TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-954c-jjx6-cxv7
Summary: Reflected XSS from the callback handler's error query parameter
Aliases: CVE-2021-32702
Severity: HIGH
CWE: CWE-79
Published: 2021-06-28T16:46:41Z

### Overview

Versions before and including `1.4.1` are vulnerable to reflected XSS.  An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message.

### Am I affected?
You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless** you are using custom error handling that does not return the error message in an HTML response.

### How to fix that?
Upgrade to version `1.4.2`.

### Will this update impact my users?
The fix adds basic HTML escaping to the error message and it should not impact your users.

### Credit

https://github.com/inian
https://github.com/git-ishanpatel
Vulnerability: GHSA-5p5w-j3g7-w4wv
Summary: Authentication bypass via incorrect XML canonicalization and DOM traversal in saml2-js
Aliases: CVE-2017-11429
Severity: MODERATE
CWE: CWE-287
Published: 2019-07-05T21:11:18Z

Versions of `saml2-js` prior to 1.12.4 or 2.0.2 are vulnerable to authentication bypass.

The `saml2-js` library may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Security Assertion Markup Language (SAML) is an XML-based markup language for security assertions regarding authentication and permissions, most commonly used for single sign-on (SSO) services.

Some XML DOM traversal and canonicalization APIs may be inconsistent in handling of comments within XML nodes. Incorrect use of these APIs by some SAML libraries results in incorrect parsing of the inner text of XML nodes such that any inner text after the comment is lost prior to cryptographically signing the SAML message. Text after the comment therefore has no impact on the signature on the SAML message.

A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider


## Recommendation

If you use 1.x upgrade to version 1.12.4 or greater 
If you use 2.x upgrade to version 2.02 or greater
Vulnerability: GHSA-97gv-3p2c-xw7j
Summary: Denial of Service and Content Injection in i18n-node-angular
Aliases: CVE-2016-10524
Severity: HIGH
CWE: CWE-74, CWE-400
Published: 2019-02-18T23:39:06Z

Versions of `i18n-node-angular` prior to 1.4.0 are affected by denial of service and cross-site scripting vulnerabilities. The vulnerabilities exist in a REST endpoint that was created for development purposes, but was not disabled in production in affected versions.


## Recommendation

Update to version 1.4.0 or later.
Vulnerability: GHSA-w7jg-972m-rphv
Summary: Directory Traversal in susu-sum
Aliases: CVE-2017-16199
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:17:28Z

Affected versions of `susu-sum` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-h2jv-5v3f-7m7j
Summary: Downloads Resources over HTTP in adamvr-geoip-lite
Aliases: CVE-2016-10680
Severity: MODERATE
CWE: CWE-311
Published: 2020-09-01T16:10:03Z

Affected versions of `adamvr-geoip-lite` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-4g7x-7vgq-3j28
Summary: Vulnerability in list function leads to arbitrary code execution via filePath parameters
Aliases: CVE-2020-36376
Severity: CRITICAL
CWE: CWE-77, CWE-78
Published: 2021-11-02T15:42:16Z

aaptjs is a node wraper for aapt. An issue was discovered in the list function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
Vulnerability: GHSA-gr4j-r575-g665
Summary: Cross-Site Scripting in highcharts
Severity: HIGH
CWE: CWE-79
Published: 2020-08-25T14:04:47Z

Versions of `highcharts` prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS).  The package fails to sanitize `href` values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link.
Vulnerability: GHSA-fvqr-27wr-82fm
Summary: Prototype Pollution in lodash
Aliases: CVE-2018-3721
Severity: LOW
CWE: CWE-471
Published: 2018-07-26T15:14:52Z

Versions of `lodash` before 4.17.5 are vulnerable to prototype pollution. 

The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.17.5 or later.
Vulnerability: GHSA-8mm3-2mcj-cx6r
Summary: Malicious Package in angluar-cli
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-11T21:09:24Z

Version 0.0.3 of `angluar-cli` contains malicious code as a postinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed the package attempts to remove files and stop processes related to McAfee antivirus on macOS.


