TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-7f5c-rpf4-86p8
Summary: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor in hbs
Aliases: CVE-2021-32822
Severity: MODERATE
CWE: CWE-538, CWE-200
Published: 2021-09-02T17:16:46Z

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.
Vulnerability: GHSA-2x4q-6jfv-8h9h
Summary: Path Traversal in glance
Aliases: CVE-2018-3715
Severity: HIGH
CWE: CWE-22
Published: 2018-07-26T14:53:14Z

Versions of `glance` before 3.0.4 are vulnerable to path traversal allowing a remote attacker to read arbitrary files from the server using `glance`.


## Recommendation

Update to version 3.0.4 or later.
Vulnerability: GHSA-63q7-h895-m982
Summary: Cross-site Scripting in dompurify
Aliases: CVE-2020-26870
Severity: MODERATE
CWE: CWE-79
Published: 2020-12-18T22:51:40Z

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
Vulnerability: GHSA-8fw4-xh83-3j6q
Summary: Cross-Site Scripting in diagram-js
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-11T21:18:05Z

Versions of `diagram-js` prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in `search-pad`, allowing attackers to execute arbitrary JavaScript.


## Recommendation

If you are using diagram-js 3.x, upgrade to version 3.3.1.
If you are using diagram-js 2.x, upgrade to version 2.6.2.
Vulnerability: GHSA-f698-m2v9-5fh3
Summary: Command Injection in opencv
Severity: LOW
CWE: CWE-77
Published: 2019-06-04T20:11:44Z

Versions of `opencv`prior to 6.1.0 are vulnerable to Command Injection. The utils/ script find-opencv.js does not validate user input allowing attackers to execute arbitrary commands.


## Recommendation

Upgrade to version 6.1.0.
Vulnerability: GHSA-xj6r-2jpm-qvxp
Summary: Code injection issue for java-spring-cloud-stream-template
Aliases: CVE-2021-37694
Severity: HIGH
CWE: CWE-94
Published: 2021-08-25T14:45:52Z

The following was initially reported by @jonaslagoni:

Given the following command:
`ag ./dummy.json @asyncapi/java-spring-cloud-stream-template --force-write --output ./output`

With the following AsyncAPI document:
```json
{
  "asyncapi": "2.0.0",
  "info": {
    "title": "Streetlight",
    "version": "1.0.0"
  },
  "defaultContentType": "json",
  "channels": {
    "security/audit/channel": {
      "description": "Channel for the turn on command which should turn on the streetlight",
      "parameters": {
        "streetlight_id": {
          "description": "The ID of the streetlight",
          "schema": {
            "type": "string"
          }
        }
      },
      "publish": {
        "operationId": "test() { System.out.println(\"injected\"); return test(0); }\n public Consumer<CustomClass> someothername",
        "message": {
          "name": "TurnonCommand",
          "payload": {
            "$ref": "#/components/schemas/CustomClass"
          }
        }
      }
    }
  },
  "components": {
    "schemas" : {
      "CustomClass": {
        "type": "object",
        "properties": {
          "prop": { 
              "type": "string"
          }
        }
      }
    }
  }
}
```

Which changes the following output: 

```java
...
  @Bean
  public Consumer<CustomClass> test() {
    // Add business logic here.
    return null;
  }
...
```
To
```java
...
  @Bean
  public Consumer<CustomClass> test() { System.out.println("injected"); return someothername(); }
  public Consumer<CustomClass> someothername() {
    // Add business logic here.
    return null;
  }
...
```
Vulnerability: GHSA-3c48-6pcv-88rm
Summary: Macro in MathJax running untrusted Javascript within a web browser
Aliases: CVE-2018-1999024
Severity: MODERATE
CWE: CWE-79
Published: 2018-07-27T17:05:27Z

MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later.
Vulnerability: GHSA-r9p9-mrjm-926w
Summary: Use of a Broken or Risky Cryptographic Algorithm
Aliases: CVE-2020-28498
Severity: MODERATE
CWE: CWE-327
Published: 2021-03-08T16:06:50Z

