Low known vulnerability

What mcp-scan saw

Same OSV.dev query as the other vulnerability rules. An advisory routes here when its parsed CVSS base score is below 4.0, or when database_specific.severity says LOW. Its fixRecommendation differs from the higher tiers: 'Review and patch when convenient.' rather than an upgrade instruction.

Why it fires

A sub-4.0 score usually means the flaw needs local access, an unusual configuration, or produces limited impact. It is reported so the advisory is on the record rather than because it demands action, which is why the recommendation text is deliberately softer.

When this is a false positive

• No version is sent to OSV, so every advisory ever filed against the package returns regardless of what you run.
• A low CVSS score can still matter in a specific deployment, and a high one can be irrelevant. Treat the number as a starting point, not a verdict.
• The advisory may concern a dependency of a dependency that the MCP server's code path never loads.
• Low findings are filtered out entirely when you scan with --severity medium or higher, so their absence from a report is not evidence they do not exist.

How to fix it

1. Note the advisory id and move on unless you are already touching that dependency.
2. Fold these into your normal upgrade cadence rather than handling them individually.
3. If you want them out of your reports, run with --severity medium so the LOW tier is filtered before output.
4. To suppress just this rule, add 'known-vulnerability-low' to suppressRules in .mcp-scan.json.
5. Before dismissing one, check whether the advisory's low score depends on an assumption your deployment breaks, for example a local-access precondition on a shared machine.