sid perl/util-linux/busybox into this image.
3. Optional later hardening (separate change, not a CVE suppress): distroless/chainguard-style Python image, or drop busybox-static if cron is retired; multi-stage so pip is not left in the runtime layer.
4. Lower-exposure path today: host-native deploy/ systemd unit (no container OS packages). Still upgrade that venv’s pip (python -m pip install --upgrade "pip>=26.2.0") as hygiene — not a Trivy image alert.
5. When to suppress vs upgrade
   • Upgrade when Trivy/Debian lists a Fixed Version that is in trixie (or a trustworthy official slim rebuild).
   • Track (this issue) when Fixed Version is empty / <no-dsa>.
   • Suppress in .trivyignore only with a per-CVE comment (unused + no fix + not reachable) and a link back here. Prefer leaving alerts open. Never a blanket ignore.

When this issue can close

• pip alert gone after fix: upgrade Docker image pip to ≥26.2.0 (CVE-2026-13346) #35 + next trivy-image upload, and
• Debian 13 has fixed perl + util-linux + busybox + systemd CVEs (or we have rebuilt onto a base that has), or
• we have deliberately moved the documented Docker runtime off python:3.12-slim to a distroless image and re-scanned.

Key alert / tracker links

• https://github.com/cgfixit/Veeam-HealthCheck-Simplifier/security/code-scanning/252
• https://github.com/cgfixit/Veeam-HealthCheck-Simplifier/security/code-scanning/253
• https://github.com/cgfixit/Veeam-HealthCheck-Simplifier/security/code-scanning/254
• https://security-tracker.debian.org/tracker/CVE-2026-13221
• https://security-tracker.debian.org/tracker/CVE-2026-76642
• https://security-tracker.debian.org/tracker/CVE-2026-38754
• https://security-tracker.debian.org/tracker/CVE-2026-16742
• https://osv.dev/vulnerability/CVE-2026-13346
• Draft fix PR: fix: upgrade Docker image pip to ≥26.2.0 (CVE-2026-13346) #35