---
url: /en/security/sca-vulnerability.md
description: >
  Usage of the Open-Source Component Vulnerability Scan plugin
  (cnbcool/sca-vulnerability), including parameters, the severity gate, log
  output, incremental rules, and exit codes.
---
The Open-Source Component Vulnerability Scan plugin compares the dependency changes of a Pull Request,
reports only the vulnerabilities (CVEs) it newly introduces, and can gate on severity.

## Features

* **Incremental scanning**: checks only the vulnerabilities newly introduced by the current PR;
* **Vulnerability gate**: can fail on `low`, `medium`, `high`, or `critical`;
* **Fix guidance**: outputs the component version, CVE, fixed version, and upgrade advice.

## Plugin image

```text
cnbcool/sca-vulnerability:latest
```

## Parameters

Plugin parameters are passed through `settings`:

| Parameter | Description | Default |
|---|---|---|
| `failOnSeverity` | Minimum severity that blocks the check: `low`, `medium`, `high`, or `critical`. If unset, findings are reported without applying a gate | none |

## Usage in CNB

```yaml title=".cnb.yml"
main:
  pull_request:
    - stages:
        - name: Open-Source Component Vulnerability Scan
          image: cnbcool/sca-vulnerability:latest
          settings:
            failOnSeverity: high
```

The configuration above fails the check when the PR introduces a High or Critical vulnerability.
Low and Medium vulnerabilities are still reported in the log.

### Scan without blocking

Omit `failOnSeverity` to report new vulnerabilities without applying a severity gate:

```yaml title=".cnb.yml"
main:
  pull_request:
    - stages:
        - name: Open-Source Component Vulnerability Scan
          image: cnbcool/sca-vulnerability:latest
```

## Output

The plugin prints new vulnerabilities directly to the CI log:

```text
go.mod: HIGH CVE-2025-10002
  component: github.com/example/library@v1.2.0
  fixed-version: v1.3.0
  message: example vulnerability
  action: upgrade github.com/example/library to v1.3.0 or later

SCA gate failed: 1 new risk findings, 1 matched gate
```

## Incremental rules

* The same component with the same CVE that already exists is not blocked again;
* A new component or a new CVE forms a new vulnerability;
* Deleting a file does not produce a new vulnerability;
* Renaming a file whose content is unchanged does not reproduce a vulnerability.

## Exit codes

| Exit code | Description |
|---:|---|
| `0` | Scan completed and no new vulnerability matched the gate |
| `1` | A new vulnerability matched the gate |
| `2` | Configuration error or scan failure |

## Next steps

* [Overview](./sca-plugins.md) — overall configuration and gates for the three plugins
* [License Scan](./sca-license.md) — License risk gate
* [SBOM Generation](./sca-sbom.md) — component change list