ws is an open source WebSocket client and server for Node

#!/usr/bin/env python3
# CVE-2026-45736 verifier for installed ws packages
# Usage: python3 check_ws_cve_2026_45736.py /path/to/app
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / no determination

import json
import os
import re
import sys
from typing import List, Optional, Tuple

VULN_MIN = (8, 0, 0)
FIXED = (8, 20, 1)


def parse_semver(version: str) -> Optional[Tuple[int, int, int, str]]:
    if not version or not isinstance(version, str):
        return None
    m = re.match(r'^\s*v?(\d+)\.(\d+)\.(\d+)(.*)$', version.strip())
    if not m:
        return None
    return (int(m.group(1)), int(m.group(2)), int(m.group(3)), m.group(4) or '')


def is_vulnerable(version: str) -> Optional[bool]:
    parsed = parse_semver(version)
    if parsed is None:
        return None
    core = parsed[:3]
    return core >= VULN_MIN and core < FIXED


def find_ws_packages(root: str) -> List[Tuple[str, str]]:
    results = []
    for dirpath, dirnames, filenames in os.walk(root):
        # Skip very large or irrelevant trees when possible
        base = os.path.basename(dirpath)
        if base in {'.git', '.hg', '.svn', '__pycache__'}:
            dirnames[:] = []
            continue

        if 'package.json' not in filenames:
            continue

        norm = dirpath.replace('\\', '/')
        if '/node_modules/ws' not in norm:
            continue

        pkg_json = os.path.join(dirpath, 'package.json')
        try:
            with open(pkg_json, 'r', encoding='utf-8') as f:
                data = json.load(f)
            if data.get('name') == 'ws':
                version = str(data.get('version', '')).strip()
                results.append((pkg_json, version))
        except Exception:
            results.append((pkg_json, ''))
    return results


def main() -> int:
    if len(sys.argv) != 2:
        print('UNKNOWN: usage: python3 check_ws_cve_2026_45736.py /path/to/app')
        return 2

    root = sys.argv[1]
    if not os.path.exists(root):
        print(f'UNKNOWN: path does not exist: {root}')
        return 2

    findings = find_ws_packages(root)
    if not findings:
        print('UNKNOWN: no installed ws package instances found under node_modules')
        return 2

    vulnerable = []
    patched = []
    unknown = []

    for path, version in findings:
        verdict = is_vulnerable(version)
        if verdict is True:
            vulnerable.append((path, version))
        elif verdict is False:
            patched.append((path, version))
        else:
            unknown.append((path, version))

    if vulnerable:
        print('VULNERABLE: found ws versions in affected range >=8.0.0 <8.20.1')
        for path, version in vulnerable:
            print(f'  - {version or "unknown-version"} @ {path}')
        if patched:
            print('Also found patched/non-vulnerable instances:')
            for path, version in patched:
                print(f'  - {version or "unknown-version"} @ {path}')
        if unknown:
            print('Could not parse these instances:')
            for path, version in unknown:
                print(f'  - {version or "unknown-version"} @ {path}')
        return 1

    if patched and not unknown:
        print('PATCHED: all discovered ws instances are outside the vulnerable range or at/above 8.20.1')
        for path, version in patched:
            print(f'  - {version or "unknown-version"} @ {path}')
        return 0

    print('UNKNOWN: no vulnerable versions found, but one or more ws instances could not be parsed')
    if patched:
        print('Parsed patched/non-vulnerable instances:')
        for path, version in patched:
            print(f'  - {version or "unknown-version"} @ {path}')
    if unknown:
        print('Unparsed instances:')
        for path, version in unknown:
            print(f'  - {version or "unknown-version"} @ {path}')
    return 2


if __name__ == '__main__':
    sys.exit(main())