TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-3wxq-7r8m-qpmg
Summary: Hijacked Environment Variables in ffmepg
Aliases: CVE-2017-16068
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-29T23:56:30Z

The `ffmepg` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-c7hr-j4mj-j2w6
Summary: Verification Bypass in jsonwebtoken
Aliases: CVE-2015-9235
Severity: CRITICAL
CWE: CWE-20
Published: 2018-10-09T00:38:30Z

Versions 4.2.1 and earlier of `jsonwebtoken` are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm.




## Recommendation

Update to version 4.2.2 or later.
Vulnerability: GHSA-f5mh-hq6h-whxv
Summary: Directory Traversal in bitty
Aliases: CVE-2016-10561
Severity: MODERATE
CWE: CWE-22
Published: 2019-02-18T23:38:29Z

Affected versions of `bitty` are vulnerable to directory traversal via the URL path in GET requests.


## Recommendation

The `bitty` package is not currently maintained, and has not seen an update since 2015. 

At this time, the best available mitigation is to use an alternative module that is actively maintained and provides similar functionality, such as [serve](https://www.npmjs.com/package/serve).
Vulnerability: GHSA-h9rv-jmmf-4pgx
Summary: Cross-Site Scripting in serialize-javascript
Aliases: CVE-2019-16769
Severity: MODERATE
CWE: CWE-79
Published: 2019-12-05T18:44:37Z

Versions of `serialize-javascript` prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.


## Recommendation

Upgrade to version 2.1.1 or later.
Vulnerability: GHSA-f8fh-8rgm-227h
Summary: OS Command Injection in node-prompt-here
Aliases: CVE-2020-7602
Severity: CRITICAL
CWE: CWE-78
Published: 2021-05-07T16:16:16Z

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The &quot;runCommand()&quot; is called by &quot;getDevices()&quot; function in file &quot;linux/manager.js&quot;, which is required by the &quot;index. process.env.NM_CLI&quot; in the file &quot;linux/manager.js&quot;. This function is used to construct the argument of function &quot;execSync()&quot;, which can be controlled by users without any sanitization.
Vulnerability: GHSA-xqfm-ff6g-24c7
Summary: Directory Traversal in dgard8.lab6
Aliases: CVE-2017-16218
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:39:44Z

Affected versions of `dgard8.lab6` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-8xxm-h73r-ghfj
Summary: Validation bypass in frourio
Aliases: CVE-2022-23623
Severity: HIGH
CWE: CWE-20
Published: 2022-02-07T22:37:45Z

## 日本語

### 影響
v0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。

### パッチ
frourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには `class-transformer` と `reflect-metadata` の依存への追加も必要となります。

### ワークアラウンド
controller側で自分でclass-transformerを使用してチェックする、vaildatorを使わない、など。

### さらなる情報

このセキュリティ勧告に関する質問やコメントについては、以下の方法でお問い合わせいただけます。
* [frourio](https://github.com/frouriojs/frourio)にIssueを開く。

## English

### Impact
Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder. Validators does not work properly for request bodies and queries in specific situations. Addtionally, some kind of input is not validated. (false positives)

### Patches
Please update your frourio to v0.26.0 or later. You also need to install `class-transformer` and `reflect-metadata` to your project.

### Workarounds
Validate objects from request with class-transformer in controllers by yourself, or prevent using validators.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [frourio](https://github.com/frouriojs/frourio)
Vulnerability: GHSA-7xvg-m3vx-2hhv
Summary: Downloads Resources over HTTP in webrtc-native
Aliases: CVE-2016-10600
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:50:26Z

Affected versions of `webrtc-native` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `webrtc-native`.


## Recommendation

No direct patch is currently available for this vulnerability. 

However, if the native components of `webrtc-native` are built from source, this avoids download the precompiled binary, therefore mitigating the insecure download. 

