TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-q8j6-pwqx-pm96
Summary: Insecure template handling in Squirrelly
Aliases: CVE-2021-32819
Severity: HIGH
CWE: CWE-200
Published: 2021-05-17T20:58:02Z

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of squirrelly is currently 8.0.8. For complete details refer to the referenced GHSL-2021-023.
Vulnerability: GHSA-6q8q-rvf4-m4pg
Summary: Downloads Resources over HTTP in dalek-browser-chrome
Aliases: CVE-2016-10604
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:50:14Z

Affected versions of `dalek-browser-chrome` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dalek-browser-chrome`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available - the author of `dalek` recommends [`TestCafé`](http://devexpress.github.io/testcafe/). 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-3w76-x94r-pw44
Summary: Downloads Resources over HTTP in rs-brightcove
Aliases: CVE-2016-10676
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:42:16Z

Affected versions of `rs-brightcove` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `rs-brightcove`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-68gr-cmcp-g3mj
Summary: Directory Traversal in lactate
Severity: HIGH
CWE: CWE-22
Published: 2019-06-14T16:39:31Z

A crafted `GET` request can be leveraged to traverse the directory structure of a host using the lactate web server package, and request arbitrary files outside of the specified web root. This allows for a remote attacker to gain access to arbitrary files on the filesystem that the process has access to read.

Mitigating factors:
Only files that the user running `lactate` has permission to read will be accessible via this vulnerability.


[Proof of concept](https://hackerone.com/reports/296645):
Please globally install the `lactate` package and `cd` to a directory you wish to serve assets from. Next, run `lactate -p 8081` to start serving files from this location.

The following cURL request can be used to demonstrate this vulnerability by requesting the target `/etc/passwd` file:

```
curl "http://127.0.0.1:8081/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
```
```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
[...]
```


## Recommendation

As there is currently no fix for this issue selecting an alternative static web server would be the best choice.
Vulnerability: GHSA-w4pv-w56c-mg4v
Summary: Path Traversal in stattic
Aliases: CVE-2018-3734
Severity: HIGH
CWE: CWE-22
Published: 2018-07-18T21:20:15Z

Versions of `stattic` before 0.3.0 are vulnerable to path traversal allowing a remote attacker to read arbitrary files with any extension from the server that users `stattic`.


## Recommendation

Update to version 0.3.0 or later.
Vulnerability: GHSA-jc84-3g44-wf2q
Summary: Denial of Service in ecstatic
Aliases: CVE-2019-10775
Severity: MODERATE
CWE: CWE-400
Published: 2020-12-15T16:52:17Z

ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.
Vulnerability: GHSA-2cf2-2383-h4jv
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in querymen
Aliases: CVE-2020-7600
Severity: MODERATE
CWE: CWE-915
Published: 2021-05-07T16:16:43Z

querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.
Vulnerability: GHSA-xfhp-gmh8-r8v2
Summary: Regular Expression Denial of Service (ReDoS)
Aliases: CVE-2021-23354
Severity: HIGH
CWE: CWE-400
Published: 2021-03-19T21:22:10Z

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity.
Vulnerability: GHSA-7vrq-vg6p-32fw
Summary: Downloads Resources over HTTP in libxl
Aliases: CVE-2016-10585
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2019-02-18T23:34:48Z

Affected versions of `libxl` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `libxl`.


## Recommendation

The module author recommends installing the bindings using a pinned and verified version of SDK instead of the automated download. More information is available in the modules [README](https://www.npmjs.com/package/libxl).
Vulnerability: GHSA-x9r5-jxvq-4387
Summary: Self XSS on user input in jquery.terminal
Aliases: CVE-2021-43862
Severity: LOW
CWE: CWE-80
Published: 2022-01-06T22:48:56Z

### Impact
This is low impact and limited XSS, because code for XSS payload is always visible, but attacker can use other techniques to hide the code the victim sees.

Also if the application use execHash option and execute code from URL the attacker can use this URL to execute his code. The scope is limited because the javascript code inside html attribute used is added to span tag, so no automatic execution like with `onerror` on images is possible.

### Patches
Fixed version 2.31.1

### Workarounds
The user can use formatting that wrap whole user input and it's no op.

```javascript
$.terminal.new_formatter([/([\s\S]+)/g, '[[;;]$1]']);
```
The fix will only work when user of the library is not using different formatters (e.g. to highlight code in different way).