The npm package `elliptic` before version 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.
Vulnerability: GHSA-72hv-rp4q-q7f3
Summary: Hijacked Environment Variables in babelcli
Aliases: CVE-2017-16060
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-29T23:57:14Z

The `babelcli` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation



As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-4w46-w44m-3jq3
Summary: Parse Server stores password in plain text
Aliases: CVE-2020-26288
Severity: LOW
CWE: CWE-312
Published: 2020-12-28T16:33:17Z

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.
In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext.
This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.
Vulnerability: GHSA-6cgh-hjpw-q3gq
Summary: Utils.readChallengeTx does not verify the server account signature
Aliases: CVE-2021-32738
Severity: MODERATE
CWE: CWE-287
Published: 2021-07-02T19:20:33Z

The `Utils.readChallengeTx` function used in [SEP-10 Stellar Web Authentication](https://github.com/stellar/stellar-protocol/blob/master/ecosystem/sep-0010.md) states in its function documentation that it reads and validates the challenge transaction including verifying that the `serverAccountID` has signed the transaction. The function does not verify that the server has signed the transaction and has been fixed so that it does in v8.2.3.

Applications that also used `Utils.verifyChallengeTxThreshold` or `Utils.verifyChallengeTxSigners` to verify the signatures including the server signature on the challenge transaction are unaffected as those functions verify the server signed the transaction.

Applications calling `Utils.readChallengeTx` should update to v8.2.3 to ensure that the challenge transaction is completely valid and signed by the server creating the challenge transaction.
Vulnerability: GHSA-j49g-mp79-5vm5
Summary: Exfiltrates data on installation in coffe-script
Aliases: CVE-2017-16203
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-06T20:06:29Z

The `coffe-script` package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. 

All versions have been unpublished from the npm registry.



## Recommendation

If you have found `coffe-script` installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your SSH keys, registry credentials, tokens, and any other sensitive credentials that may have been present in your bash history.

Additionally, any service which may have been exposed via credentials in your bash history or accessible via your ssh keys, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-792j-9wj3-j634
Summary: Command injection in github-todos
Aliases: CVE-2021-44684
Severity: MODERATE
Published: 2021-12-10T20:30:52Z

naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is directly used by the exec function.
Vulnerability: GHSA-jgrx-mgxx-jf9v
Summary: Regular Expression Denial of Service in tmpl
Aliases: CVE-2021-3777
Severity: HIGH
CWE: CWE-400
Published: 2021-09-20T20:27:52Z

nodejs-tmpl is simple string formatting. tmpl is vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion.
Vulnerability: GHSA-qg3g-2mgh-33j8
Summary: Sensitive Data Exposure in msrcrypto
Aliases: CVE-2018-8319
Severity: CRITICAL
CWE: CWE-682
Published: 2018-09-10T15:19:49Z

Versions of `msrcrypto` prior to 1.4.1 are vulnerable to Sensitive Data Exposure. The package's Elliptic Curve Cryptography (ECC) implementation may leak information about a server's private ECC key. It can also allow attackers to craft invalid ECDSA signatures that pass as valid. There is no published proof-of-concept for this vulnerability.


## Recommendation

Upgrade to version 1.4.1 or later.
Vulnerability: GHSA-fw5f-7c6c-3vmv
Summary: Cross-site Scripting in PrimeFaces
Aliases: CVE-2020-10544
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-07T16:16:30Z

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation.
Vulnerability: GHSA-vm67-mh96-95mq
Summary: Malicious Package in bubfer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:40:48Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-rhwf-hqpr-q8g2
Summary: Code Injection in script-manager
Aliases: CVE-2020-8129
Severity: HIGH
CWE: CWE-94
Published: 2021-04-13T15:24:38Z