## Recommendation

Remove the package from your environment and verify whether files were deleted and if processes were stopped.
Vulnerability: GHSA-j5jc-jf8f-86q7
Summary: Malicious Package in dictum.js
Severity: CRITICAL
Published: 2020-09-01T20:38:30Z

Version 1.0.5 of `dictum.js` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.5 of this module is found installed you will want to replace it with a version before or after 1.0.5. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-6xhg-q9c8-rj32
Summary: Credential leak in react-native-fast-image
Aliases: CVE-2020-7696
Severity: MODERATE
CWE: CWE-200
Published: 2021-05-18T01:52:54Z

This affects all versions before version 8.3.0 of package react-native-fast-image. When an image with source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }} is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.
Vulnerability: GHSA-9h4g-27m8-qjrg
Summary: Path Traversal in socket.io-file
Aliases: CVE-2020-15779
Severity: HIGH
CWE: CWE-22
Published: 2020-07-07T19:24:47Z

All versions of `socket.io-file` are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths. The `socket.io-file::createFile` message contains a `name` option that is passed directly to `path.join()`.   It is possible to upload files to arbitrary folders on the server by sending relative paths on the `name` value, such as `../../test.js`.  The `uploadDir` and `rename` options can be used to define the file upload path.
Vulnerability: GHSA-33gc-f8v9-v8hm
Summary: Malicious Package in ladder-text-js
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T20:41:40Z

`ladder-text-js` contained a malicious script that attempted to delete all files when `npm test` was run.



## Recommendation

This module has been unpublished from the npm Registry. If you find this module in your environment remove it.
Vulnerability: GHSA-vr98-27qj-3c8q
Summary: Directory traversal in rollup-plugin-server
Aliases: CVE-2020-7686
Severity: HIGH
CWE: CWE-22
Published: 2020-07-29T18:07:35Z

This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function.
Vulnerability: GHSA-37hx-4mcq-wc3h
Summary: Weak Password Recovery Mechanism for Forgotten Password in Strapi
Aliases: CVE-2021-28128
Severity: HIGH
CWE: CWE-640
Published: 2021-10-06T17:48:16Z

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.
Vulnerability: GHSA-6m4r-m3gc-h4r5
Summary: OS Command Injection in install-package
Aliases: CVE-2020-7629
Severity: CRITICAL
CWE: CWE-78
Published: 2022-02-10T23:48:06Z

install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
Vulnerability: GHSA-3p92-886g-qxpq
Summary: Remote Memory Exposure in floody
Severity: MODERATE
CWE: CWE-201
Published: 2019-06-04T15:42:32Z

Versions of `floody` before 0.1.1 are vulnerable to remote memory exposure.

.write(number)` in the affected `floody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory.