### References
The issue was reported here [jcubic/jquery.terminal#727](https://github.com/jcubic/jquery.terminal/issues/727)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [jcubic/jquery.terminal](https://github.com/jcubic/jquery.terminal)
* Email us at [jcubic@onet.pl](mailto:jcubic@onet.pl)
Vulnerability: GHSA-v2jq-9475-r5g8
Summary: Cross-Site Scripting in bootstrap-tagsinput
Aliases: CVE-2016-1000227
Severity: HIGH
CWE: CWE-79
Published: 2020-09-01T15:29:51Z

All versions of `bootstrap-tagsinput` are vulnerable to cross-site scripting when user input is passed into the `itemTitle` parameter unmodified, as the package fails to properly sanitize or encode user input for that parameter.



## Recommendation

This package is not actively maintained, and has not seen an update since 2015. 

Because of this, the simplest mitigation is to avoid using the `itemTitle` parameter. With over 200 open issues and over 100 open pull requests as of 2/2018, it seems unlikely that the author has any intention of maintaining the module. If avoiding the use of `itemTitle` indefinitely is acceptable, this is a workable solution. If not, the best available mitigation is to use a fork of the module that is actively maintained and provides similar functionality. There are [many such forks to choose from available on github.](https://github.com/bootstrap-tagsinput/bootstrap-tagsinput/network/members).
Vulnerability: GHSA-rv49-54qp-fw42
Summary: Path Traversal in servey
Severity: MODERATE
CWE: CWE-22
Published: 2019-06-06T15:30:20Z

Versions of `servey` prior to 3.x are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to the latest version
Vulnerability: GHSA-4627-w373-375v
Summary: Malicious Package in grunt-radical
Severity: CRITICAL
Published: 2020-09-11T21:22:24Z

Version 0.0.14 of `grunt-radical` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-r2gr-fhmr-66c5
Summary: "Arbitrary code execution in socket.io-file"
Aliases: CVE-2020-24807
Severity: HIGH
CWE: CWE-20
Published: 2021-05-10T18:38:11Z

"The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer."
Vulnerability: GHSA-m874-69ww-w7jq
Summary: Directory Traversal in whispercast
Aliases: CVE-2017-16174
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:45:01Z

Affected versions of `whispercast` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-qw93-45r3-p66p
Summary: Prototype Pollution in merge-options
Aliases: CVE-2018-3752
Severity: CRITICAL
CWE: CWE-20
Published: 2018-10-09T00:19:57Z

All versions of `merge-options` are vulnerable to Prototype Pollution


## Recommendation

Update to version 1.0.1 or greater.
Vulnerability: GHSA-gxpj-cx7g-858c
Summary: Regular Expression Denial of Service in debug
Aliases: CVE-2017-16137
Severity: LOW
CWE: CWE-400
Published: 2018-08-09T20:18:07Z

Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. 

As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.


## Recommendation

Version 2.x.x: Update to version 2.6.9 or later.
Version 3.x.x: Update to version 3.1.0 or later.
Vulnerability: GHSA-vrxj-4qhw-5vwq
Summary: Malicious Package in scryptys
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:03:41Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-84cm-x2q5-8225
Summary: Critical severity vulnerability that affects dojox
Aliases: CVE-2018-15494
Severity: CRITICAL
CWE: CWE-116
Published: 2018-10-15T22:03:48Z

In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
Vulnerability: GHSA-2r9c-46v3-43fc
Summary: Downloads Resources over HTTP in haxe3
Aliases: CVE-2016-10688
Severity: HIGH
CWE: CWE-311
Published: 2018-08-17T20:28:13Z

Affected versions of `haxe3` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `haxe3`.


## Recommendation

No patch is currently available for this vulnerability. This vulnerability has been left unpatched for several years, despite active maintenance on the package. Because of this, it appears that the package author has accepted the risk, and is unlikely to patch this package in the future.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-vf26-7gjf-f92r
Summary: OS Command Injection in rpi
Aliases: CVE-2019-10796
Severity: MODERATE
CWE: CWE-78
Published: 2021-04-13T15:23:29Z

rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization.
Vulnerability: GHSA-9q5w-79cv-947m
Summary: Unsafe defaults in `remark-html`
Aliases: CVE-2021-39199
Severity: CRITICAL
CWE: CWE-79
Published: 2021-09-07T23:10:56Z

### Impact

The documentation of `remark-html` has mentioned that it was safe by default. In practise the default was never safe and had to be opted into. This means arbitrary HTML can be passed through leading to potential XSS attacks.