An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code.
Vulnerability: GHSA-8m2f-74r2-x3f2
Summary: Code injection in accesslog
Aliases: CVE-2022-25760
Severity: HIGH
CWE: CWE-94
Published: 2022-03-18T00:01:10Z

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.
Vulnerability: GHSA-w8qv-6jwh-64r5
Summary: Regular Expression Denial of Service in browserslist
Aliases: CVE-2021-23364
Severity: MODERATE
CWE: CWE-400
Published: 2021-05-24T19:52:40Z

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Vulnerability: GHSA-77qv-gh6f-pgh4
Summary: Command Injection in Limdu
Aliases: CVE-2020-4066
Severity: LOW
CWE: CWE-78
Published: 2020-06-22T15:24:06Z

### Impact
The `trainBatch` function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

### Patches
Patched in version 0.95.

### Workarounds
Do not use trainBatch with classifiers that rely on shell execution, such as SVM Perf, SVM Linear or Adaboost

### References
No
Vulnerability: GHSA-8h84-8j4f-p97q
Summary: Injection in bodymen
Aliases: CVE-2019-10792
Severity: MODERATE
CWE: CWE-74
Published: 2021-04-13T15:24:21Z

bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Vulnerability: GHSA-mxjr-xmcg-fg7w
Summary: Arbitrary Code Injection in mobile-icon-resizer
Severity: MODERATE
CWE: CWE-94
Published: 2019-06-27T17:25:21Z

mobile-icon-resizer resizes large images for use as icons for iOS and Android.

mobile-icon-resizer has a code execution vulnerability in versions before 0.4.3.

mobile-icon-resizer takes an options object as an argument to define the resulting icons as such:
```
var options = {
  config: './config.js'
}
resize(options, function(err){});
```
config.js would need to be a file on the filesystem and look something like:
```
var config = {
  iOS: {
    "images": [
     /* iOS image definitions are not vulnerable */
    ]
  },
  android: {
    "images" : [
      {
        "baseRatio" : "console.log('Executing script as baseRatio property')",
        "folder" : "drawable-ldpi"
      },
      {
        "ratio" : "console.log('Executing script as ratio property')",
        "folder" : "drawable-mdpi"
      },
    /* other android image defintiions ... */
    ]
  }
};

exports = module.exports = config;
```
The parameters `ratio` and `baseRatio` are passed directly to `eval()`, thus allowing dynamic javascript payloads to be executed.


## Recommendation

Update to version 0.4.3 or later.
Vulnerability: GHSA-rq8g-5pc5-wrhr
Summary: Insufficient Entropy in cryptiles
Aliases: CVE-2018-1000620
Severity: CRITICAL
CWE: CWE-331
Published: 2018-09-11T18:22:50Z

Versions of `cryptiles` prior to 4.1.2 are vulnerable to Insufficient Entropy. The `randomDigits()` method does not provide sufficient entropy and its generates digits that are not evenly distributed.


## Recommendation

Upgrade to version 4.1.2. The package is deprecated and has been moved to `@hapi/cryptiles` and it is strongly recommended to use the maintained package.
Vulnerability: GHSA-cgvm-rvfv-c92r
Summary: Malicious Package in ecuvre
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:05:51Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-g95j-p8f6-pwh4
Summary: Downloads Resources over HTTP in headless-browser-lite
Aliases: CVE-2016-10625
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:56:58Z

Affected versions of `headless-browser-lite` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `headless-browser-lite`.


