Medium known vulnerability

What mcp-scan saw

Same OSV.dev query as the other vulnerability rules, name and ecosystem only. An advisory routes here when its CVSS base score is between 4.0 and 6.9, when database_specific.severity says MODERATE or MEDIUM, or when neither a score nor a qualitative severity is available at all.

Why it fires

This is also the fallback bucket. The scanner refuses to drop an advisory it cannot grade, so anything with no parseable CVSS vector and no database severity lands here rather than disappearing. That means a count under this rule mixes genuine medium-severity issues with ungraded ones.

When this is a false positive

• No version is sent to OSV, so advisories fixed before your version still return. This is the dominant false positive for the whole family.
• The fallback path puts ungraded advisories here regardless of their real severity, so an entry may be either less or more serious than MEDIUM suggests.
• CVSS v4 vectors are not parsed by the current extractor, so a v4-only advisory falls through to the qualitative path or to this bucket by default.
• A medium-severity flaw in a code path the MCP server never reaches, for example a parser used only by the package's own CLI.

How to fix it

1. Open the advisory id from the finding at osv.dev and check both the affected ranges and the actual severity vector.
2. If the finding says 'no summary available' and carries no score, the grade is the fallback, not a judgement. Read the advisory before acting.
3. If your version is affected, pin the fixed version in the args array.
4. Batch these. Medium findings are worth handling on your normal dependency cadence rather than one at a time.
5. To suppress, add 'known-vulnerability-medium' to suppressRules in .mcp-scan.json.