### Patches

The problem has been patched in 13.0.2 and 14.0.1: `remark-html` is now safe by default, and the implementation matches the documentation.

### Workarounds

On older affected versions, pass `sanitize: true`, like so:

```diff
-  .use(remarkHtml)
+  .use(remarkHtml, {sanitize: true})
```

### References

n/a

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [`remark-html`](https://github.com/remarkjs/remark-html)
* Email us at [security@unifiedjs.com](mailto:security@unifiedjs.com)
Vulnerability: GHSA-8p5p-ff7x-hw7q
Summary: Cross-Site Scripting in public
Aliases: CVE-2018-3747
Severity: MODERATE
CWE: CWE-79
Published: 2018-10-10T17:27:58Z

Versions of `public` prior to 0.1.4 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

Upgrade to version 0.1.4 or later.
Vulnerability: GHSA-vhxc-fhm5-qcp9
Summary: Prototype Pollution in bodymen
Aliases: CVE-2022-25296
Severity: MODERATE
CWE: CWE-1321
Published: 2022-03-18T00:01:11Z

The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives from an incomplete fix to [CVE-2019-10792](https://security.snyk.io/vuln/SNYK-JS-BODYMEN-548897)
Vulnerability: GHSA-mvch-rh6h-2m47
Summary: Malicious Package in equest
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-11T21:10:29Z

All versions of `equest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-wjr4-2jgw-hmv8
Summary: Command Injection in whereis
Aliases: CVE-2018-3772
Severity: HIGH
CWE: CWE-77
Published: 2018-07-31T18:28:53Z

Versions of `whereis` before 0.4.1 are vulnerable to command injection if untrusted user input is passed into `whereis`.


## Recommendation

Update to version 0.4.1 or later.
Vulnerability: GHSA-x5m8-2r8v-8f97
Summary: Prototype Pollution in libnested
Aliases: CVE-2022-25352
Severity: CRITICAL
CWE: CWE-1321
Published: 2022-03-18T00:01:11Z

The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)
Vulnerability: GHSA-9272-59x2-gwf2
Summary: Malicious Package in ripedm160
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:04:13Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-886v-mm6p-4m66
Summary: High severity vulnerability that affects gun
Severity: HIGH
CWE: CWE-22
Published: 2019-06-05T09:48:02Z

## Urgent Upgrade

The static file server module included with GUN had a **serious vulnerability**:

 - Using `curl --path-as-is` allowed reads on any parent directory or files.

This did not work via the browser or via curl without as-is option.

 ### Fixed

This has been fixed since version `0.2019.416` and higher.

 ### Who Was Effected?

Most NodeJS users who use the default setup, such as:

 - `npm start`
 - `node examples/http.js`
 - `Heroku` 1-click-deploy
 - `Docker`
 - `Now`

If you have a custom NodeJS code then you are probably safe *unless* you have something like `require('http').createServer(Gun.serve(__dirname))` in it.

If you have not upgraded, it is **mandatory** or else it is highly likely your environment variables and AWS (or other) keys could be leaked.

 ### Credit

It was reported and fixed by [JK0N](https://github.com/amark/gun/pull/527), but I did not understand the `--path-as-is` condition.

Joonas Loppi from [function61](http://function61.com) rediscovered it and explained the urgency to me to fix it.
Vulnerability: GHSA-33f9-j839-rf8h
Summary: Prototype Pollution in immer
Aliases: CVE-2021-23436
Severity: CRITICAL
CWE: CWE-843, CWE-1321
Published: 2021-09-02T17:17:37Z

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.
Vulnerability: GHSA-pgh6-m65r-2rhq
Summary: DOS and Open Redirect with user input
Aliases: CVE-2021-22964
Severity: HIGH
CWE: CWE-248, CWE-601
Published: 2021-10-12T16:04:17Z

### Impact

A redirect vulnerability in the `fastify-static` module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.

