TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-cgqv-x5cx-xvqh
Summary: Arbitrary Code Injection in pouchdb
Aliases: CVE-2016-10546
Severity: CRITICAL
CWE: CWE-94
Published: 2018-07-26T16:22:08Z

Affected versions of `pouchdb` do not properly sandbox the code execution engine which executes the map/reduce functions for temporary views and design documents. Under certain circumstances, an attacker could uses this to run arbitrary code on the server.


## Recommendation

Update to version 6.0.5 or later.
Vulnerability: GHSA-ff6r-5jwm-8292
Summary: Regular Expression Denial of Service in no-case
Aliases: CVE-2017-16099
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T19:51:16Z

Affected versions of `no-case` are vulnerable to a regular expression denial of service when parsing untrusted user input.


## Recommendation

Update to version 2.3.2 or later.
Vulnerability: GHSA-grv5-w5vr-8h98
Summary: Path Traversal in droppy
Aliases: CVE-2020-7757
Severity: MODERATE
CWE: CWE-22
Published: 2021-05-10T18:47:29Z

This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server.
Vulnerability: GHSA-4r4m-hjwj-43p8
Summary: Insecure Defaults Allow MITM Over TLS in engine.io-client
Aliases: CVE-2016-10536
Severity: MODERATE
CWE: CWE-300
Published: 2019-02-18T23:39:50Z

Affected versions of `engine.io-client` do not verify certificates by default, and as such may be vulnerable to Man-in-the-Middle attacks.

The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, such as undefined or null, certificate verification will be disabled. 



## Recommendation

Update to version 1.6.9 or later.

If you are unable to upgrade, ensure all calls to socket.io to have a `rejectedUnauthorized: true` flag.
Vulnerability: GHSA-7jvx-f994-rfw2
Summary: materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input
Aliases: CVE-2022-25349
Severity: MODERATE
CWE: CWE-79
Published: 2022-05-03T00:00:45Z

All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as &lt;not-a-tag /&gt;) that is being parsed as HTML/JavaScript, and inserted into the Document Object Model (DOM). This vulnerability can be exploited when the user-input is provided to the autocomplete component.
Vulnerability: GHSA-fg47-3c2x-m2wr
Summary: TimelockController vulnerability in OpenZeppelin Contracts 
Aliases: CVE-2021-39167
Severity: CRITICAL
CWE: CWE-269
Published: 2021-08-30T16:12:38Z

### Impact

A vulnerability in `TimelockController` allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to "open" allow anyone to use the executor role, thus leaving the timelock at risk of being taken over by an attacker.

### Patches

A fix is included in the following releases of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`:
- 4.3.1
- 3.4.2
- 3.4.2-solc-0.7

Deployed instances of `TimelockController` should be replaced with a fixed version by migrating all assets, ownership, and roles.

### Workarounds

Revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.

### References

[Post-mortem](https://forum.openzeppelin.com/t/timelockcontroller-vulnerability-postmortem/14958).

### Credits

The issue was identified by an anonymous white hat hacker through [Immunefi](https://immunefi.com/).

### For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
Vulnerability: GHSA-jf85-cpcp-j695
Summary: Prototype Pollution in lodash
Aliases: CVE-2019-10744
Severity: CRITICAL
CWE: CWE-20
Published: 2019-07-10T19:45:23Z

Versions of `lodash` before 4.17.12 are vulnerable to Prototype Pollution.  The function `defaultsDeep` allows a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.17.12 or later.
Vulnerability: GHSA-q5pq-pgrv-fh89
Summary: Critical severity vulnerability that affects dns-sync
Aliases: CVE-2014-9682
Severity: CRITICAL
CWE: CWE-77
Published: 2017-10-24T18:33:36Z

The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.
Vulnerability: GHSA-5fm9-jmv7-fcx5
Summary: Malicious Package in asynnc
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T18:35:26Z

All versions of `asynnc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-87qw-7v97-w34r
Summary: Malicious Package in asinc
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T18:33:18Z

All versions of `asinc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-46m8-42hm-wvvw
Summary: Cross-Site Scripting in emojione
Aliases: CVE-2016-1000231
Severity: HIGH
CWE: CWE-79
Published: 2020-09-01T15:34:16Z

Affected versions of `emojione` are vulnerable to cross-site scripting when user input is passed into the `toShort()`, `shortnameToImage()`, `unicodeToImage()`, and `toImage()` functions.