Proof of Concept: 

```
var f = require('floody')(process.stdout); 
f.write(USERSUPPLIEDINPUT); 
'f.stop();


## Recommendation

Update to version 0.1.1 or later.
Vulnerability: GHSA-f98m-q3hr-p5wq
Summary: Prototype Pollution in locutus
Aliases: CVE-2020-7719
Severity: CRITICAL
CWE: CWE-915, CWE-20
Published: 2021-05-06T18:12:22Z

All versions of package locutus prior to version 2.0.12 are vulnerable to Prototype Pollution via the php.strings.parse_str function.
Vulnerability: GHSA-xwjh-cp99-cj8q
Summary: Path Traversal in cordova-plugin-ionic-webview
Aliases: CVE-2018-16202
Severity: HIGH
CWE: CWE-22
Published: 2019-02-12T15:36:35Z

Versions of `cordova-plugin-ionic-webview` prior to 2.2.0 are vulnerable to Path Traversal, allowing attackers access to OS local files that should be inaccessible by third-party applications.  The package launches a webserver listening on http://localhost:8080 without restricting access of the app itself, thus escaping the iOS application sandbox and accessing local files.


## Recommendation

Upgrade to version 2.2.0
Vulnerability: GHSA-4w97-57v2-3w44
Summary: False-negative validation results in MINT transactions with invalid baton
Aliases: CVE-2020-11072
Severity: CRITICAL
CWE: CWE-697
Published: 2020-05-12T00:45:24Z

### Impact
Users could experience false-negative validation outcomes for [MINT](https://github.com/simpleledger/slp-specifications/blob/master/slp-token-type-1.md#mint---extended-minting-transaction) transaction operations.  A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton.

### Patches
npm package [slp-validate](https://www.npmjs.com/package/slp-validate) has been patched and published as version 1.2.1.

### Workarounds
Upgrade to slp-validate 1.2.1.

### References
* slp-validate [commit](https://github.com/simpleledger/slp-validate/commit/cde95c0c6470dceb4f023cd462f904135ebd73e7)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [slp-validate](https://github.com/simpleledger/slp-validate/issues)
Vulnerability: GHSA-22cm-3qf2-2wc7
Summary: LDAP Injection in is-user-valid
Aliases: CVE-2021-23335
Severity: HIGH
CWE: CWE-74, CWE-90
Published: 2021-04-13T15:30:27Z

All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure.
Vulnerability: GHSA-jc83-cpf9-q7c6
Summary: False-negative validation results in MINT transactions with invalid baton
Aliases: CVE-2020-11071
Severity: CRITICAL
CWE: CWE-697
Published: 2020-05-12T00:39:03Z

### Impact
Users could experience false-negative validation outcomes for [MINT](https://github.com/simpleledger/slp-specifications/blob/master/slp-token-type-1.md#mint---extended-minting-transaction) transaction operations.  A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton.

### Patches
npm package [slpjs](https://www.npmjs.com/package/slpjs) has been patched and published as version 0.27.2.


### Workarounds
Upgrade to slpjs 0.27.2.

### References
* slpjs [commit](https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [slp-validate](https://github.com/simpleledger/slp-validate/issues) or [slpjs](https://github.com/simpleledger/slpjs/issues)
Vulnerability: GHSA-6xv6-jpvw-cx6q
Summary: Command injection in bestzip
Aliases: CVE-2020-7730
Severity: CRITICAL
CWE: CWE-78
Published: 2021-05-06T18:27:36Z

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.
Vulnerability: GHSA-92v9-xh2q-fq9f
Summary: Prototype Pollution in @cookiex/deep
Aliases: CVE-2021-23442
Severity: HIGH
CWE: CWE-915, CWE-1321
Published: 2021-09-20T20:12:38Z

The npm @cookiex/deep package before version 0.0.7 has a prototype pollution vulnerability. The global proto object can be polluted using the __proto__ object.
Vulnerability: GHSA-39cx-xcwj-3rc4
Summary: Cross-Site Scripting in dojo
Aliases: CVE-2008-6681
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-01T15:25:29Z

Affected versions of `dojo` are susceptible to a cross-site scripting vulnerability in the `dijit.Editor` and `textarea` components, which execute their contents as Javascript, even when sanitized.


## Recommendation

Update to version 1.1 or later.
Vulnerability: GHSA-f794-r6xc-hf3v
Summary: Improper Access Control in passport-oauth2
Aliases: CVE-2021-41580
Severity: MODERATE
CWE: CWE-287
Published: 2021-09-29T17:18:32Z

The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability.
Vulnerability: GHSA-m734-r4g6-34f9
Summary: NoSQL Injection in loopback-connector-mongodb
Severity: HIGH
CWE: CWE-89
Published: 2019-06-04T19:36:17Z

Versions of `loopback-connector-mongodb` before 3.6.0 are vulnerable to NoSQL injection.

MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous `$where` property to be passed to the MongoDB Driver. The Driver allows the special `$where` property in a filter to execute JavaScript (client can pass in a malicious script) on the database Driver. This is an [intended feature of MongoDB](https://docs.mongodb.com/manual/core/server-side-javascript/) unless disabled ([instructions here](https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-js)).

A proof of concept malicious query:

```
GET /POST filter={"where": {"$where": "function(){sleep(5000); return this.title.contains('Hello');}"}}
```

The above makes the database sleep for 5 seconds and then returns all “Posts” with the title containing the word `Hello`.




## Recommendation

Update to version 3.6.0 or later.
Vulnerability: GHSA-rrj3-qmh8-72pf
Summary: Sensitive Data In Log Files in grunt-gh-pages
Aliases: CVE-2016-10526
Severity: MODERATE
CWE: CWE-391
Published: 2019-02-18T23:39:11Z

Versions of `grunt-gh-pages` prior to 1.0.0 are affected by a vulnerability which may cause unencrypted github credentials to be written to a log file in certain circumstances.

In the `grunt-gh-pages` deployment scenario where authentication is performed by injecting a github token directly into the auth portion of the URL, `grunt-gh-pages` will write the token to a log file, unencrypted.


## Recommendation

Update to version 1.0.0 or later.
Vulnerability: GHSA-hm6q-r2jc-cpqh
Summary: Malicious Package in lodahs
Aliases: CVE-2019-19771
Severity: HIGH
CWE: CWE-20
Published: 2019-12-16T19:29:33Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-wjf2-7f9g-86f5
Summary: Malicious Package in fast-requests
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T18:23:38Z

All versions of `fast-requests` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.
Vulnerability: GHSA-xmxh-g7wj-8m4m
Summary: OS Command Injection in curling
Aliases: CVE-2019-10789
Severity: HIGH
CWE: CWE-78
Published: 2021-04-13T15:32:26Z

npm package `curling` before version 1.1.0 is vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization.
Vulnerability: GHSA-g2pf-qjgf-6fw3
Summary: Downloads Resources over HTTP in openframe-glslviewer
Aliases: CVE-2016-10607
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2019-02-18T23:33:42Z

Affected versions of `openframe-glslviewer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `openframe-glslviewer`.


## Recommendation

No patch is currently available for this vulnerability, and the package hasn't been updated since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-769c-qphh-g3wm
Summary: Downloads Resources over HTTP in macaca-chromedriver
Aliases: CVE-2016-10586
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:51:09Z

Affected versions of `macaca-chromedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `macaca-chromedriver`.


## Recommendation

Update to version 1.0.29 or later.
Vulnerability: GHSA-6p48-xfj3-jw67
Summary: Downloads Resources over HTTP in fibjs
Aliases: CVE-2016-10621
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:56:54Z

Affected versions of `fibjs` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `fibjs`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-5q6m-3h65-w53x
Summary: Improper Neutralization of Special Elements used in an OS Command.
Aliases: CVE-2021-24033
Severity: MODERATE
CWE: CWE-78
Published: 2021-03-11T22:26:09Z

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
Vulnerability: GHSA-p32g-242c-76h3
Summary: Malicious Package in geoheat
Severity: CRITICAL
Published: 2020-09-11T21:14:49Z

Version 1.3.2 of `geoheat` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-qwj8-p662-3m7x
Summary: Path Traversal in localhost-now
Aliases: CVE-2019-5416
Severity: HIGH
CWE: CWE-22
Published: 2019-03-25T16:17:05Z

All versions of `localhost-now` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-7jfh-2xc9-ccv7
Summary: Cross-Site Scripting in public
Severity: LOW
CWE: CWE-79
Published: 2019-05-31T23:46:40Z

All versions of `public` are vulnerable to stored cross-site scripting (XSS). 


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
Vulnerability: GHSA-xg5r-8j97-2wrj
Summary: Directory Traversal in restafary
Aliases: CVE-2016-10528
Severity: MODERATE
CWE: CWE-22
Published: 2019-02-18T23:39:22Z

Affected versions of `restafary` are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.


Proof of Concept