A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is "http://localhost:3000//^/.."`

The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.

### Patches
The issue has been patched in `fastify-static@4.4.1`

### Workarounds
If updating is not an option, you can sanitize the input URLs using the [`rewriteUrl`](https://www.fastify.io/docs/latest/Server/#rewriteurl) server option.

### References

+ Bug founder: drstrnegth
+ [hackerone Report](https://hackerone.com/reports/1361804)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fastify-static](https://github.com/fastify/fastify-static)
* Contact the [security team](https://github.com/fastify/fastify/blob/main/SECURITY.md#the-fastify-security-team)
Vulnerability: GHSA-qh7x-j4v8-qw5w
Summary: Clipboard-based XSS
Aliases: CVE-2021-41086
Severity: HIGH
CWE: CWE-79
Published: 2021-09-22T20:39:26Z

### Impact
XSS against the user.

### Details
jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` causing XSS.

### References
The Curious Case of Copy & Paste – on risks of pasting arbitrary content in browsers: https://research.securitum.com/the-curious-case-of-copy-paste/
Vulnerability: GHSA-v9w2-v7j9-rjpr
Summary: Remote code execution in Eclipse Theia
Aliases: CVE-2021-34435
Severity: HIGH
CWE: CWE-942, CWE-668
Published: 2021-09-02T22:02:36Z

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file.
Vulnerability: GHSA-333w-rxj3-f55r
Summary: Regular Expression Denial Of Service in uri-js
Aliases: CVE-2017-16021
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T20:00:30Z

Affected versions of `uri-js` is susceptible to a regular expression denial of service vulnerability when user input is sent to the `.parse()` method.



## Recommendation

Update to v3.0.0 or later.
Vulnerability: GHSA-cfxm-4p54-5w7h
Summary: Directory traversal in pooledwebsocket
Aliases: CVE-2017-16107
Severity: HIGH
CWE: CWE-22
Published: 2018-07-24T00:20:57Z

Affected versions of `pooledwebsocket` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

Update to version 0.0.19 or later.
Vulnerability: GHSA-7543-mr7h-6v86
Summary: Improper Authorization in googleapis
Severity: HIGH
CWE: CWE-285
Published: 2020-09-02T16:00:26Z

Versions of `googleapis` prior to 39.1.0 are vulnerable to Improper Authorization. Setting credentials to one client may apply to all clients which may cause requests to be sent with the incorrect credentials.


## Recommendation

Upgrade to version 39.1.0.
Vulnerability: GHSA-9xr8-8hmc-389f
Summary: Cross-Site Scripting in vant
Severity: HIGH
CWE: CWE-79
Published: 2019-11-22T13:45:33Z

Versions of `vant` prior to 2.1.8 are vulnerable to Cross-Site Scripting. The text value of the `Picker` component column is not sanitized, which may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 2.1.8 or later.
Vulnerability: GHSA-r2vw-jgq9-jqx2
Summary: Improper Authorization in @sap-cloud-sdk/core
Severity: HIGH
CWE: CWE-285
Published: 2020-09-03T15:54:11Z

Affected versions of `@sap-cloud-sdk/core` do not properly validate JWTs.  The `verifyJwt()` function does not properly validate the URL from where the public verification key for the JWT can be downloaded.  Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT.


## Recommendation

Upgrade to version 1.21.2 or later.
Vulnerability: GHSA-5rqg-jm4f-cqx7
Summary: Infinite loop causing Denial of Service in colors
Severity: HIGH
CWE: CWE-835
Published: 2022-01-10T17:29:53Z

colors is a library for including colored text in node.js consoles. Between 07 and 09 January 2022, colors versions 1.4.1, 1.4.2, and 1.4.44-liberty-2 were published including malicious code that caused a Denial of Service due to an infinite loop. Software dependent on these versions experienced the printing of randomized characters to console and an infinite loop resulting in unbound system resource consumption.

