Triage an ML dependency CVE in four steps: confirm you run an affected version, check whether your code reaches the vulnerable function, check whether an attacker can reach that path in your deployment, then set a fix date by what you found. Most alerts stop at step two.
Why ML stacks produce long alert lists
A typical model-serving project depends on a framework, a tokenizer library, a model hub client, a serving runtime, and a large tree of transitive packages. Each package has its own advisories. Many sit in code paths a serving app never calls, such as training utilities, notebook helpers, or format converters.
The four steps
1. Confirm the version. Match the advisory's affected range against your lockfile, not your top level requirements. A transitive package may be pinned to a different version than you expect. The GitHub Advisory Database covers pip among other ecosystems and publishes in the OSV format, so version ranges are machine readable.
2. Check reachability. Reachability analysis asks whether your application can actually call the vulnerable code. A vulnerability in a model conversion function does not matter if your service only loads prepared weights. See reachability for transitive dependencies.
3. Check exposure. Even a reachable flaw needs an attacker path. Is the affected service on the internet? Does it accept untrusted input, files, or model artifacts? A deserialization flaw in an internal batch job carries a different risk from one in a public endpoint.
4. Set the fix date. Use what you learned. Reachable and exposed gets a short deadline. Not reachable gets a scheduled update with a note explaining why. CISA describes its Known Exploited Vulnerabilities catalog as an input to prioritisation, so a KEV listing should move an item up regardless of the other steps.
Record the decision
Write one line per alert: affected, reachable, exposed, decision, date. That line is what you hand a customer who asks why a critical alert is still open. It also feeds a VEX style statement later.
Try it yourself
Open the demo and compare the raw alert count with the count after reachability filtering. Note which findings drop out and why.
Click through it at your own pace, or open it full screen.
A short note on Safeguard
Safeguard provides reachability analysis alongside SBOM and dependency scanning, so the ranked list reflects what your code can call. Try a free scan at gold.safeguard.sh/scan.
Quick check
Is a not reachable CVE safe to ignore?
Not forever. Schedule the update and record the reasoning, because code paths change and a later refactor can make it reachable.
Do GitHub reviewed advisories cover every ML package?
No. Unreviewed advisories are imported from the National Vulnerability Database feed without review, and Dependabot does not alert on them. Check more than one source.
Sources
Last reviewed: 19 October 2026.