## Recommendation

Update to version 2015.4.18-a or later.
Vulnerability: GHSA-jvf4-g24p-2qgw
Summary: Arbitrary Code Execution in shiba
Aliases: CVE-2020-7738
Severity: HIGH
CWE: CWE-94
Published: 2021-05-10T18:37:34Z

"All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad()."
Vulnerability: GHSA-mwj7-r5vc-hmc9
Summary: Directory Traversal in hcbserver
Aliases: CVE-2017-16171
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:35:38Z

Affected versions of `hcbserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-2hw7-mxvj-m455
Summary: Path traversal in Node-RED-Dashboard
Aliases: CVE-2021-3223
Severity: HIGH
CWE: CWE-22
Published: 2021-01-29T18:13:52Z

In Node-RED-Dashboard before 2.26.2 there is a path traversal vulnerability. It allows ui_base/js/..%2f directory traversal to read files.
Vulnerability: GHSA-ww39-953v-wcq6
Summary: Regular expression denial of service in glob-parent
Aliases: CVE-2020-28469
Severity: HIGH
CWE: CWE-400
Published: 2021-06-07T21:56:34Z

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Vulnerability: GHSA-x2jj-x3q2-7hph
Summary: Directory Traversal in 11xiaoli
Aliases: CVE-2017-16160
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:28:09Z

Affected versions of `11xiaoli` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-fpw3-x4xq-6vxq
Summary: Malicious Package in wepack-cli
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T18:32:13Z

All versions of `wepack-cli` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-4v9w-pvwr-38h3
Summary: OS Command Injection in strong-nginx-controller
Aliases: CVE-2020-7621
Severity: CRITICAL
CWE: CWE-78
Published: 2022-02-10T23:36:54Z

strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function.
Vulnerability: GHSA-j44m-qm6p-hp7m
Summary: Arbitrary File Overwrite in tar
Aliases: CVE-2018-20834
Severity: HIGH
CWE: CWE-59
Published: 2019-05-01T18:37:31Z

Versions of `tar` prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.


## Recommendation

For tar 4.x, upgrade to version 4.4.2 or later.
For tar 2.x, upgrade to version 2.2.2 or later.
Vulnerability: GHSA-2w3f-9w3q-qw77
Summary: Prototype Pollution in config-handler
Aliases: CVE-2021-23448
Severity: CRITICAL
CWE: CWE-913
Published: 2021-10-12T18:30:37Z

All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.
Vulnerability: GHSA-hqq7-2q2v-82xq
Summary: Cross-site Scripting in sanitize-url
Aliases: CVE-2021-23648
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-17T00:00:24Z

The package `@braintree/sanitize-url` before 6.0.0 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the `sanitizeUrl` function.
Vulnerability: GHSA-5wg4-74h6-q47v
Summary: Integer Overflow or Wraparound and Use of a Broken or Risky Cryptographic Algorithm in bcrypt
Aliases: CVE-2020-7689
Severity: MODERATE
CWE: CWE-327, CWE-190
Published: 2020-08-20T14:38:49Z

In bcrypt (npm package) before version 5.0.0, data is truncated wrong when its length is greater than 255 bytes.
Vulnerability: GHSA-qj3f-9gmq-fwv5
Summary: Cross-Site Scripting in simple-markdown
Aliases: CVE-2019-9844
Severity: MODERATE
CWE: CWE-79
Published: 2019-04-09T19:47:29Z

Versions of `simple-markdown` prior to 0.4.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing `data` or VBScript URIs and a base64-encoded payload.


## Recommendation

Upgrade to version 0.4.4 or later.
Vulnerability: GHSA-jxf5-7x3j-8j9m
Summary: Malicious Package in load-from-cwd-or-npm
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T18:19:14Z

Version 3.0.2 of `load-from-cwd-or-npm`  contains malicious code. The malware breaks functionality of the `purescript-installer` package by injecting targeted code.


## Recommendation

Upgrade to version 3.0.4 or later. There is no indication of further compromise.
Vulnerability: GHSA-2589-w6xf-983r
Summary: Cross-site scripting in react-bootstrap-table
Aliases: CVE-2021-23398
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-10T18:58:49Z

All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.
Vulnerability: GHSA-82mg-x548-gq3j
Summary: LDAP Injection in ldapauth
Aliases: CVE-2015-7294
Severity: HIGH
CWE: CWE-90
Published: 2020-08-31T22:49:46Z

Versions 2.2.4 and earlier of `ldapauth-fork` are affected by an LDAP injection vulnerability. This allows an attacker to inject and run arbitrary LDAP commands via the username parameter.