Users of colors relying on these specific versions should downgrade to version 1.4.0.
Vulnerability: GHSA-frpw-jrwx-hcfv
Summary: Path Traversal in node-red-contrib-huemagic
Aliases: CVE-2021-25864
Severity: HIGH
CWE: CWE-22
Published: 2021-04-13T15:30:00Z

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file.
Vulnerability: GHSA-jwjq-vp53-ph6m
Summary: Directory Traversal in pytservce
Aliases: CVE-2017-16195
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:21:44Z

Affected versions of `pytservce` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-mmqv-m45h-q2hp
Summary: Sandbox Breakout / Arbitrary Code Execution in localeval
Severity: CRITICAL
Published: 2020-09-04T15:22:40Z

All versions of `localeval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `constructor.constructor`. This may allow attackers to execute arbitrary code in the system.  Evaluating the payload 
```
constructor.constructor("return process.env")()
``` 

returns the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-37q6-576q-vgr7
Summary: Missing Origin Validation in parcel-bundler
Aliases: CVE-2018-14731
Severity: HIGH
CWE: CWE-200
Published: 2018-10-30T20:36:53Z

Versions of `parcel-bundler` before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.


## Recommendation

Update to version 1.10.0 or later.
Vulnerability: GHSA-9gxr-rhx6-4jgv
Summary: Sandbox Breakout / Prototype Pollution in notevil
Severity: MODERATE
CWE: CWE-1321
Published: 2020-09-04T15:18:57Z

Versions of `notevil` prior to 1.3.3 are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype.

Evaluating the payload ```try{a[b];}catch(e){e.constructor.constructor('return __proto__.arguments.callee.__proto__.polluted=true')()}``` add the `polluted` property to Function.


## Recommendation

Upgrade to version 1.3.3 or later.
Vulnerability: GHSA-gg96-f8wr-p89f
Summary: Script injection
Aliases: CVE-2021-32661
Severity: MODERATE
CWE: CWE-77, CWE-434
Published: 2021-06-04T19:09:26Z

### Impact

A malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an `object` element. This may give access to sensitive data when other users visit that same documentation page.

The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store.

### Patches

The vulnerability is patched in the `0.9.5` release of `@backstage/plugin-techdocs`.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-r742-7j4h-hjr8
Summary: Malicious Package in arsenic-tabasco-cyborg-peanut-butter
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:27:36Z

All versions of `arsenic-tabasco-cyborg-peanut-butter` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-f8h3-rqrm-47v9
Summary: Prototype Pollution in smart-extend
Severity: MODERATE
CWE: CWE-1321
Published: 2020-09-02T16:02:40Z

All versions of `smart-extend` are vulnerable to Prototype Pollution. The `deep()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-2m39-62fm-q8r3
Summary: Regular Expression Denial of Service in sshpk
Aliases: CVE-2018-3737
Severity: HIGH
CWE: CWE-770
Published: 2018-08-15T13:22:23Z

Versions of `sshpk` before 1.13.2 or 1.14.1 are vulnerable to regular expression denial of service when parsing crafted invalid public keys.


## Recommendation

Update to version 1.13.2, 1.14.1 or later.
Vulnerability: GHSA-cgpp-wm2h-6hqx
Summary: SQL Injection in waterline-sequel
Aliases: CVE-2016-10551
Severity: HIGH
CWE: CWE-89
Published: 2019-02-18T23:54:28Z

Affected versions of `waterline-sequel` are vulnerable to SQL injection in cases where user input is passed into the `like`, `contains`, `startsWith`, or `endsWith` methods.



## Recommendation

Upgrade to at least version 0.5.1
Vulnerability: GHSA-pgr8-jg6h-8gw6
Summary: Cross-Site Scripting in webpack-bundle-analyzer
Severity: MODERATE
CWE: CWE-79
Published: 2019-05-23T09:26:20Z

Versions of `webpack-bundle-analyzer` prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses `JSON.stringify()` without properly escaping input which may lead to Cross-Site Scripting.


