CVSS Score High 8.7 found in markdown-table 3.0.4 (sonatype-2026-004742 MALWARE)

[max-schaefer-dedalus]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.262.3

Please tell us more about your question or problem

Our security scanner Sonatype Nexus Firewall found CVSS Score High 8.7 in markdown-table 3.0.4 (sonatype-2026-004742 MALWARE)
https://guide.sonatype.com/vulnerability/sonatype-2026-004742/sonatype-research
The version is found in the package.json

Are you aware of this issue? Is it valid from your point of view?
If not valid could you take action to get it marked as false-positive.
If valid could it be fixed?

Logs (if relevant)

No response

[jamietanna]

Thanks for sharing the screenshots, as I don't have access given I don't have an account

https://www.npmjs.com/package/markdown-table/v/3.0.4 was released ~2 years ago - I don't see any other reports from other vendors which is odd

[jamietanna]

I'd recommend reaching out to Sonatype - as you have a relationship with them as a customer - to get them to investigate whether this is a false positive

We (the Renovate maintainers) believe this is a false positive

[max-schaefer-dedalus]

Thanks for swift reply!
Sontype has identified it as a false positive.