Dependency Vulnerability
A security weakness in third-party libraries or packages that an application depends on, which can be exploited to compromise the application.
Definition
Modern applications use hundreds of dependencies, creating a large attack surface. Dependency vulnerabilities are tracked via CVE (Common Vulnerabilities and Exposures) database. Tools like npm audit, Snyk, Dependabot, and OWASP Dependency-Check scan for known vulnerabilities. Software Composition Analysis (SCA) identifies all dependencies, including transitive ones, and maps them to known CVEs.
Why It Matters
The Log4Shell vulnerability (CVE-2021-44228) demonstrated how a single dependency flaw can affect millions of applications. OWASP lists "Vulnerable and Outdated Components" in the Top 10. According to Synopsys, 84% of codebases contain at least one vulnerability in open-source dependencies.
Example
A developer runs npm audit and discovers that lodash version 4.17.15 has a prototype pollution vulnerability (CVE-2020-8203). They upgrade to lodash 4.17.21 which includes the security patch.