## Recommendation

ldapauth is not actively maintained, having not seen a publish since 2014. As a result, there is no patch available. Consider updating to use [ldapauth-fork](https://www.npmjs.com/package/ldapauth-fork) 2.3.3 or greater.
Vulnerability: GHSA-88h9-fc6v-jcw7
Summary: Unintended Require in larvitbase-www
Severity: MODERATE
Published: 2020-09-03T20:28:51Z

All versions of `larvitbase-www` are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an `require()` call. This allows attackers to execute any `.js` file in the same folder as the server is running.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-4662-j96g-mv46
Summary: Arbitrary Code Injection in reduce-css-calc
Aliases: CVE-2016-10548
Severity: CRITICAL
CWE: CWE-94
Published: 2018-06-07T19:43:06Z

Affected versions of `reduce-css-calc` pass input directly to `eval`. If user input is passed into the calc function, this may result in cross-site scripting on the browser, or remote code execution on the server.

## Proof of Concept

```
const reduceCSSCalc = require('reduce-css-calc');
console.log(reduceCSSCalc(`calc(                       (Buffer(10000)))`));
console.log(reduceCSSCalc(`calc(                       (global['fs'] = require('fs')))`));
console.log(reduceCSSCalc(`calc(                       (fs['readFileSync']("/etc/passwd", "utf-8")))`));
```



## Recommendation

Update to version 1.2.5 or later.
Vulnerability: GHSA-5wq6-v5cw-jvfr
Summary: Malicious Package in js-shas
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:03:36Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-w5q7-3pr9-x44w
Summary: Denial of Service in serialize-to-js
Severity: HIGH
Published: 2020-09-02T15:59:19Z

Versions of `serialize-to-js` prior to 2.0.0 are vulnerable to Denial of Service. User input is not properly validated, allowing attackers to provide inputs that lead the execution to loop indefinitely.


## Recommendation

Upgrade to version 2.0.0 or later.
Vulnerability: GHSA-crfh-jmv2-2f9v
Summary: Malicious Package in singale
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:03:11Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-7frv-9phw-vrvr
Summary: Authorization bypass in Strapi
Aliases: CVE-2020-27664
Severity: CRITICAL
CWE: CWE-862
Published: 2021-05-10T18:43:59Z

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.
Vulnerability: GHSA-wx77-rp39-c6vg
Summary: Regular Expression Denial of Service in markdown
Severity: LOW
CWE: CWE-400
Published: 2020-09-04T15:11:03Z

All versions of `markdown` are vulnerable to Regular Expression Denial of Service (ReDoS). The `markdown.toHTML()` function has significantly degraded performance when parsing long strings containing underscores. This may lead to Denial of Service if the parser accepts user input.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-3pcq-34w5-p4g2
Summary: forEachSeries and forEachLimit do not limit the number of requests
Aliases: CVE-2021-41167
Severity: HIGH
CWE: CWE-400
Published: 2021-10-21T17:49:30Z

### Impact

This is a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects.

### Patches

The problem has been patched in 1.0.4.

### Workarounds

There is no workaround aside from upgrading to 1.0.4.
Vulnerability: GHSA-5c6f-jpx7-cwq6
Summary: Directory Traversal in enserver
Aliases: CVE-2017-16209
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:13:11Z

Affected versions of `enserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-jp99-5h8w-gmxc
Summary: Sandbox Breakout / Arbitrary Code Execution in @zhaoyao91/eval-in-vm
Severity: CRITICAL
Published: 2020-09-04T15:03:13Z

All versions of `@zhaoyao91/eval-in-vm` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-6x8c-mvpv-5366
Summary: Directory Traversal in shit-server
Aliases: CVE-2017-16147
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:18:32Z

Affected versions of `shit-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-2c83-wfv3-q25f
Summary: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown
Severity: CRITICAL
CWE: CWE-78
Published: 2021-09-07T23:07:56Z

### Impact

A Remote Command Execution vulnerability was found in the rebber module,
which allowed execution of arbitrary commands. The reported problem came
from CodeBlocks, which could be escaped to insert malicious LaTeX.

