Open-Source Component Vulnerability Scan

About 357 wordsAbout 1 min

The Open-Source Component Vulnerability Scan plugin compares the dependency changes of a Pull Request, reports only the vulnerabilities (CVEs) it newly introduces, and can gate on severity.

Features

Incremental scanning: checks only the vulnerabilities newly introduced by the current PR;
Vulnerability gate: can fail on low, medium, high, or critical;
Fix guidance: outputs the component version, CVE, fixed version, and upgrade advice.

Plugin image

cnbcool/sca-vulnerability:latest

Parameters

Plugin parameters are passed through settings:

Parameter	Description	Default
`failOnSeverity`	Minimum severity that blocks the check: `low`, `medium`, `high`, or `critical`. If unset, findings are reported without applying a gate	none

Usage in CNB

.cnb.yml
main:
  pull_request:
    - stages:
        - name: Open-Source Component Vulnerability Scan
          image: cnbcool/sca-vulnerability:latest
          settings:
            failOnSeverity: high

The configuration above fails the check when the PR introduces a High or Critical vulnerability. Low and Medium vulnerabilities are still reported in the log.

Scan without blocking

Omit failOnSeverity to report new vulnerabilities without applying a severity gate:

.cnb.yml
main:
  pull_request:
    - stages:
        - name: Open-Source Component Vulnerability Scan
          image: cnbcool/sca-vulnerability:latest

Output

The plugin prints new vulnerabilities directly to the CI log:

go.mod: HIGH CVE-2025-10002
  component: github.com/example/library@v1.2.0
  fixed-version: v1.3.0
  message: example vulnerability
  action: upgrade github.com/example/library to v1.3.0 or later

SCA gate failed: 1 new risk findings, 1 matched gate

Incremental rules

The same component with the same CVE that already exists is not blocked again;
A new component or a new CVE forms a new vulnerability;
Deleting a file does not produce a new vulnerability;
Renaming a file whose content is unchanged does not reproduce a vulnerability.

Exit codes

Exit code	Description
`0`	Scan completed and no new vulnerability matched the gate
`1`	A new vulnerability matched the gate
`2`	Configuration error or scan failure

Next steps

Overview — overall configuration and gates for the three plugins
License Scan — License risk gate
SBOM Generation — component change list