## Recommendation

Upgrade to version 3.3.2 or later.
Vulnerability: GHSA-3wqh-h42r-x8fq
Summary: Denial of Service in @hapi/subtext
Severity: HIGH
Published: 2020-09-03T15:46:22Z

Versions of `@hapi/subtext` prior to 6.1.3 or 7.0.3 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 6.1.3 or 7.0.3
Vulnerability: GHSA-x52f-h74p-9jh8
Summary: Hijacked Environment Variables in node-sqlite
Aliases: CVE-2017-16048
Severity: HIGH
CWE: CWE-506, CWE-200
Published: 2018-07-23T21:00:07Z

The `node-sqlite` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation




As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-j866-8vxx-27hx
Summary: Hijacked Environment Variables in nodemailer.js
Aliases: CVE-2017-16072
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-29T23:43:53Z

The `nodemailer.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-7cvf-p83w-48q6
Summary: Malicious Package in beffer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:37:29Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-r96c-57pf-9jjm
Summary: Prototype Pollution in node.extend
Aliases: CVE-2018-16491
Severity: MODERATE
CWE: CWE-400
Published: 2019-02-07T18:17:34Z

Versions of `node.extend` before 1.1.7 or 2.0.1 are vulnerable to prototype pollution. 


## Recommendation

Update to version 1.1.7, 2.0.1 or later.
Vulnerability: GHSA-2g8g-63j4-9w3r
Summary: RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend
Severity: HIGH
Published: 2021-12-01T18:29:12Z

The templating library used by the scaffolder backend assumes that templates are trusted which is an undesired property of the scaffolder-backend. This has now been mitigated by sandboxing the template code execution.

### Impact
A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template yaml definition itself and not by user input data.

### Patches
This is vulnerability is patched in version `0.15.14` of `@backstage/plugin-scaffolder-backend`.


### For more information
If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-p5p2-rhc3-wmf3
Summary: Malicious Package in siganle
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:03:31Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-fg6m-q92x-vv38
Summary: Directory Traversal in dcserver
Aliases: CVE-2017-16158
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:26:00Z

Affected versions of `dcserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-8p2p-p8mg-x3cw
Summary: Insight API transaction broadcast endpoint can result in Full Path Disclosure
Aliases: CVE-2018-1000023
Severity: MODERATE
CWE: CWE-20
Published: 2018-03-05T19:33:54Z

Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request.
Vulnerability: GHSA-wrw9-m778-g6mc
Summary: Memory Exposure in bl
Severity: MODERATE
CWE: CWE-200
Published: 2019-06-03T17:27:57Z

Versions of `bl` before 0.9.5 and 1.0.1 are vulnerable to memory exposure.

`bl.append(number)` in the affected `bl` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory


## Recommendation

Update to version 0.9.5, 1.0.1 or later.
Vulnerability: GHSA-894f-rw44-qrw5
Summary: Hijacked Environment Variables in mongose
Aliases: CVE-2017-16077
Severity: MODERATE
CWE: CWE-506
Published: 2018-10-10T17:28:21Z

The `mongose` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-4v2c-g2xc-47fv
Summary: Downloads Resources over HTTP in massif
Aliases: CVE-2016-10682
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:54:38Z

Affected versions of `massif` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `massif`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-cr6m-62pq-hmqh
Summary: OS Command injection in npm-lockfile
Aliases: CVE-2022-0841
Severity: CRITICAL
CWE: CWE-78
Published: 2022-03-04T00:00:18Z

npm-lockfile safely generates an npm lockfile and output it to the filename of your choice. npm-lockfile before 2.0.4 does not santize unsafe external input and invoke sensitive command execution API with the input, causing command injection vulnerability. A fix was released in version 2.0.5.
Vulnerability: GHSA-mvmf-cvfx-qg55
Summary: Regular Expression Denial of Service in bleach
Aliases: CVE-2014-8881
Severity: MODERATE
CWE: CWE-400
Published: 2020-09-01T15:16:43Z

All versions of the `bleach` package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function.



## Recommendation

The `bleach` package is not currently maintained, and has not seen an update since 2014. 

To mitigate this issue, it is necessary to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=html%20sanitizer&page=1&ranking=optimal).
Vulnerability: GHSA-3cjv-4phw-gvvv
Summary: Malicious Package in getcookies
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T20:39:33Z

The `getcookies` module contained a backdoor that would allow for a remote attacker to execute arbitrary commands on the system running the malicious module.


## Recommendation

This module should be uninstalled if found used within an application. In addition to removing the installed module, you will also want to evaluate your application to determine whether or not user data or systems were compromised.
Vulnerability: GHSA-8f64-q7jc-ccgp
Summary: Cross-Site Scripting in metascraper
Aliases: CVE-2018-3773
Severity: HIGH
CWE: CWE-79
Published: 2018-08-08T22:25:57Z

Versions of `metascraper` prior to 5.3.0 are vulnerable to stored cross-site scripting (XSS).


