KICS parser: CRITICAL severity missing from SEVERITY map, findings default to Medium

[leyendanerd]

Bug description

When importing (and re-importing) KICS scan reports into DefectDojo, findings that KICS classifies as CRITICAL are being shown in DefectDojo with a severity of MEDIUM. This causes critical infrastructure-as-code vulnerabilities to be under-represented in dashboards, SLA tracking, and risk reports, since they are not visible under the "Critical" severity filter.

This is confirmed to be a bug in DefectDojo's own KICS parser, not a configuration issue on our side — the raw KICS report correctly labels the findings as CRITICAL, but DefectDojo re-labels them as Medium on import/re-import.

Root cause (confirmed)

In dojo/tools/kics/parser.py, the SEVERITY mapping table only defines four levels:

SEVERITY = {
    "HIGH": "High",
    "MEDIUM": "Medium",
    "LOW": "Low",
    "INFO": "Info",
}

CRITICAL is missing from this table. Then, on line 34, the severity lookup falls back to "Medium" whenever the key is not found:

severity = self.SEVERITY.get(query.get("severity"), "Medium")

Since "CRITICAL" is never a key in SEVERITY, every KICS finding with severity: CRITICAL silently falls through to the "Medium" default. This was verified directly against the DefectDojo 2.58.4 source (the version currently running in our prod ArgoCD deployment, per values/prod.yaml: 2.58.4-alpine), and the same SEVERITY table/fallback exists across the other versions checked, so this is not version-specific to our install — it affects the KICS parser generally.

Steps to reproduce

1. Run a KICS scan on a Terraform/CloudFormation/K8s project that contains at least one query with severity: CRITICAL (e.g. <QUERY_ID / QUERY_NAME_AQUI>).
2. Export the KICS results in json format.
3. In DefectDojo, go to the target Engagement/Test and import the report using the KICS Scan parser (Import Scan or Re-import Scan).
4. Open the Findings list for that test/engagement.
5. Observe that the finding(s) which are CRITICAL in the original KICS report appear as Medium severity in DefectDojo.

Actual behavior

Findings originally reported by KICS as CRITICAL are imported/re-imported into DefectDojo with severity Medium.

Expected behavior

Findings reported by KICS as CRITICAL should retain that severity and appear as Critical in DefectDojo, both on initial import and on re-import (the mapping should be consistent across both operations).

Impact

• Critical infrastructure vulnerabilities are hidden from Critical-severity views, filters, and reports.
• Affects SLA/risk metrics and prioritization, since Medium findings are treated with lower urgency than Critical ones.
• Reproducible on both Import Scan and Re-import Scan, so historical data re-imported is also affected.

Environment

Item	Value
DefectDojo version	2.58.4-alpine
Deployment method	Kubernetes (ArgoCD)
KICS version	v2.1.20
Report format used	JSON
Parser used	KICS Scan

Nota: se revisaron otras versiones de DefectDojo además de 2.58.4 y todas comparten el mismo SEVERITY dict / mismo fallback, por lo que el bug no es exclusivo de esta versión.

Evidence

• Adjuntar fragmento del reporte KICS original mostrando "severity": "CRITICAL" para el finding afectado.
• Adjuntar captura del finding ya importado en DefectDojo mostrando Medium.
• (Opcional) Adjuntar el archivo de reporte completo (sanitizado) para reproducir.
  Casos similares de mapeo de severidad incorrecto ya han sido reportados para otros parsers de DefectDojo (p. ej. issues Discrepancy in Severity Mappings for Veracode SCA scans #6248, Incorrect Severity Level Mapping from Tenable Reports in DefectDojo #10051, Wrong severity mapping for native semgrep JSON parser #6289), donde la severidad original de la herramienta no se respeta al importar.

Suggested fix

Agregar la clave faltante al diccionario SEVERITY:

SEVERITY = {
    "CRITICAL": "Critical",
    "HIGH": "High",
    "MEDIUM": "Medium",
    "LOW": "Low",
    "INFO": "Info",
}

Related issues

• KICS partial import #7966 — KICS partial import (no todas las vulnerabilidades se muestran al importar el JSON de KICS)

Additional context

---

Labels sugeridas

bug parser kics severity

[Maffooch]

Hi @leyendanerd can you please open a PR for this issue with your suggested fix + unit tests?