## Recommendation

Update to version 1.3.1 or later.
Vulnerability: GHSA-m852-866j-69j8
Summary: Malicious Package in eslint-config-airbnb-standard
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T20:47:01Z

Version 2.0.0 of `eslint-config-airbnb-standard` was published with a bundled version of `eslint-scope` that  was found to contain malicious code. This code would read the users `.npmrc` file and send it's contents to a remote server.


## Recommendation

The best course of action if you found this package installed in your environment is to revoke all your npm tokens and use a different version of the module. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens
Vulnerability: GHSA-wh87-3959-vfrq
Summary: Malicious Package in buffer-hor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:51:58Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-62g9-6hw5-rwfp
Summary: Path Traversal in resolve-path
Aliases: CVE-2018-3732
Severity: HIGH
CWE: CWE-22
Published: 2018-07-18T21:20:25Z

Versions of `resolve-path` before 1.4.0 are vulnerable to path traversal. `resolve-path` relative path resolving suffers from a lack of file path sanitization for windows based paths.


## Recommendation

Update to version 1.4.0 or later.
Vulnerability: GHSA-wvhm-4hhf-97x9
Summary: Cross-Site Scripting in Prism
Aliases: CVE-2020-15138
Severity: HIGH
CWE: CWE-79
Published: 2020-08-07T22:28:30Z

### Impact
The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer.

This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin (>=v1.10.0) or the _Previewer: Easing_ plugin (v1.1.0 to v1.9.0).

### Patches
This problem is patched in v1.21.0.

### Workarounds
To workaround the issue without upgrading, [disable the easing preview](https://prismjs.com/plugins/previewers/#disabling-a-previewer) on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.

### References
The vulnerability was introduced by this [commit](https://github.com/PrismJS/prism/commit/4303c940d3d3a20e8ce7635bf23331c75060f5c5) on Sep 29, 2015 and fixed by [Masato Kinugawa](https://twitter.com/kinugawamasato) (#2506).

### For more information
If you have any questions or comments about this advisory, please [open an issue](https://github.com/PrismJS/prism/issues).
Vulnerability: GHSA-pr34-8jfr-xhv8
Summary: Downloads Resources over HTTP in selenium-wrapper
Aliases: CVE-2016-10628
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:21Z

Affected versions of `selenium-wrapper` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-wrapper`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-57f3-gghm-9mhc
Summary: Regular Expression Denial of Service (ReDoS)
Aliases: CVE-2021-23353
Severity: HIGH
CWE: CWE-400
Published: 2021-03-12T21:28:46Z

This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.
Vulnerability: GHSA-hg78-c92r-hvwr
Summary: Denial of Service in mqtt
Aliases: CVE-2016-1000242
Severity: HIGH
CWE: CWE-248
Published: 2020-09-01T16:01:24Z

Affected versions of `mqtt` will cause the node process to crash when receiving specially crafted MQTT packets, making the application vulnerable to a denial of service condition.



## Recommendation

Update to v1.0.0 or later
Vulnerability: GHSA-c78w-2gw7-gjv3
Summary: XSS in TinyMCE
Aliases: CVE-2019-1010091
Severity: MODERATE
CWE: CWE-79
Published: 2020-05-11T20:00:15Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in: the core parser and `media` plugin. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.9 or lower and TinyMCE 5.2.1 or lower.

### Patches
This vulnerability has been patched in TinyMCE 4.9.10 and 5.2.2 by improved HTML parsing and sanitization logic.

### Workarounds
The workarounds available are:
- disable the media plugin and manually sanitize CDATA content (see below)
or
- upgrade to either TinyMCE 4.9.10 or TinyMCE 5.2.2

#### Example: Manually strip CDATA elements
```js
setup: function(editor) {
  editor.on('PreInit', function() {
    editor.parser.addNodeFilter('#cdata', function(nodes) {
      for (var i = 0; i < nodes.length; i++) {
        nodes[i].remove();
      }
    });
  });
}
```

### Acknowledgements
Tiny Technologies would like to thank Michał Bentkowski and [intivesec](https://github.com/intivesec) for discovering these vulnerabilities.