## Recommendation

Upgrade to version 5.3.0 or later.
Vulnerability: GHSA-c6rq-rjc2-86v2
Summary: Time-of-check Time-of-use (TOCTOU) Race Condition in chownr
Aliases: CVE-2017-18869
Severity: LOW
CWE: CWE-367
Published: 2022-02-10T23:33:39Z

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.
Vulnerability: GHSA-2777-2vq8-c4v4
Summary: SQL Injection in sequelize
Aliases: CVE-2019-11069
Severity: HIGH
CWE: CWE-20
Published: 2019-04-11T16:33:17Z

Versions of `sequelize` prior to 5.3.0 (excluding v3 and v4) are vulnerable to SQL Injection. PostgreSQL option`standard_conforming_strings` is not set to `on` by default, which may allow attackers to inject SQL statements due to poor handling of backslashes in string literals.


## Recommendation

Upgrade to version 5.3.0 or later.
Vulnerability: GHSA-5f38-9jw2-6r6h
Summary: Cross-site Scripting in teddy
Aliases: CVE-2021-23447
Severity: MODERATE
CWE: CWE-79, CWE-843
Published: 2021-10-12T16:22:04Z

Teddy is a readable and easy to learn templating language. This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).
Vulnerability: GHSA-xh56-3f5w-9h25
Summary: Hijacked Environment Variables in nodemailer-js
Aliases: CVE-2017-16071
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-29T23:40:01Z

The `nodemailer-js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-cjj8-wfrx-jqcf
Summary: Cross-Site Scripting (XSS) in pivottable
Aliases: CVE-2016-1000241
Severity: HIGH
CWE: CWE-79
Published: 2020-09-01T16:00:18Z

Affected versions of `pivottable` are vulnerable to cross-site scripting, due to a new mechanism used to render JSON elements.


## Recommendation

Update to version 2.0.0 or later.
Vulnerability: GHSA-4q69-q4q7-x82c
Summary: High severity vulnerability that affects rendertron
Aliases: CVE-2017-18353
Severity: HIGH
Published: 2019-01-04T17:41:46Z

Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application.
Vulnerability: GHSA-f4hq-453j-p95f
Summary: Open redirect in Slashify
Aliases: CVE-2021-3189
Severity: HIGH
CWE: CWE-601
Published: 2021-02-05T20:43:34Z

The package is an Express middleware that normalises routes by stripping any final slash, redirecting, for example, `bookings/latest/` to `bookings/latest`. However, it does not validate the path it redirects to in any way. In particular, if the path starts with two slashes (or two backslashes, or a slash and a backslash, etc.) it may redirect to a different domain.

Consider the [example from the docs](https://www.npmjs.com/package/slashify#usage). Assume we have run it and started a server on `localhost:3000`, then visiting `localhost:3000///github.com/` redirects you to https://github.com.

## Recommendation

This vulnerability is currently un-patched in the `slashify` package so there is no known safe version of this package. Discontinuing use of `slashify` is recommended.
Vulnerability: GHSA-fv9m-f7w4-889c
Summary: Exfiltrates Discord login tokens to pastebin in discordi.js
Aliases: CVE-2017-16207
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-06T21:43:03Z

The `discordi.js` package is malware that attempts to discover and exfiltrate a user's [Discord](https://discordapp.com/) credentials, sending them to pastebin.

All versions have been unpublished from the npm registry.


## Recommendation

Do not install / use this module. It has been unpublished from the npm registry but may exist in some caches. Any users that logged into Discord using this library will need to change their credentials.
Vulnerability: GHSA-qcc9-q247-3m2m
Summary: Malicious Package in js-regular
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:46:49Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-qx4v-6gc5-f2vv
Summary: Regular Expression Denial of Service
Severity: MODERATE
CWE: CWE-400
Published: 2019-06-20T14:32:56Z

A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop.
Vulnerability: GHSA-58g2-9fqr-36q2
Summary: Prototype Pollution in Proto
Aliases: CVE-2021-23426
Severity: HIGH
CWE: CWE-1321
Published: 2021-09-02T22:01:01Z

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function.