Anyone using `rebber` without sanitation of code content or a custom
macro is impacted by this vulnerability. Here is an example of a Markdown
content that will exploit the vulnerability:

````markdown
```
\end{CodeBlock}

\immediate\write18{COMMAND > outputrce}
\input{outputrce}

\begin{CodeBlock}{text}
```
````

Will insert into the generated LaTeX the result of executing
`COMMAND` on the system.

### Patches

The vulnerability has been patched in version 5.2.1.
If impacted, you should update to this version as soon as possible.

### Workarounds

It is possible to mitigate the vulnerability without upgrading by using a
custom code macro. Please make sure this custom macro escapes your
closing LaTeX sequence. For the example above, use:

```javascript
const escaped = content.replace(new RegExp('\\\\end\\s*{CodeBlock}', 'g'), '')
```

### For more information

If you have any questions or comments about this advisory, open an issue in [ZMarkdown](https://github.com/zestedesavoir/zmarkdown/issues).
Vulnerability: GHSA-8r4g-cg4m-x23c
Summary: Denial of Service in node-static
Severity: MODERATE
CWE: CWE-400, CWE-248
Published: 2021-09-22T18:22:02Z

All versions of node-static are vulnerable to a Denial of Service. The package fails to catch an exception when user input includes null bytes. This allows attackers to access `http://host/%00` and crash the server.
Vulnerability: GHSA-gc25-3vc5-2jf9
Summary: Sandbox Breakout / Arbitrary Code Execution in sandbox
Severity: CRITICAL
Published: 2020-09-04T15:00:58Z

All versions of `sandbox` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-7p7h-4mm5-852v
Summary: Regular Expression Denial of Service in trim-newlines
Aliases: CVE-2021-33623
Severity: HIGH
CWE: CWE-400
Published: 2021-06-07T22:10:39Z

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Vulnerability: GHSA-72mh-269x-7mh5
Summary: Improper Certificate Validation in xmlhttprequest-ssl
Aliases: CVE-2021-31597
Severity: CRITICAL
CWE: CWE-295
Published: 2021-05-24T19:52:55Z

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Vulnerability: GHSA-3r8f-gphx-9m2c
Summary: Path Traversal in mcstatic
Aliases: CVE-2018-3730
Severity: HIGH
CWE: CWE-22
Published: 2018-07-27T17:04:16Z

All versions of `mcstatic` are vulnerable to path traversal.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
Vulnerability: GHSA-r74q-wqx8-2pr3
Summary: Downloads Resources over HTTP in nodeschnaps
Aliases: CVE-2016-10622
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:31Z

Affected versions of `nodeschnaps` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nodeschnaps`.


## Recommendation

Update to version 1.0.3 or later.
Vulnerability: GHSA-h45p-w933-jxh3
Summary: Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript 
Severity: MODERATE
CWE: CWE-347
Published: 2021-06-01T21:20:22Z

### Impact

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. 

This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In addition to these signatures, the ESDK uses AES-GCM encryption and all plaintext is verified before being released to a caller. There is no impact on the integrity of the ciphertext or decrypted plaintext, however some callers may rely on the the ECDSA signature for non-repudiation. Without validating the ECDSA signature, an actor with trusted KMS permissions to decrypt a message may also be able to encrypt messages. This update introduces a new API for callers who wish to stream only unsigned messages. 

For customers who process ESDK messages from untrusted sources, this update also introduces a new configuration to limit the number of Encrypted Data Keys (EDKs) that the ESDK will attempt to process per message. This configuration provides customers with a way to limit the number of AWS KMS Decrypt API calls that the ESDK will make per message. This setting will reject messages with more EDKs than the configured limit.