The package author has provided instructions for building from source [here](https://github.com/vmolsa/webrtc-native/wiki/Getting-started#building-from-source).
Vulnerability: GHSA-f2jw-pr2c-9x96
Summary: Code injection in @rkesters/gnuplot
Aliases: CVE-2021-29369
Severity: CRITICAL
CWE: CWE-77, CWE-78
Published: 2022-02-10T23:41:49Z

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.
Vulnerability: GHSA-m7qm-r2r5-f77q
Summary: Cross-Site Scripting in react-marked-markdown
Severity: HIGH
CWE: CWE-79
Published: 2020-09-01T20:43:48Z

All versions of `react-marked-markdown` are vulnerable to cross-site scripting (XSS) via `href` attributes. This is exploitable if user is provided to `react-marked-markdown`

Proof of concept:

```
import React from 'react'
import ReactDOM from 'react-dom'
import { MarkdownPreview } from 'react-marked-markdown'

ReactDOM.render(
<MarkdownPreview
markedOptions={{ sanitize: true }}
value={'[XSS](javascript: alert`1`)'}
/>,
document.getElementById('root')
)
```


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time if you allow user input into href values.
Vulnerability: GHSA-7xf9-74cp-8hx3
Summary: Malicious Package in js-cha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:59:21Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-hpmr-g4pq-jhgp
Summary: Denial of service in chrono-node
Aliases: CVE-2021-23371
Severity: HIGH
CWE: CWE-400
Published: 2021-05-06T15:58:05Z

This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces.
Vulnerability: GHSA-m9jw-237r-gvfv
Summary: SQL Injection in sequelize
Aliases: CVE-2019-10752
Severity: CRITICAL
CWE: CWE-89
Published: 2019-10-25T19:43:16Z