```
curl -i -s -k  -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'
```


## Recommendation

Update to version 1.6.1 or later.
Vulnerability: GHSA-79mx-88w7-8f7q
Summary: XSS Filter Bypass via Encoded URL in validator
Aliases: CVE-2014-9772
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-06T23:12:49Z

Versions of `validator` prior to 2.0.0 contained an xss filter method that is affected by several filter bypasses. This may result in a cross-site scripting vulnerability.


## Proof of Concept
The xss() function removes the word "javascript" when contained inside an attribute.

However, it does not properly handle cases where characters have been hex-encoded. 

As a result, it is possible to build an input that bypasses the filter but which the browser will accept as valid JavaScript.

For example:
```<a href="jav&#x61;script:...">abc</a>```
will render as:
```<a href="javascript:...">abc</a>```


## Recommendation

The package author has decided to remove the xss filter functionality in the latest version of this module. If this feature is not currently being used, you are not affected by the vulnerability. If it is being used, updating to the latest version of the module will break your application.

In order for affected users to mitigate this vulnerability, it is necessary to use an [alternative package](https://www.npmjs.com/search?q=xss%20filter&page=1&ranking=optimal) that provides similar functionality.
Vulnerability: GHSA-v2p6-4mp7-3r9v
Summary: Regular Expression Denial of Service in underscore.string
Severity: MODERATE
CWE: CWE-400
Published: 2019-06-14T16:26:22Z

Versions of `underscore.string` prior to *3.3.5* are vulnerable to Regular Expression Denial of Service (ReDoS).

The function `unescapeHTML` is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs.


## Recommendation

Upgrade to version 3.3.5 or higher.
Vulnerability: GHSA-ph32-23p8-9rw5
Summary: Improper Input Validation in network-manager
Aliases: CVE-2019-10786
Severity: CRITICAL
CWE: CWE-20, CWE-78
Published: 2021-04-13T15:17:45Z

network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument.
Vulnerability: GHSA-7c9w-qmrq-ff8r
Summary: Path Traversal in http-live-simulator
Aliases: CVE-2018-16479
Severity: HIGH
CWE: CWE-22
Published: 2019-02-07T18:14:21Z

Versions of `http-live-simulator` prior to 1.0.7 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. For example: `curl --path-as-is http://localhost:8080//../../../../etc/passwd`.


## Recommendation

Upgrade to version 1.0.7
Vulnerability: GHSA-7phr-5m9x-rw9q
Summary: Directory traversal in fast-http
Aliases: CVE-2020-7687
Severity: HIGH
CWE: CWE-22
Published: 2020-07-27T16:02:57Z

This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js.
Vulnerability: GHSA-2v7q-2xqx-f4q5
Summary: Potential SQL Injection in sequelize
Aliases: CVE-2016-10553
Severity: HIGH
CWE: CWE-89
Published: 2019-02-18T23:54:32Z

Affected versions of `sequelize` are vulnerable to SQL Injection when user input is passed into `findOne` or into a statement such as `where: "user input"`.



## Recommendation

Update to version 3.0.0 or later.

Version 3.0.0 will introduce a number of breaking changes.
Thankfully, the project authors have provided a 2.x -> 3.x [upgrade guide](https://github.com/sequelize/sequelize/wiki/Upgrade-from-2.0-to-3.0) to ease this transition.

If upgrading is not an option, it is also possible to mitigate this by ensuring that all uses of `where: "input"` and `findOne("input")` are properly sanitized, such as by the use of a wrapper function.
Vulnerability: GHSA-6g47-63mv-qpgh
Summary: Prototype Pollution in dotty
Aliases: CVE-2021-23624
Severity: MODERATE
CWE: CWE-843, CWE-1321
Published: 2021-11-08T17:55:48Z

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.
Vulnerability: GHSA-vpgw-ffh3-648h
Summary: Prototype Pollution in fullpage.js
Aliases: CVE-2022-1295
Severity: HIGH
CWE: CWE-1321
Published: 2022-04-12T00:00:38Z

fullPage utils are available to developers using window.fp_utils. They can use these utils for their own use-case (other than fullPage) as well. However, one of the utils deepExtend is vulnerable to Prototype Pollution vulnerability.

Javascript is "prototype" language which means when a new "object" is created, it carries the predefined properties and methods of an "object" with itself like toString, constructor etc. By using prototype-pollution vulnerability, an attacker can overwrite/create the property of that "object" type. If the victim developer has used that property anywhere in the code, then it will have severe effect on the application.
Vulnerability: GHSA-49mg-94fc-2fx6
Summary: Command Injection in npm-git-publish
Severity: CRITICAL
CWE: CWE-77
Published: 2020-09-04T17:32:49Z

All versions of `npm-git-publish` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an `execSync` call, which may allow attackers to execute arbitrary code in the system. The `publish` function is vulnerable through the `gitRemoteUrl` variable.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-8qx4-r7fx-xc4v
Summary: Malicious Package in requst
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-11T21:08:19Z

All versions of `requst` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-6354-6mhv-mvv5
Summary: Regular Expression Denial of Service in jadedown
Aliases: CVE-2016-10520
Severity: LOW
CWE: CWE-400
Published: 2019-02-18T23:38:38Z

The `jadedown` package is affected by a regular expression denial of service vulnerability when certain types of user input are passed in.


### Proof of concept
```
var jadedown = require('jadedown');

var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}


for (i=1;i<=10000000;i=i+1) {
    console.log("COUNT: " + i);
    var str = genstr(i, 'f') + genstr(i, '#') + '{';
    console.log("LENGTH: " + str.length);
    var start = process.hrtime();
    jadedown(str)

    var end = process.hrtime(start);
    console.log(end);
}

```

Results demonstrating blocking for 5 seconds using only 48 characters.

