From a28487cbff1d19ea928d027b66329140b0e92cd9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Wed, 12 Aug 2026 03:16:14 -0700
Subject: [PATCH] fix(ci): suppress .NET runtime CVE temporarily (#12426)

---
 .grype.yaml       | 13 +++++++++++++
 .trivyignore.yaml | 14 ++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/.grype.yaml b/.grype.yaml
index 7c36171f65..8fe74513c9 100644
--- a/.grype.yaml
+++ b/.grype.yaml
@@ -33,6 +33,19 @@ ignore:
     package:
       name: Microsoft.Bcl.Memory
 
+  # The .NET runtime bundled inside the PowerShell tarball the Dockerfile pins.
+  # CVE-2026-62901 is the same temporary exception documented in .trivyignore.yaml:
+  # fixed in .NET 9.0.19 / 10.0.11 (2026-08-11), but no published PowerShell release
+  # ships a patched runtime yet (7.5.9 bundles 9.0.18; 7.6.4 bundles 10.0.x < 10.0.11).
+  # pwsh runs only local M365 module cmdlets; nothing listens for inbound WebSocket
+  # connections. Remove with the Trivy exception by 2026-09-15.
+  - vulnerability: CVE-2026-62901
+    package:
+      name: Microsoft.NETCore.App.Runtime.linux-x64
+  - vulnerability: CVE-2026-62901
+    package:
+      name: Microsoft.NETCore.App.Runtime.linux-arm64
+
 
   # The CPython interpreter, compiled into the official base image.
   # TEMPORARY, unlike the entries above: moving to Python 3.13 clears seven of these, and
diff --git a/.trivyignore.yaml b/.trivyignore.yaml
index f3a1b73b12..76e45691a9 100644
--- a/.trivyignore.yaml
+++ b/.trivyignore.yaml
@@ -118,6 +118,20 @@ vulnerabilities:
       - "pkg:npm/ip-address"
     expired_at: 2027-01-31
 
+  # CVE-2026-62901 is a DoS in System.Net.WebSockets (unchecked input for loop condition,
+  # CWE-606), fixed in .NET 9.0.19 / 10.0.11 (published 2026-08-11). The vulnerable runtime
+  # ships inside the PowerShell tarball the Dockerfile pins: 7.5.9 is the latest 7.5.x and
+  # bundles .NET 9.0.18; 7.6.4 bundles .NET 10.0.x < 10.0.11, so no published PowerShell
+  # release contains the fix yet. Prowler only invokes pwsh locally to run M365 module
+  # cmdlets; the image does not accept inbound WebSocket connections, so the DoS path is
+  # not reachable from the network. Remove this temporary suppression as soon as a
+  # PowerShell release shipping .NET 9.0.19+ is available.
+  - id: CVE-2026-62901
+    purls:
+      - "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64"
+      - "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64"
+    expired_at: 2026-09-15
+
   # Modules compiled into the Trivy binary the images ship. The binary is pinned by version
   # and verified by checksum in the Dockerfile; only a rebuild by its vendor moves these.
   # CVE-2026-71556 affects go-git worktree operations that can follow symlinks outside a