{
  "schema_version": 1,
  "app_id": "io.thepeoples.Claude",
  "slug": "claude",
  "version": "4.23118.1",
  "scanned_at": "2026-11-10T23:17:36Z",
  "scanner": {
    "name": "trivy",
    "version": "0.73.0",
    "db_updated_at": "2026-11-10T01:02:55Z"
  },
  "input": {
    "kind": "deb",
    "filename": "claude-desktop_4.23118.1_amd64.deb",
    "sha256": "b09ccdd72b38916c9637d48548db70e77c425eb2e09bb467465409d2ff9d287a",
    "extracted_without_scripts": true
  },
  "gate": {
    "result": "pass",
    "fail_on": "wrap CRITICAL"
  },
  "counts": {
    "wrap": {
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0,
      "unknown": 0
    },
    "vendor": {
      "critical": 0,
      "high": 1,
      "medium": 1,
      "low": 0,
      "unknown": 0
    }
  },
  "coverage": {
    "packages_seen": 6,
    "wrap": {
      "status": "inventoried",
      "packages_seen": 0,
      "notes": []
    },
    "vendor": {
      "status": "inventoried",
      "packages_seen": 6,
      "notes": [
        "electron asar",
        "electron 44.9.3 from version file",
        "read 5 package.json file(s)",
        "trivy sbom on 6 derived PURLs"
      ]
    }
  },
  "findings": [
    {
      "id": "CVE-2026-45736",
      "severity": "MEDIUM",
      "pkg": "ws",
      "installed": "8.18.0",
      "fixed": "8.20.1",
      "class": "vendor",
      "title": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`"
    },
    {
      "id": "CVE-2026-48779",
      "severity": "HIGH",
      "pkg": "ws",
      "installed": "8.18.0",
      "fixed": "5.2.5, 6.2.4, 7.5.11, 8.21.0",
      "class": "vendor",
      "title": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments"
    }
  ]
}