---
title: Vulnerabilities in transitive dependencies
related:
  - https://docs.kentico.com/documentation/developers-and-admins/security-guidelines.md
  - https://docs.kentico.com/documentation/developers-and-admins/installation/support-policy.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

A dependency is a software component released by a third-party, which is required by the Xperience product. See [Third party software licenses](https://community.kentico.com/documentation/third-party-software-licenses) to view a list of dependencies and the licenses under which they are used.

Kentico distinguishes between two types of dependencies:

- **Direct dependencies**\
  Packages that are explicitly added and required by our product. We have full control over the version used and we are fully responsible for keeping the usage of these dependencies up-to-date and secure.
- **Transitive dependencies**\
  Packages that are indirectly required, meaning they are dependencies of our direct dependencies. They are managed by the authors of these direct dependencies. We do not have direct control over their versions, but they can still impact our product and should be monitored.

When a vulnerability with a [CVSS](https://www.first.org/cvss/) score of 7 and higher is discovered in a transitive dependency, we aim to provide a temporary fix, [overriding the version](https://learn.microsoft.com/en-us/nuget/concepts/auditing-packages#transitive-packages) by adding a direct reference to the Xperience by Kentico packages. This override is monitored by us and removed once a new version of the direct dependency that references the fixed transitive dependency becomes available.

For vulnerabilities with a score below 7, it is **your responsibility** to monitor and manage them. We recommend [setting up the NuGet audit process](https://learn.microsoft.com/en-us/nuget/concepts/auditing-packages) in your development and deployment pipeline to stay informed. If vulnerabilities are discovered, you need to override affected transitive dependencies in your project.

The version override may lead to discrepancies between the versions expected by your project and those introduced by the override, which need to be [resolved](https://learn.microsoft.com/en-us/nuget/concepts/dependency-resolution) to ensure compatibility and stability.