### References
https://www.tiny.cloud/docs/release-notes/release-notes522/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
Vulnerability: GHSA-m8pw-hgvj-cwcm
Summary: Directory Traversal in sgqserve
Aliases: CVE-2017-16215
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:08:55Z

Affected versions of `sgqserve` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-gjph-xf5q-6mfq
Summary: Denial of Service in @hapi/ammo
Severity: HIGH
Published: 2020-09-03T15:46:02Z

Versions of `@hapi/ammo` prior to 3.1.2 or 5.0.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 3.1.2 or 5.0.1.
Vulnerability: GHSA-wp7m-mrvf-599c
Summary: Command Injection in node-df
Aliases: CVE-2019-15597
Severity: CRITICAL
CWE: CWE-94
Published: 2020-02-14T23:09:10Z

All versions of `node-df` are vulnerable to Command Injection. The package fails to sanitize filenames passed to the  `file` option. If this value is user-controlled it  may allow attackers to run arbitrary commands in the server.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-x7m2-6g99-84w5
Summary: Arbitrary File Read in Snyk Broker
Aliases: CVE-2020-7652
Severity: MODERATE
CWE: CWE-22
Published: 2020-06-03T22:02:24Z

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.
Vulnerability: GHSA-w8hg-mxvh-9h57
Summary: Malicious Package in angular-bmap
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T19:42:49Z

Version 0.0.9 of `angular-bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.9 of this module is found installed you will want to replace it with a version before or after 0.0.9. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-6898-wx94-8jq8
Summary: Potential Command Injection in libnotify
Aliases: CVE-2013-7381
Severity: CRITICAL
CWE: CWE-74
Published: 2020-08-31T22:50:48Z

Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify.

Untrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this.

### Example
```
var libnotify = require('libnotify')
libnotify.notify('UNTRUSTED INPUT', { title: \"\" }, function () {
    console.log(arguments);
})
```

Special thanks to Neal Poole for submitting the pull request to fix this issue.


## Recommendation

Update to version 1.0.4 or greater
Vulnerability: GHSA-5w8q-x7hc-jhp6
Summary: Directory Traversal in node-simple-router
Aliases: CVE-2017-16083
Severity: HIGH
CWE: CWE-22
Published: 2018-07-24T19:42:39Z

Affected versions of `node-simple-router` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

Update to v0.10.1 or later.
Vulnerability: GHSA-wpgh-hmv4-r3v5
Summary: Prototype pollution in safe-obj
Aliases: CVE-2021-25928
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-06-21T17:18:20Z

Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-w725-67p7-xv22
Summary: Command Injection in local-devices
Severity: HIGH
CWE: CWE-77
Published: 2020-09-03T17:05:04Z

Versions of `local-devices` prior to 3.0.0 are vulnerable to Command Injection. The package does not validate input on ip addresses and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.


## Recommendation

Upgrade to version 3.0.0 or later.
Vulnerability: GHSA-89mq-4x47-5v83
Summary: Prototype Pollution in angular
Aliases: CVE-2019-10768
Severity: HIGH
CWE: CWE-915, CWE-20
Published: 2019-11-20T15:29:43Z

Versions of `angular ` prior to 1.7.9 are vulnerable to prototype pollution. The deprecated API function `merge()` does not restrict the modification of an Object's prototype in the , which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

Upgrade to version 1.7.9 or later. The function was already deprecated and upgrades are not expected to break functionality.
Vulnerability: GHSA-hmw2-mvvh-jf5j
Summary: OS Command Injection in enpeem
Aliases: CVE-2019-10801
Severity: HIGH
CWE: CWE-78
Published: 2021-04-13T15:22:47Z

enpeem through 2.2.0 allows execution of arbitrary commands. The &quot;options.dir&quot; argument is provided to the &quot;exec&quot; function without any sanitization.
Vulnerability: GHSA-hqw4-8893-j4h7
Summary: Directory Traversal in simple-npm-registry
Aliases: CVE-2017-16132
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:49:28Z

Affected versions of `simple-npm-registry` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-22h7-7wwg-qmgg
Summary: Prototype Pollution in @hapi/hoek
Severity: LOW
CWE: CWE-1321
Published: 2020-09-04T17:56:39Z

Versions of `@hapi/hoek` prior to 8.5.1 and 9.0.3 are vulnerable to Prototype Pollution. The `clone` function fails to prevent the modification of the Object prototype when passed specially-crafted input. Attackers may use this to change existing properties that exist in all objects, which may lead to Denial of Service or Remote Code Execution in specific circumstances.  
This issue __does not__ affect hapi applications since the framework protects against such malicious inputs. Applications that use `@hapi/hoek` outside of the hapi ecosystem may be vulnerable.