```
$ node jadedown.js
COUNT: 1
LENGTH: 6
[ 0, 4014065 ]
COUNT: 4
LENGTH: 12
[ 0, 503507 ]
COUNT: 7
LENGTH: 18
[ 0, 325225 ]
COUNT: 10
LENGTH: 24
[ 0, 1632684 ]
COUNT: 13
LENGTH: 30
[ 0, 7541230 ]
COUNT: 16
LENGTH: 36
[ 0, 80889495 ]
COUNT: 19
LENGTH: 42
[ 0, 636009936 ]
COUNT: 22
LENGTH: 48
[ 5, 820586760 ]
```

# Timeline
- October 24, 2015 - Vulnerability Identified
- October 24, 2015 - Maintainers Notified
- October 25, 2015 - Response from Maintainers with intent to fix
- January 5, 2016 - Advisory Published
- January 11, 2016 - CVE Requested


## Recommendation

This package is not actively maintained, and has not seen an update since 2011. 

The package also provides unique functionality in the form of a templating language that is not available elsewhere. If this package is used to process user input, the best available mitigation is to refactor the dependent application to not make use of this module.
Vulnerability: GHSA-87mg-h5r3-hw88
Summary: Cross-Site Scripting in bootbox
Severity: MODERATE
CWE: CWE-79, CWE-64
Published: 2019-05-30T17:23:28Z

All version of `bootbox` are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.


## Recommendation

Sanitize user input being passed to `bootbox` or consider using an alternative package.
Vulnerability: GHSA-54qm-37qr-w5wq
Summary: Sandbox Breakout / Arbitrary Code Execution in veval
Severity: CRITICAL
Published: 2020-09-04T15:04:20Z

All versions of `veval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-jj6g-7j8p-7gf2
Summary: Cross-Site Scripting in bracket-template
Severity: HIGH
CWE: CWE-79
Published: 2019-05-30T21:03:24Z

All versions of `bracket-template` are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used in a template.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
Vulnerability: GHSA-p8c3-7rj8-q963
Summary: ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign
Aliases: CVE-2020-14966
Severity: HIGH
CWE: CWE-347
Published: 2020-06-26T16:54:15Z

### Impact
Jsrsasign supports ECDSA signature validation which signature value is represented by ASN.1 DER encoding. This vulnerablity may accept a wrong ASN.1 DER encoded ECDSA signature such as:

- wrong multi-byte ASN.1 length of TLV (ex. 0x820045 even though 0x45 is correct)
- prepending zeros with ASN.1 INTEGER value (ex. 0x00000123 even though 0x0123 is correct)
- appending zeros to signature of ASN.1 TLV (ex. 0x3082....1fbc000000 even though 0x3082....1fbc, appending zeros are ignored.)

This vulnerability was fixed by strict ASN.1 DER checking. 

Here is an assessment of this vulnerability:

- If you are not use ECDSA signature validation, this vulnerability is not affected.
- Not ASN.1 format signature like just concatenation of R and S value is not affected such as Bitcoin.
- This vulnerability is affected to all ECC curve parameters.
- Risk to accept a forged or crafted message to be signed is low.
- Risk to raise memory corruption is low since jsrsasign uses BigInteger class.
- ECDSA signatures semantically the same to valid one may be accepted as valid. There are many malleable variants.

As discussed [here](https://crypto.stackexchange.com/questions/24862/ber-or-der-x9-62-for-ecdsa-signature), there is no standards like X9.62 which requires ASN.1 DER. So ASN.1 BER can be applied to ECDSA however most of implementations like OpenSSL do strict ASN.1 DER checking.

### Patches
Users using ECDSA signature validation should upgrade to 8.0.19.

### Workarounds
Do strict ASN.1 DER checking for ASN.1 encoded ECDSA signature value.

### References
https://nvd.nist.gov/vuln/detail/CVE-2020-14966
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14966
https://vuldb.com/?id.157123
https://github.com/kjur/jsrsasign/issues/437
https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.ECDSA.html
https://kjur.github.io/jsrsasign/api/symbols/ASN1HEX.html#.checkStrictDER
https://www.itu.int/rec/T-REC-X.690
Vulnerability: GHSA-86p3-4gfq-38f2
Summary: Denial of Service in url-relative
Severity: MODERATE
CWE: CWE-400
Published: 2019-06-05T14:10:34Z

All versions of `url-relative` are vulnerable to Denial of Service. If the values `to` and `from` are equal, the function hangs and never returns. This may cause a Denial of Service.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-27fj-mc8w-j9wg
Summary: RSA signature validation vulnerability on maleable encoded message in jsrsasign
Aliases: CVE-2021-30246
