From e943ded9786df14ada255fed4c20799de849381d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar=20Arroba?=
 <19954079+cesararroba@users.noreply.github.com>
Date: Tue, 21 Jul 2026 15:32:32 +0200
Subject: [PATCH] fix(ui): remove unused npm from container to drop tar
 CVE-2026-59873 (#12065)

---
 ui/Dockerfile                                              | 4 +++-
 ui/changelog.d/ui-trivy-cve-2026-59873-npm-tar.security.md | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)
 create mode 100644 ui/changelog.d/ui-trivy-cve-2026-59873-npm-tar.security.md

diff --git a/ui/Dockerfile b/ui/Dockerfile
index 6ab9752972..3c3d3124f0 100644
--- a/ui/Dockerfile
+++ b/ui/Dockerfile
@@ -4,7 +4,9 @@ FROM node:24.13.0-alpine@sha256:cd6fb7efa6490f039f3471a189214d5f548c11df1ff9e5b1
 LABEL maintainer="https://github.com/prowler-cloud"
 
 # Patch Alpine OpenSSL runtime packages before all stages inherit the base image.
-RUN apk upgrade --no-cache libcrypto3 libssl3 && corepack enable
+# The build uses pnpm via corepack, so npm is unused — remove it (and npx) to drop
+# the bundled-npm CVE surface (node-tar CVE-2026-59873) from every stage, incl. prod.
+RUN apk upgrade --no-cache libcrypto3 libssl3 && corepack enable && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 # Install dependencies only when needed
 FROM base AS deps
diff --git a/ui/changelog.d/ui-trivy-cve-2026-59873-npm-tar.security.md b/ui/changelog.d/ui-trivy-cve-2026-59873-npm-tar.security.md
new file mode 100644
index 0000000000..d446e6c2b5
--- /dev/null
+++ b/ui/changelog.d/ui-trivy-cve-2026-59873-npm-tar.security.md
@@ -0,0 +1 @@
+Removed the unused `npm` CLI from the UI container image, eliminating the bundled `node-tar` `CVE-2026-59873` (and future bundled-npm CVEs); the image builds with `pnpm` via `corepack` and does not use `npm`