## Recommendation

Update to version 8.5.1, 9.0.3 or later.
Vulnerability: GHSA-4r9c-jghc-cx5m
Summary: Cross-site Scripting in apostrophe
Aliases: CVE-2021-25978
Severity: MODERATE
CWE: CWE-79
Published: 2021-11-10T16:45:34Z

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.
Vulnerability: GHSA-3v6h-hqm4-2rg6
Summary: Arbitrary File Write in adm-zip
Aliases: CVE-2018-1002204
Severity: HIGH
CWE: CWE-22
Published: 2018-07-27T17:07:14Z

Versions of `adm-zip` before 0.4.9 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames (`../../file.txt` for example).


## Recommendation

Update to version 0.4.9 or later.
Vulnerability: GHSA-mjjq-c88q-qhr6
Summary: Cross-Site Scripting in dompurify
Severity: CRITICAL
CWE: CWE-79
Published: 2020-09-03T21:22:00Z

Versions of `dompurify` prior to 2.0.7 are vulnerable to Cross-Site Scripting (XSS). It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 2.0.7 or later.
Vulnerability: GHSA-4hq8-v42x-9wx3
Summary: Malicious Package in bs85check
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:51:52Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-qmhf-qg6f-pc4v
Summary: Directory Traversal in fbr-client
Aliases: CVE-2017-16217
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:39:51Z

Affected versions of `fbr-client` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-662x-fhqg-9p8v
Summary: Regular Expression Denial of Service in ua-parser-js
Aliases: CVE-2020-7733
Severity: HIGH
CWE: CWE-400
Published: 2021-05-07T16:18:19Z

The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
Vulnerability: GHSA-7hx8-2rxv-66xv
Summary: Denial of Service in hapi
Severity: HIGH
Published: 2020-09-03T15:48:00Z

All Versions of `hapi` are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

This package is deprecated and is now maintained as `@hapi/hapi`. Please update your dependencies to use `@hapi/hapi`.
Vulnerability: GHSA-9px9-f7jw-fwhj
Summary: Command Injection in priest-runner
Severity: CRITICAL
CWE: CWE-77
Published: 2020-09-03T15:49:37Z

All versions of `priest-runner` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to a `spawn` call, which may allow attackers to execute arbitrary code in the system. The `PriestController.prototype.createChild ` function is vulnerable since the `spawn` parameters come from a POST request body.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-vvf2-ppj9-pp49
Summary: Inefficient Regular Expression Complexity in vuelidate
Aliases: CVE-2021-3794
Severity: HIGH
CWE: CWE-400, CWE-697
Published: 2021-09-20T20:42:06Z

vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS (regular expression denial of service) flaw was found in the `@vuelidate/validators` package. An attacker that is able to provide crafted input to the url(input) function may cause an application to consume an excessive amount of CPU.
Vulnerability: GHSA-69r7-cw26-px6h
Summary: Downloads Resources over HTTP in google-closure-tools-latest
Aliases: CVE-2016-10677
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:42:14Z

Affected versions of `google-closure-tools-latest` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `google-closure-tools-latest`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, and instead install the [closure compiler](https://github.com/google/closure-compiler) manually.

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-49x3-8228-3w3m
Summary: Inefficient Regular Expression Complexity in code-server
Aliases: CVE-2021-3810
Severity: HIGH
CWE: CWE-1333
Published: 2021-09-20T20:18:39Z

code-server is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-frxq-v7fm-m4pv
Summary: Malicious Package in requuest
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:27:53Z

All versions of `requuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-qrmc-fj45-qfc2
Summary: Prototype Pollution in extend
Aliases: CVE-2018-16492
Severity: MODERATE
CWE: CWE-400
Published: 2019-02-07T18:03:28Z

Versions of `extend` prior to 3.0.2 (for 3.x) and 2.0.2 (for 2.x) are vulnerable to Prototype Pollution. The `extend()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

If you're using `extend` 3.x upgrade to 3.0.2 or later.
If you're using `extend` 2.x upgrade to 2.0.2 or later.
Vulnerability: GHSA-7r8m-45gc-m2c8
Summary: Downloads Resources over HTTP in mongodb-instance
Aliases: CVE-2016-10572
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:52:14Z

Affected versions of `mongodb-instance` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mongodb-instance`.