Severity: CRITICAL
CWE: CWE-347
Published: 2021-04-16T19:52:35Z

### Impact
Vulnerable jsrsasign will accept RSA signature with improper PKCS#1.5 padding.
Decoded RSA signature value consists following form:
01(ff...(8 or more ffs)...ff)00[ASN.1 OF DigestInfo]
Its byte length shall be the same as RSA key length however such checking was not sufficient.

To make crafted message for practical attack is very hard.

### Patches
Users validating RSA signature should upgrade to 10.2.0 or later.

### Workarounds
There is no workaround. Not to use RSA signature validation in jsrsasign.

### ACKNOWLEDGEMENT
Thanks to Daniel Yahyazadeh @yahyazadeh for reporting and analyzing this vulnerability.
Vulnerability: GHSA-3v5x-qjrp-q2hq
Summary: Unrestricted Upload of File with Dangerous Type in ButterCMS
Aliases: CVE-2022-27260
Severity: CRITICAL
CWE: CWE-434
Published: 2022-04-13T00:00:24Z

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.
Vulnerability: GHSA-cfjh-p3g4-3q2f
Summary: VBScript Content Injection in marked
Aliases: CVE-2015-1370
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Versions 0.3.2 and earlier of `marked` are affected by a cross-site scripting vulnerability even when `sanitize:true` is set. 

## Proof of Concept ( IE10 Compatibility Mode Only )

`[xss link](vbscript:alert(1&#41;)`

will get a link

`<a href="vbscript:alert(1)">xss link</a>`


## Recommendation

Update to version 0.3.3 or later.
Vulnerability: GHSA-gqq4-937c-2282
Summary: Malicious Package in juffer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:49:42Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-wfrj-qqc2-83cm
Summary: Remote command injection when using sendmail email transport
Severity: MODERATE
CWE: CWE-88
Published: 2021-09-20T19:52:41Z

### Impact

Sites using the `sendmail` transport as part of their `mail` config are vulnerable to remote command injection due to a [vulnerability](https://github.com/advisories/GHSA-48ww-j4fc-435p) in the `nodemailer` dependency.

Ghost defaults to the `direct` transport so this is only exploitable if the `sendmail` transport is explicitly used.

### Patches

Fixed in 4.15.0, all sites should upgrade as soon as possible.

### Workarounds

* Use an alternative email transport as described in the [docs](https://ghost.org/docs/config/#mail). 

### For more information

If you have any questions or comments about this advisory:

* email us at security@ghost.org
Vulnerability: GHSA-7752-f4gf-94gc
Summary: Cross-Site Scripting in materialize-css
Aliases: CVE-2019-11003
Severity: MODERATE
CWE: CWE-79
Published: 2019-04-09T19:44:38Z

All versions of `materialize-css` are vulnerable to Cross-Site Scripting. The `autocomplete` component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript code if the malicious input is rendered by a user.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-4rv9-5vc4-88cg
Summary: Command injection in node-ps
Aliases: CVE-2020-7785
Severity: CRITICAL
CWE: CWE-78
Published: 2021-03-19T21:21:06Z

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js.
Vulnerability: GHSA-ww6v-677g-p656
Summary: Sandbox Breakout in safe-eval
Aliases: CVE-2017-16088
Severity: CRITICAL
CWE: CWE-610
Published: 2018-07-18T18:28:10Z

Affected versions of `safe-eval` are vulnerable to a sandbox escape. By accessing object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox. 

## Proof of Concept:
This code accesses the process object and calls `.exit()`
```
var safeEval = require('safe-eval');
safeEval("this.constructor.constructor('return process')().exit()");
```


## Recommendation

Update to version 0.4.0 or later
Vulnerability: GHSA-hxhm-96pp-2m43
Summary: Remote Code Execution in Angular Expressions
Aliases: CVE-2020-5219
Severity: HIGH
CWE: CWE-74
Published: 2020-01-24T15:27:25Z

### Impact

The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call `expressions.compile(userControlledInput)` where `userControlledInput` is text that comes from user input.

* If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput).
* If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.

### Patches

Users should upgrade to version 1.0.1 of angular-expressions

### Workarounds

A temporary workaround might be either to : 

* disable user-controlled input that will be fed into angular-expressions in your application

OR

* allow only following characters in the userControlledInput : 