Finally, this update adds early rejection of invalid messages with certain invalid combinations of algorithm suite and header data.

### Patches

Fixed in versions 1.9 and 2.2. We recommend that all users upgrade to address these issues.

Customers leveraging the ESDK’s streaming features have several options to protect signature validation. One is to ensure that client code reads to the end of the stream before using released plaintext. With this release, using the new API for streaming and falling back to the non-streaming decrypt API for signed messages prevents using any plaintext from signed data before the signature is validated. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

Users processing ESDK messages from untrusted sources should use the new maximum encrypted data keys parameter. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

### Workarounds

None

### For more information

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#digital-sigs

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x
Vulnerability: GHSA-q4m3-2j7h-f7xw
Summary: Cross-Site Scripting in jquery
Aliases: CVE-2020-7656
Severity: MODERATE
CWE: CWE-79
Published: 2020-05-20T16:18:01Z

Versions of `jquery` prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 1.9.0 or later.
Vulnerability: GHSA-6qpr-9mc5-7gch
Summary: Command Injection in async-git
Aliases: CVE-2020-28490
Severity: CRITICAL
CWE: CWE-78
Published: 2021-04-12T19:50:20Z

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb')
Vulnerability: GHSA-cfc5-x58f-869w
Summary: Malicious Package in conistring
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:40:55Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-65j7-66p7-9xgf
Summary: Malicious Package in font-scrubber
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:51:55Z

Version 1.2.2 of `font-scrubber` contains malicious code as a postinstall script. The package attempts to upload sensitive files from the system to a remote server. The files include configuration files, command history logs, SSH keys and /etc/passwd.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-rv7p-mmwq-x674
Summary: Improper Input Validation and Code Injection in pdf-image
Aliases: CVE-2020-8132
Severity: HIGH
CWE: CWE-94, CWE-20
Published: 2021-05-10T18:46:58Z

Lack of input validation in pdf-image npm package version &lt;= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input.
Vulnerability: GHSA-6xm4-p6r2-mwrc
Summary: Malicious Package in cuffer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:47:30Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-3jfq-g458-7qm9
Summary: Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
Aliases: CVE-2021-32804
Severity: HIGH
CWE: CWE-22
Published: 2021-08-03T19:06:36Z

### Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

`node-tar` aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. 

This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. 

### Patches

3.2.2 || 4.4.14 || 5.0.6 || 6.1.1

NOTE: an adjacent issue [CVE-2021-32803](https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw) affects this release level. Please ensure you update to the latest patch levels that address CVE-2021-32803 as well if this adjacent issue affects your `node-tar` use case.

### Workarounds

Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths.

```js
const path = require('path')
const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  // either add this function...
  onentry: (entry) => {
    if (path.isAbsolute(entry.path)) {
      entry.path = sanitizeAbsolutePathSomehow(entry.path)
      entry.absolute = path.resolve(entry.path)
    }
  },

  // or this one
  filter: (file, entry) => {
    if (path.isAbsolute(entry.path)) {
      return false
    } else {
      return true
    }
  }
})
```

Users are encouraged to upgrade to the latest patch versions, rather than attempt to sanitize tar input themselves.
Vulnerability: GHSA-gc6c-5v9w-xmhw
Summary: Downloads Resources over HTTP in nodewebkit
Aliases: CVE-2016-10580
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:51:27Z

Affected versions of `nodewebkit` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nodewebkit`.


## Recommendation

No patch is currently available, and the package author has deprecated this package. 

The best path forward in mitigating this vulnerability is to use the [official installer](https://www.npmjs.com/nw) instead of this package, as per the package author's instructions.
Vulnerability: GHSA-xwqw-rf2q-xmhf
Summary: Cross-Site Scripting in buefy
Severity: HIGH
CWE: CWE-79
Published: 2020-09-01T21:23:38Z

Versions of buefy prior to 0.7.2 are vulnerable to Cross-Site Scripting, allowing attackers to manipulate the DOM and execute remote code. The autocomplete list renders user input as HTML without encoding.


