A dependency vulnerability is a security flaw in a third-party library, framework, or other component that an application relies on. Because the application incorporates or calls that component, its users may inherit the flaw even if the application’s own code is not the source of the bug.
In real attacks, a vulnerable dependency can expose an application to issues such as unauthorized access or remote code execution, depending on the flaw and how the component is used. Defenders should track software components and versions, review security advisories, and update to fixed releases. In platforms that bundle dependencies, applying the vendor’s patched application version can address risks that are not obvious from the application’s own features.