## Recommendation

Update to version 0.0.3 or later.
Vulnerability: GHSA-8hq2-fcqm-39hq
Summary: Malicious Package in rimrafall
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:46:05Z

Version 1.0.0 of `rimrafall` contains malicious code as a preinstall script. The package attempts to remove all files in the system's root folder.


## Recommendation

If you installed this package it is likely your machine was erased. If not, remove the package from your system and verify if any files were deleted.
Vulnerability: GHSA-r3xc-47qg-h929
Summary: Cross-Site Scripting in @ionic/core
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T17:06:09Z

Versions of  `@ionic/core` prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. This issue affects the components:
- `<ion-alert>.message`
- `<ion-searchbar>.placeholder`
- `<ion-infinite-scroll-content>.loadingText`
- `<ion-refresher-content>.pullingText`
- `<ion-refresher-content>.refershingText`


## Recommendation

- If you are using @ionic/core 4.0.x, upgrade to 4.0.3 or later.
- If you are using @ionic/core 4.1.x, upgrade to 4.1.3 or later.
- If you are using @ionic/core 4.2.x, upgrade to 4.2.1 or later.
- If you are using @ionic/core 4.3.x, upgrade to 4.3.1 or later.
Vulnerability: GHSA-pj97-j597-ppm7
Summary: Malicious Package in rqeuest
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:15:22Z

All versions of `rqeuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-vpf5-82c8-9v36
Summary: Prototype Pollution in algoliasearch-helper
Aliases: CVE-2021-23433
Severity: MODERATE
CWE: CWE-915, CWE-1321
Published: 2021-11-23T21:15:35Z

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.
Vulnerability: GHSA-fmrr-mx6j-h3h5
Summary: Prototype Pollution in confucious
Aliases: CVE-2020-7714
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-06T18:12:09Z

All versions of package confucious up to and including version 0.0.12 are vulnerable to Prototype Pollution via the set function.
Vulnerability: GHSA-wfjh-3hq2-r276
Summary: Malicious Package in node-spdy
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:56:48Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-377f-vvrc-9wgg
Summary: Malicious Package in zemen
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:09:07Z

Version 0.0.5 of `zemen` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-vm5j-vqr6-v7v8
Summary: OS Command Injection in pixl-class
Aliases: CVE-2020-7640
Severity: HIGH
CWE: CWE-78
Published: 2021-12-10T20:04:56Z

pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization.
Vulnerability: GHSA-gfm8-g3vm-53jh
Summary: Malicious Package in leetlog
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:21:19Z

Versions 0.1.2 and 0.1.3 of `leetlog` contain malicious code. The package adds an arbitrary hardcoded SSH key identified as `hacker@evilmachine` to the system's `authorized_keys`


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-q8xg-8xwf-m598
Summary: Machine-In-The-Middle in lix
Aliases: CVE-2020-10800
Severity: HIGH
CWE: CWE-544, CWE-639
Published: 2020-04-16T03:14:59Z

All versions of `lix` are vulnerable to Machine-In-The-Middle. The package accepts downloads with `http` and follows `location` header redirects for package downloads. This allows for an attacker in a privileged network position to intercept a lix package installation and redirect the download to a malicious source.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-58v4-qwx5-7f59
Summary: SQL Injection in knex
Aliases: CVE-2019-10757
Severity: CRITICAL
CWE: CWE-89
Published: 2019-10-21T16:12:13Z

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.
Vulnerability: GHSA-2h3h-q99f-3fhc
Summary: UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
Aliases: CVE-2021-39134
Severity: MODERATE
CWE: CWE-61, CWE-59
Published: 2021-08-31T16:04:03Z

### Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder.

This is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies.

When multiple dependencies differ only in the case of their name, Arborist's internal data structure saw them as separate items that could coexist within the same level in the `node_modules` hierarchy.  However, on case-insensitive file systems (such as macOS and Windows), this is not the case.  Combined with a symlink dependency such as `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem.

For example, a package `pwn-a` could define a dependency in their `package.json` file such as `"foo": "file:/some/path"`.  Another package, `pwn-b` could define a dependency such as `FOO: "file:foo.tgz"`.  On case-insensitive file systems, if `pwn-a` was installed, and then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any existing contents of `/some/path` would be removed.

Anyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected.