Affected versions of `sequelize` are vulnerable to SQL Injection. The function `sequelize.json()` incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query.  Exploitation example:  
```return User.findAll({
  where: this.sequelize.json("data.id')) AS DECIMAL) = 1 DELETE YOLO INJECTIONS; -- ", 1)
});```


## Recommendation

If you are using `sequelize` 5.x, upgrade to version 5.15.1 or later.
If you are using `sequelize` 4.x, upgrade to version 4.44.3 or later.
Vulnerability: GHSA-4xgp-xrg3-c73w
Summary: Malicious Package in commqnder
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-11T21:10:29Z

All versions of `commqnder` contain malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.
Vulnerability: GHSA-hj3m-v758-jwx5
Summary: Path Traversal in http-server-node
Aliases: CVE-2021-23797
Severity: HIGH
CWE: CWE-22
Published: 2022-01-05T15:02:43Z

All versions of package http-server-node are vulnerable to Directory Traversal via use of --path-as-is.
Vulnerability: GHSA-m5h6-hr3q-22h5
Summary: npm Token Leak in npm
Aliases: CVE-2016-3956
Severity: HIGH
CWE: CWE-200
Published: 2018-07-31T22:58:35Z

Affected versions of the `npm` package include the bearer token of the logged in user in every request made by the CLI, even if the request is not directed towards the user's active registry. 

An attacker could create an HTTP server to collect tokens, and by various means including but not limited to install scripts, cause the npm CLI to make a request to that server, which would compromise the user's token.

This compromised token could be used to do anything that the user could do, including publishing new packages.




## Recommendation

1. Update npm with `npm install npm@latest -g`
2. [Revoke your Tokens](https://www.npmjs.com/settings/tokens)
3. Enable [Two-Factor Authentication](https://docs.npmjs.com/getting-started/using-two-factor-authentication)
Vulnerability: GHSA-r9vm-rhmf-7hxx
Summary: OS Command Injection in im-resize
Aliases: CVE-2019-10787
Severity: HIGH
CWE: CWE-78
Published: 2021-04-13T15:17:06Z

im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization.
Vulnerability: GHSA-5g6j-8hv4-vfgj
Summary: Cross-Site Scripting in node-red
Severity: HIGH
CWE: CWE-79
Published: 2020-09-11T21:21:19Z

Versions of `node-red` prior to 0.18.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the `name` field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 0.18.6 or later.
Vulnerability: GHSA-wjpj-gmc3-5w56
Summary: Malicious Package in buvfer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:30:31Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-w65v-hx54-xrqx
Summary: Malicious Package in midway-xtpl
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:41:23Z

All versions of `midway-xtpl` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-cr5w-6rv4-r2qg
Summary: Malicious Package in maleficent
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T02:37:45Z

All versions of `maleficent` contain malicious code. The package is a demonstration of possible risks when installing npm packages. It gathers system information such as: environment variables, OS information, network interface, AWS credentials, npm credentials and ssh keys. The package prints the information to a local file but does not upload it to a remote server.



## Recommendation

Remove the package from your environment. There is no further compromise.
Vulnerability: GHSA-wv39-cgmm-cq29
Summary: Malicious Package in buffmr-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:23:00Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-rx32-c25r-79mx
Summary: Directory Traversal in serverhuwenhui
Aliases: CVE-2017-16102
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T16:54:41Z

Affected versions of `serverhuwenhui` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-x3m6-rprw-862w
Summary: Malicious Package in node-buc
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:43:31Z

All versions of `node-buc` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-6pwf-whc8-hjf6
Summary: Downloads Resources over HTTP in baryton-saxophone
Aliases: CVE-2016-10573
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:35:18Z

Affected versions of `baryton-saxophone` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `baryton-saxophone`.


## Recommendation

Update to version 3.0.1 or later.
Vulnerability: GHSA-gj77-59wh-66hg
Summary: Regular Expression Denial of Service (ReDoS) in Prism
Aliases: CVE-2021-32723
Severity: HIGH
CWE: CWE-400
Published: 2021-06-28T18:33:18Z

Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).

### Impact

When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. Do not use the following languages to highlight untrusted text.

- ASCIIDoc
- ERB

Other languages are __not__ affected and can be used to highlight untrusted text.

### Patches
This problem has been fixed in Prism v1.24.

### References

- PrismJS/prism#2774
- PrismJS/prism#2688
Vulnerability: GHSA-vmh4-322v-cfpc
Summary: Cross-Site Scripting in cmmn-js-properties-panel
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T18:18:06Z

Versions of `cmmn-js-properties-panel` prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.


## Recommendation

Upgrade to version 0.8.0 or later.
Vulnerability: GHSA-9m87-6fj3-c5xh
Summary: Untrusted Search Path in PNPM
Aliases: CVE-2022-26183
Severity: HIGH
CWE: CWE-426
Published: 2022-03-23T00:00:24Z

PNPM prior to v6.15.1 was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
Vulnerability: GHSA-m2mx-rfpw-jghv
Summary: DLL Injection in kerberos
Severity: HIGH
Published: 2020-09-04T18:01:59Z

Version of `kerberos` prior to 1.0.0 are vulnerable to DLL Injection. The package loads DLLs without specifying a full path. This may allow attackers to create a file with the same name in a folder that precedes the intended file in the DLL path search. Doing so would allow attackers to execute arbitrary code in the machine.


## Recommendation

Upgrade to version 1.0.0 or later.
Vulnerability: GHSA-c5xm-m64m-f2vq
Summary: Malicious Package in cxct
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:23:47Z

All versions of `cxct` contain malicious code. The package finds and exfiltrates cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-73hr-6785-f5p8
Summary: Malicious Package in donotinstallthis
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:24:55Z

The package `donotinstallthis` contained malicious code. The package contained a script that was run as part of the install script. The script contacted a remote service tracking how many installations were done. There is no further compromise.


## Recommendation

Remove the package from your environment.
Vulnerability: GHSA-xqg8-cv3h-xppv
Summary: SQL Injection in sequelize
Aliases: CVE-2015-1369
Severity: HIGH
CWE: CWE-89
Published: 2017-10-24T18:33:36Z

Versions 2.0.0-rc-7 and earlier of `sequelize` are affected by a SQL injection vulnerability when user input is passed into the order parameter.



## Proof of Concept