## Recommendation

Upgrade to version 0.7.2 or later.
Vulnerability: GHSA-4pmg-jgm5-3jg6
Summary: Malicious Package in erquest
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:16:26Z

All versions of `erquest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-fm87-46vv-jqrr
Summary: Path Traversal in html-pages
Aliases: CVE-2018-3744
Severity: HIGH
CWE: CWE-35
Published: 2018-09-18T13:45:07Z

Versions of `html-pages` before 2.1.0 are vulnerable to path traversal.


## Recommendation

Update to version 2.1.0 or later.
Vulnerability: GHSA-v95x-h953-x7fg
Summary: Malicious Package in k0a_multer
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:47:55Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-8fr3-hfg3-gpgp
Summary: Open Redirect in node-forge
Aliases: CVE-2022-0122
Severity: MODERATE
CWE: CWE-601
Published: 2022-01-21T23:36:19Z

parseUrl functionality in node-forge mishandles certain uses of backslash such as https:/\/\/\ and interprets the URI as a relative path.
Vulnerability: GHSA-mgff-xpg3-3gwc
Summary: Malicious Package in bsae-x
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:42:25Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-r683-j2x4-v87g
Summary: node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Aliases: CVE-2022-0235
Severity: HIGH
CWE: CWE-173, CWE-601, CWE-200
Published: 2022-01-21T23:55:52Z

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability: GHSA-32j9-6qqm-mq9g
Summary: Unhandled case in node-lmdb
Aliases: CVE-2022-21164
Severity: HIGH
CWE: CWE-241, CWE-703
Published: 2022-03-17T00:00:27Z

The package node-lmdb before 0.9.7 is vulnerable to Denial of Service (DoS) when defining a non-invokable `ToString` value, which will cause a crash during type check.
Vulnerability: GHSA-j7cg-h9v9-6vqp
Summary: "Prototype Pollution in irrelon-path and @irrelon/path"
Aliases: CVE-2020-7708
Severity: CRITICAL
CWE: CWE-915
Published: 2021-05-06T17:29:19Z

The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.
Vulnerability: GHSA-7rg2-qxmf-hhx9
Summary: Session fixation in express-openid-connect
Aliases: CVE-2021-41246
Severity: MODERATE
CWE: CWE-384
Published: 2021-12-09T19:08:58Z

### Overview

Versions `2.3.0` up to and including `2.5.1` do not regenerate the session id and session cookie when user logs in.  This behavior opens up the application to various session fixation vulnerabilities.

### Am I affected?
You are affected by this vulnerability if you are using `express-openid-connect` version `2.3.0` up to and including `2.5.1` and use a custom session store.


### How to fix that?
Upgrade to version `>= 2.5.2`.

### Will this update impact my users?
The fix provided in patch will not affect your users.
Vulnerability: GHSA-5v2h-r2cx-5xgj
Summary: Inefficient Regular Expression Complexity in marked
Aliases: CVE-2022-21681
Severity: HIGH
CWE: CWE-1333
Published: 2022-01-14T21:04:46Z

### Impact

_What kind of vulnerability is it?_

Denial of service.

The regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings.
PoC is the following.

```javascript
import * as marked from 'marked';

console.log(marked.parse(`[x]: x

\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
```

_Who is impacted?_

Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.

### Patches

_Has the problem been patched?_

Yes

_What versions should users upgrade to?_

4.0.10

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Do not run untrusted markdown through marked or run marked on a [worker](https://marked.js.org/using_advanced#workers) thread and set a reasonable time limit to prevent draining resources.

### References

_Are there any links users can visit to find out more?_

- https://marked.js.org/using_advanced#workers
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [marked](https://github.com/markedjs/marked)