### Patches

2.8.2 (included in npm v7.20.7 and above)

### Fix and Caveats

There are two parts to the fix:

1. Immediately prior to extraction, if the target folder is not a directory, it is moved aside.  (If the installation fails, filesystem entries moved aside in this manner are moved back as part of the rollback process.)
2. The `children` map that represents child nodes in the tree is replaced with a case-insensitive map object, such that `node.children.get('foo')` and `node.children.get('FOO')` will return the same object, enabling Arborist to detect and handle this class of tree collision.

This second item imposes a caveat on case _sensitive_ filesystems where two packages with names which differ only in case may already exist at the same level in the tree, causing unpredictable behavior in this rare edge case.  Note that in such cases, the `package-lock.json` already creates a situation which is hazardous to use on case-sensitive filesystems, and will likely lead to other problems.

If affected by this caveat, please run `npm update` to rebuild your tree and generate a new `package-lock.json` file.
Vulnerability: GHSA-m7mf-vm62-7x3q
Summary: Insecure template handling in haml-coffee
Aliases: CVE-2021-32818
Severity: HIGH
CWE: CWE-79
Published: 2021-05-17T20:58:21Z

haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application that passes user controlled request objects to the haml-coffee template engine may introduce RCE vulnerabilities. Additionally control over the escapeHtml parameter through template configuration pollution ensures that haml-coffee would not sanitize template inputs that may result in reflected Cross Site Scripting attacks against downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of haml-coffee is currently 1.14.1. For complete details refer to the referenced GHSL-2021-025.
Vulnerability: GHSA-q42p-pg8m-cqh6
Summary: Prototype Pollution in handlebars
Severity: HIGH
CWE: CWE-471
Published: 2019-06-05T14:07:48Z

Versions of `handlebars` prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.


## Recommendation

For handlebars 4.1.x upgrade to 4.1.2 or later.
For handlebars 4.0.x upgrade to 4.0.14 or later.
Vulnerability: GHSA-6pq3-928q-x6w6
Summary: Prototype Pollution
Aliases: CVE-2020-8147
Severity: HIGH
CWE: CWE-471
Published: 2020-09-03T15:51:28Z

All versions of `utils-extend` are vulnerable to prototype pollution. The `extend` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.

## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-w32g-5hqp-gg6q
Summary: Cross-Site Scripting in mermaid
Severity: HIGH
CWE: CWE-79
Published: 2020-09-02T15:41:41Z

Versions of `mermaid` prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input  such as `A["<img src=invalid onerror=alert('XSS')></img>"] ` is provided to the application, it will execute the code instead of rendering it as text due to improper output encoding.


## Recommendation

Upgrade to version 8.2.3 or later
Vulnerability: GHSA-pc7q-c837-3wjq
Summary: Malicious Package in wallet-address-validtaor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:02:58Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-2vqv-hp3p-fmv8
Summary: Downloads Resources over HTTP in webdriver-launcher
Aliases: CVE-2016-10651
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:03Z

Affected versions of `webdriver-launcher` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `webdriver-launcher`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2011.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-9xv2-548x-5h79
Summary: Arbitrary File Read in Snyk Broker
Aliases: CVE-2020-7648
Severity: MODERATE
CWE: CWE-22
Published: 2020-06-03T22:02:19Z

All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json`
Vulnerability: GHSA-w4vp-3mq7-7v82
Summary: Cross-Site Scripting in lazysizes
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T15:49:48Z

Versions of `lazysizes` prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting.  The `video-embed` plugin fails to sanitize the following attributes: data-vimeo, `data-vimeoparams`, `data-youtube` and `data-ytparams`. This allows attackers to execute arbitrary JavaScript in a victim's browser if the attacker has control over the vulnerable attributes.


## Recommendation

Upgrade to version 5.2.1-rc1 or later.
Vulnerability: GHSA-g4xj-wcq6-qwx5
Summary: Code injection in mock2easy
Aliases: CVE-2020-7697
Severity: CRITICAL
CWE: CWE-77
Published: 2021-05-06T18:25:58Z

