Vulnerability	Vulnerable Version
L Improper Restriction of Rendered UI Layers or Frames ciguard is a Static security auditor for CI/CD pipelines — now with a Model Context Protocol server (`pip install 'ciguard[mcp]'`) exposing scan / scan_repo / explain_rule / diff_baseline / list_rules to Claude Desktop / Claude Code / Cursor. Plus .ciguardignore rationale-required suppression, baseline / delta reports, EOL-aware image checks, GitHub Actions CVE lookups across GitLab CI, GitHub Actions, and Jenkins Pipelines. Pre-commit hook + CIGUARD_MCP_DISABLED enterprise gate. Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames due to missing HTTP security headers in the web interface. An attacker can compromise the integrity of the web application by exploiting the absence of headers such as `Content-Security-Policy`, `X-Frame-Options`, and `Sub-Resource-Integrity`, potentially enabling attacks like clickjacking or injection of malicious scripts when a user interacts with the web UI. How to fix Improper Restriction of Rendered UI Layers or Frames? Upgrade `ciguard` to version 0.8.2 or higher.	[,0.8.2)
L Execution with Unnecessary Privileges ciguard is a Static security auditor for CI/CD pipelines — now with a Model Context Protocol server (`pip install 'ciguard[mcp]'`) exposing scan / scan_repo / explain_rule / diff_baseline / list_rules to Claude Desktop / Claude Code / Cursor. Plus .ciguardignore rationale-required suppression, baseline / delta reports, EOL-aware image checks, GitHub Actions CVE lookups across GitLab CI, GitHub Actions, and Jenkins Pipelines. Pre-commit hook + CIGUARD_MCP_DISABLED enterprise gate. Affected versions of this package are vulnerable to Execution with Unnecessary Privileges due to the container image running as the root user by default, as the Dockerfile lacks a `USER` directive. An attacker can increase the impact of a potential container escape by leveraging root privileges within the container. This is only exploitable if a container escape vulnerability is present in the runtime environment. How to fix Execution with Unnecessary Privileges? Upgrade `ciguard` to version 0.8.2 or higher.	[,0.8.2)

Improper Restriction of Rendered UI Layers or Frames

ciguard is a Static security auditor for CI/CD pipelines — now with a Model Context Protocol server (pip install 'ciguard[mcp]') exposing scan / scan_repo / explain_rule / diff_baseline / list_rules to Claude Desktop / Claude Code / Cursor. Plus .ciguardignore rationale-required suppression, baseline / delta reports, EOL-aware image checks, GitHub Actions CVE lookups across GitLab CI, GitHub Actions, and Jenkins Pipelines. Pre-commit hook + CIGUARD_MCP_DISABLED enterprise gate.

Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames due to missing HTTP security headers in the web interface. An attacker can compromise the integrity of the web application by exploiting the absence of headers such as Content-Security-Policy, X-Frame-Options, and Sub-Resource-Integrity, potentially enabling attacks like clickjacking or injection of malicious scripts when a user interacts with the web UI.

How to fix Improper Restriction of Rendered UI Layers or Frames?

Upgrade ciguard to version 0.8.2 or higher.

[,0.8.2)

Execution with Unnecessary Privileges

Affected versions of this package are vulnerable to Execution with Unnecessary Privileges due to the container image running as the root user by default, as the Dockerfile lacks a USER directive. An attacker can increase the impact of a potential container escape by leveraging root privileges within the container. This is only exploitable if a container escape vulnerability is present in the runtime environment.

How to fix Execution with Unnecessary Privileges?

Upgrade ciguard to version 0.8.2 or higher.

[,0.8.2)

Go back to all versions of this package