Vulnerability Detection

cside automatically scans every third-party script loaded on your site and checks it against known vulnerability databases. When a script with a known vulnerability is detected, we flag it and surface the details in your dashboard so you can take action.

How it works

When a script is loaded on your site, cside follows a three-step process to determine if it contains known vulnerabilities:

1. Extract the library and version

cside identifies the package name and version from the script URL. We support most common CDN and hosting patterns:

For example, given the script URL:

https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.17.21/lodash.min.js

cside extracts:

• Package: lodash.js
• Version: 4.17.21

2. Check against vulnerability databases

The extracted package and version are checked against multiple industry-standard vulnerability databases that aggregate known security issues from sources like the National Vulnerability Database, GitHub Security Advisories, and the npm registry.

These databases are regularly synced to ensure up-to-date coverage.

3. Match against affected version ranges

Each vulnerability defines one or more affected version ranges. cside checks whether the detected version falls within any affected range. For example, a vulnerability might specify:

• Introduced in: 0.0.0
• Fixed in: 4.17.22

In this case, any version of lodash below 4.17.22 would be flagged -including 4.17.21.

Example: lodash 4.17.21

The script https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.17.21/lodash.min.js is a real-world example of a script that cside would report as vulnerable.

Lodash 4.17.21 is affected by known vulnerabilities including prototype pollution issues tracked in public CVE records. When cside detects this script on your site, the alert includes:

• Vulnerability ID -The CVE or advisory identifier (e.g., CVE-2025-XXXX, GHSA-XXXX)
• Severity -The severity level of the vulnerability
• Summary -A short description of the vulnerability
• Source -Which vulnerability database flagged the issue

What we report

When a vulnerable script is detected, cside creates a script alert visible in your dashboard with the following details:

Types of vulnerabilities detected

cside detects several categories of vulnerable scripts:

• Known CVEs -Scripts with publicly disclosed vulnerabilities in the National Vulnerability Database
• GitHub Security Advisories -Vulnerabilities reported through GitHub’s advisory system (GHSA identifiers)
• Malicious packages -Scripts from npm packages that have been flagged as intentionally malicious (MAL identifiers)

Supported CDNs and URL formats

cside can extract library information from scripts served by any of these patterns:

• unpkg.com -unpkg.com/@scope/package@version/file.js
• jsDelivr -cdn.jsdelivr.net/npm/package@version/file.js
• cdnjs -cdnjs.cloudflare.com/ajax/libs/package/version/file.js
• Query parameters -Any URL with ?v= or ?ver= version parameters
• Filename versioning -Scripts like package-1.2.3.min.js or package.1.2.3.js
• Path-based versioning -URLs like /1.2.3/package.js

Vulnerability notification filtering

The Noise Filter on Vulnerable Script Detected is enabled by default and affects immediate notifications for routine vulnerabilities. It can suppress notifications for findings confirmed with high confidence to affect only server or build code and not be reachable in the browser. Findings stay scored and visible in the dashboard, and remain in daily and weekly digests.

When a verdict is not yet available, a routine notification can wait for verification. The default hold is 30 minutes; unresolved findings are then released for delivery. This is a verification window, not a delivery-time guarantee. High and critical severity findings and malware use the immediate High-risk Vulnerability trigger and are never filtered by this option. Turn the filter off to receive all routine findings on the immediate schedule.

Open an alert from email

Emails for individual vulnerable-script and high-risk vulnerability alerts include a View alert in cside button. Click it to open the corresponding alert in the dashboard and review its impacted scripts. The vulnerability identifier or reference remains a separate link to OSV or the source advisory.

If a notification does not include a direct alert link, the button reads View alerts in cside and opens Alerts for the affected domain. Find the alert there using the target search and status filter.

See Resolving alerts for review actions and Notifications to configure delivery.

Recommended actions

When cside flags a vulnerable script on your site:

1. Review the vulnerability details in your dashboard to understand the severity and impact
2. Update the script to a patched version if one is available
3. Evaluate the risk -determine if the vulnerability is exploitable in your specific usage
4. Remove the script if it is no longer maintained or no patched version exists