diff --git a/mruby/TODO b/mruby/TODO
new file mode 100644
index 0000000000..059d5d8876
--- /dev/null
+++ b/mruby/TODO
@@ -0,0 +1,2 @@
+This package has known vulnerabilities, please investigate and fix if possible:
+  CVE-2020-6838, CVE-2020-6839, CVE-2020-6840