This affects all versions up to and including version 0.0.24 of package mock2easy. a malicious user could inject commands through the _data variable: Affected Area require('../server/getJsonByCurl')(mock2easy, function (error, stdout) { if (error) { return res.json(500, error); } res.json(JSON.parse(stdout)); }, '', _data.interfaceUrl, query, _data.cookie,_data.interfaceType);
Vulnerability: GHSA-mpp5-2x55-49xw
Summary: XSS in svg2png (NPM package)
Aliases: CVE-2020-11887
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-06T19:45:13Z

svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document.
Vulnerability: GHSA-jmqm-f2gx-4fjv
Summary: Sensitive information exposure through logs in npm-registry-fetch
Severity: MODERATE
CWE: CWE-352
Published: 2020-07-07T18:59:10Z

Affected versions of `npm-registry-fetch` are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is printed to stdout and also to any generated log files.
Vulnerability: GHSA-w3w8-37jv-2c58
Summary: Cross-Site Scripting in mustache
Aliases: CVE-2015-8862
Severity: HIGH
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Versions of `mustache` prior to 2.2.1 are affected by a cross-site scripting vulnerability when attributes in mustache templates are not quoted.



### Example
Template:
```<a href={{foo}}/>```

Input:
```{ 'foo' : 'test.com onload=alert(1)'}```

Rendered result:
```<a href=test.com onload=alert(1)/>```


## Recommendation

Update to version 2.2.1 or later.
Alternatively, ensure that all attributes in hmustache templates are encapsulated with quotes.
Vulnerability: GHSA-pqpp-2363-649v
Summary: Cross-Site Scripting in buttle
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-02T18:22:30Z

All versions of `buttle` are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, `buttle` does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-8p9r-f949-699g
Summary: Path Traversal in browserless-chrome
Aliases: CVE-2020-7758
Severity: HIGH
CWE: CWE-22
Published: 2021-05-10T18:46:48Z

This affects all versions of browserless-chrome before 1.43.0. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.
Vulnerability: GHSA-xqqr-p362-6rmc
Summary: Directory Traversal in hostr
Aliases: CVE-2017-16029
Severity: MODERATE
CWE: CWE-22
Published: 2018-11-09T17:44:20Z

Affected versions of `hostr` are vulnerable to directory traversal which allows attackers to read files outside the current directory by sending `../` in the url path for GET requests.


## Recommendation

Upgrade to version 2.3.6 or later.
Vulnerability: GHSA-6c8f-qphg-qjgp
Summary: Validation Bypass in kind-of
Aliases: CVE-2019-20149
Severity: HIGH
CWE: CWE-668
Published: 2020-03-31T15:59:54Z

Versions of `kind-of` 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation. 


## Recommendation

Upgrade to versions 6.0.3 or later.
Vulnerability: GHSA-rqjw-p5vr-c695
Summary: Basic-auth app bundle credential exposure in gatsby-source-wordpress
Aliases: CVE-2021-32770
Severity: HIGH
CWE: CWE-522, CWE-200
Published: 2021-07-19T15:21:41Z

### Impact
The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time.  Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected.

Example affected gatsby-config.js:
```
      resolve: 'gatsby-source-wordpress',
        auth: {
          htaccess: {
            username: leaked_username
            password: leaked_password,
          },
        },
```

### Patches
A patch has been introduced in gatsby-source-wordpress@4.0.8 and gatsby-source-wordpress@5.9.2 which mitigates the issue by filtering all variables specified in the `auth: { }` section.  Users that depend on this functionality are advised to upgrade to the latest release of gatsby-source-wordpress, run `gatsby clean` followed by a `gatsby build`.


### Workarounds
There is no known workaround at this time, other than manually editing the app.js file post-build.


### For more information
Email us at [security@gatsbyjs.com](mailto:security@gatsbyjs.com)
Vulnerability: GHSA-6f93-xj8r-jp82
Summary: Malicious Package in bunfer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:28:21Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-whq6-mj2r-mjqc
Summary: OS Command Injection in lsof
Aliases: CVE-2019-10783
Severity: HIGH
CWE: CWE-78
Published: 2021-04-13T15:17:53Z

All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input.
Vulnerability: GHSA-4m8h-h59m-m34j
Summary: Prototype Pollution in bmoor
Aliases: CVE-2021-23558
Severity: HIGH
CWE: CWE-1321
Published: 2022-02-01T00:50:09Z

The package bmoor before 0.10.1 is vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664)
Vulnerability: GHSA-9829-jj5p-j6hf
Summary: Prototype Pollution in worksmith
Aliases: CVE-2020-7725
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-06T18:26:30Z

All versions up to and including 1.0.0 of the package worksmith are vulnerable to Prototype Pollution via the setValue function.