Dotnet Vulnerable Packages
Import the JSON report of dotnet list package --vulnerable, which checks restored NuGet
packages against the GitHub Advisory Database.
File Types
JSON, as written by the .NET SDK. Generated with .NET SDK 8.0.423:
dotnet restore
dotnet list package --vulnerable --include-transitive --format json > dotnet_vulnerable.jsonPass --include-transitive. A vulnerable package is very often pulled in by another dependency
rather than referenced directly, and only transitivePackages names those. Both lists are walked.
Transitive entries carry no requestedVersion, and their mitigation says so — telling someone to
“upgrade” a package that is not in their project file is not actionable, so the finding names the real
options instead.
Severity comes from the NuGet advisory (Critical/High/Moderate/Low).
The report carries no advisory identifier, only advisoryurl. The GHSA id is parsed out of that
URL, and is the only public identifier available — there is no CVE field.
A project with nothing vulnerable omits the frameworks key entirely rather than reporting an empty
list. A package reported under several target frameworks of one project is a single finding.
Sample Scan Data
Sample Dotnet Vulnerable Packages scans can be found here.
Default Deduplication Hashcode Fields
By default, DefectDojo identifies duplicate findings using these hashcode fields:
- component_name
- component_version
- vuln_id_from_tool