Question

A CySA+ analyst runs a software composition analysis (SCA) scan against a Node.js application build. The report flags a critical remote code execution vulnerability in a logging library. Investigation shows the development team never directly imported this library; it was pulled in automatically by a charting package listed in package.json. The charting package itself has no fix that removes the vulnerable dependency. What is the MOST appropriate first action for the analyst to recommend?

Accepted Answer

Coordinate with developers to apply a dependency override/resolution pinning the transitive library to a patched version, then rebuild and rescan

Answer

Mark the finding as a false positive because the development team did not directly declare the vulnerable library

Answer

Remove the entire application from production until the upstream charting package vendor releases a new major version

Answer

Add the vulnerable library hash to the endpoint EDR block list so the library cannot execute