```js
if (/^[|a-zA-Z.0-9 :"'+-?]+$/.test(userControlledInput)) {
      var result = expressions.compile(userControlledInput);
}
else {
     result = undefined;
}
```

### References

[Removal of angular-expression sandbox](http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [angular-expressions](https://github.com/peerigon/angular-expressions/issues)
* [Email us](mailto:contact@javascript-ninja.fr)

### Credits 

The issue was reported by Maxime Nadeau from GoSecure, Inc.
Vulnerability: GHSA-9jf3-f2pg-7868
Summary: Downloads Resources over HTTP in nw-with-arm
Aliases: CVE-2016-10629
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:57:01Z

Affected versions of `nw-with-arm` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nw-with-arm`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-4328-8hgf-7wjr
Summary: Global node_modules Binary Overwrite in npm
Aliases: CVE-2019-16777
Severity: LOW
CWE: CWE-22
Published: 2019-12-13T15:39:32Z

Versions of  the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. 

For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This will not overwrite system binaries but only binaries put into the global node_modules directory.

This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.


## Recommendation

Upgrade to version 6.13.4 or later.
Vulnerability: GHSA-gh88-3pxp-6fm8
Summary: Infinite Loop in colors.js
Aliases: CVE-2021-23567
Severity: HIGH
CWE: CWE-835
Published: 2022-01-21T23:39:50Z

The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0
Vulnerability: GHSA-2479-qvv7-47qq
Summary: Denial of Service in parse-server
Aliases: CVE-2019-1020012
Severity: HIGH
CWE: CWE-444
Published: 2019-06-13T16:22:13Z

Versions of `parse-server` prior to 3.4.1 are vulnerable to Denial of Service (DoS). POST requests to `/parse/classes/_Audience` (or other volatile classes) cause the server to respond with a `500 Internal Server Error` for any subsequent POST requests.


## Recommendation

Upgrade to version 3.4.1 or later.
Vulnerability: GHSA-7prf-vw4p-qr59
Summary: Prototype pollution in supermixer
Aliases: CVE-2020-24939
Severity: HIGH
CWE: CWE-915, CWE-1321
Published: 2021-12-10T19:03:07Z

Prototype pollution in Stampit supermixer allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation.
Vulnerability: GHSA-765h-qjxv-5f44
Summary: Prototype Pollution in handlebars
Aliases: CVE-2021-23383
Severity: CRITICAL
CWE: CWE-1321
Published: 2022-02-10T23:51:42Z

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
Vulnerability: GHSA-9w87-4j72-gcv7
Summary: Insecure Default Configuration in graphql-code-generator
Severity: HIGH
Published: 2020-09-02T18:27:54Z

Versions of `graphql-code-generator` prior to 0.18.2 have an Insecure Default Configuration. The packages sets `NODE_TLS_REJECT_UNAUTHORIZED` to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process.


## Recommendation

Upgrade to version 0.18.2 or later.
Vulnerability: GHSA-2fmp-7xwf-wvwr
Summary: Arbitrary File Read in Snyk Broker
Aliases: CVE-2020-7650
Severity: MODERATE
CWE: CWE-22
Published: 2020-06-03T22:02:16Z

All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.
Vulnerability: GHSA-5ggx-g294-qj3q
Summary: Malicious Package in buffeb-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:47:29Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-ff7x-qrg7-qggm
Summary: Prototype Pollution in dot-prop
Aliases: CVE-2020-8116
Severity: HIGH
CWE: CWE-425, CWE-471
Published: 2020-07-29T20:56:59Z

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Vulnerability: GHSA-qh73-qc3p-rjv2
Summary: Uncaught Exception in fastify-multipart
Aliases: CVE-2021-23597
Severity: HIGH
CWE: CWE-400
Published: 2022-02-11T18:57:53Z

### Impact

This is a bypass of CVE-2020-8136 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8136).
By providing a `name=constructor` property it is still possible to crash the application.
The original fix only checks for the key `__proto__` (https://github.com/fastify/fastify-multipart/pull/116).

All users are recommended to upgrade

### Patches

v5.3.1 includes a patch
 
### Workarounds

No workarounds are possible.

### References

Read up https://www.fastify.io/docs/latest/Guides/Prototype-Poisoning/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/fastify/fastify-multipart](https://github.com/fastify/fastify-multipart)
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Vulnerability: GHSA-wv2f-3rxv-jqhp
Summary: Path Traversal in general-file-server
Aliases: CVE-2018-3724
Severity: HIGH
CWE: CWE-22
Published: 2018-07-26T15:21:04Z

All versions of `general-file-server` are vulnerable to path traversal.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not use this module until a fix has been provided.