```javascript
Test.findAndCountAll({
where: { id :1 },
order : [['id', 'UNTRUSTED USER INPUT']]
})
```


## Recommendation

Update to version 2.0.0-rc8 or later
Vulnerability: GHSA-9j49-mfvp-vmhm
Summary: Code Injection in pac-resolver
Aliases: CVE-2021-23406
Severity: HIGH
CWE: CWE-94
Published: 2021-09-02T17:10:06Z

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
Vulnerability: GHSA-qr4p-c9wr-phr6
Summary: Prototype pollution in set-in
Aliases: CVE-2020-28273
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-03-19T21:01:46Z

Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-f9vc-q3hh-qhfv
Summary: Content Injection in remarkable
Aliases: CVE-2014-10065
Severity: HIGH
CWE: CWE-94
Published: 2020-08-31T22:56:00Z

Versions 1.4.0 and earlier of `remarkable` are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of `remarkable` did not properly whitelist link protocols, and consequently allowed `javascript:` to be used. 


### Proof of Concept

Markdown Source:
```
[link](<javascript:alert(1)>)
```

Rendered HTML:
```
<a href="javascript:alert(1)">link</a>
```


## Recommendation

Update to version 1.4.1 or later
Vulnerability: GHSA-q854-j362-cfq9
Summary: Cross-site Scripting in jsoneditor
Aliases: CVE-2020-23849
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-12T16:22:30Z

Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.
Vulnerability: GHSA-hp68-xhvj-x6j6
Summary: Insufficient patch for Regular Expression Denial of Service (ReDoS) to jsx-slack v4.5.1
Aliases: CVE-2021-43843
Severity: MODERATE
CWE: CWE-400
Published: 2022-01-06T18:34:18Z

We found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient to save from Regular Expression Denial of Service (ReDoS) attack.

This vulnerability affects to jsx-slack v4.5.1 and earlier versions.

### Impact

If attacker can put a lot of JSX elements into `<blockquote>` tag _with including multibyte characters_, an internal regular expression for escaping characters may consume an excessive amount of computing resources.

```javascript
/** @jsxImportSource jsx-slack */
import { Section } from 'jsx-slack'

console.log(
  <Section>
    <blockquote>
      {[...Array(40)].map(() => (
        <p>亜</p>
      ))}
    </blockquote>
  </Section>
)
```

v4.5.1 has released by passing the test against ASCII characters but missed the case of multibyte characters.
https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q

### Patches

jsx-slack v4.5.2 has updated regular expressions for escaping blockquote characters to prevent catastrophic backtracking. It is also including an updated test case to confirm rendering multiple tags in `<blockquote>` with multibyte characters.

### References

- https://github.com/yhatt/jsx-slack/commit/46bc88391d89d5fda4ce689e18ca080bcdd29ecc

### Credits

Thanks to @hieki for finding out this vulnerability.
Vulnerability: GHSA-wmpv-c2jp-j2xg
Summary: ERC1155Supply vulnerability in OpenZeppelin Contracts
Severity: LOW
Published: 2021-11-15T23:28:18Z

When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the `ERC1155Supply` extension, total supply is not updated until after the callback, thus during the callback the reported total supply is lower than the real number of tokens in circulation.

### Impact
If a system relies on accurately reported supply, an attacker may be able to mint tokens and invoke that system after receiving the token balance but before the supply is updated.

### Patches
A fix is included in version 4.3.3 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.

### Workarounds
If accurate supply is relevant, do not mint tokens to untrusted receivers.

### Credits
The issue was identified and reported by @ChainSecurityAudits.

### For more information
Read [TotalSupply Inconsistency in ERC1155 NFT Tokens](https://medium.com/chainsecurity/totalsupply-inconsistency-in-erc1155-nft-tokens-8f8e3b29f5aa) by @ChainSecurityAudits for a more detailed breakdown.

If you have any questions or comments about this advisory, email us at security@openzeppelin.com.
Vulnerability: GHSA-855m-jchh-9qjc
Summary: Malicious Package in commnader
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:19:22Z

All versions of `commnader` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-7g8m-5qh9-9pgw
Summary: Directory Traversal in wind-mvc
Aliases: CVE-2017-16220
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:07:51Z

Affected versions of `wind-mvc` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-gvr4-7xgc-gx3w
Summary: Cross-Site Scripting in fileview
Aliases: CVE-2019-15602
Severity: HIGH
CWE: CWE-79
Published: 2020-04-01T16:36:15Z

All versions of `fileview` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-w5m8-5v9m-xhx5
Summary: Critical severity vulnerability that affects Haraka
Aliases: CVE-2016-1000282
Severity: CRITICAL
CWE: CWE-77
Published: 2019-02-12T17:26:10Z

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.
Vulnerability: GHSA-52c9-458g-whrf
Summary: Malicious Package in js-3ha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:58:17Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-rc77-xxq6-4mff
Summary: Command Injection in hot-formula-parser
Aliases: CVE-2020-6836
Severity: CRITICAL
CWE: CWE-94
Published: 2020-05-06T19:32:33Z

Versions of `hot-formula-parser` prior to 3.0.1 are vulnerable to Command Injection. The package fails to sanitize values passed to the  `parse` function and concatenates it in an `eval` call. If a value of the formula is supplied by user-controlled input it may allow attackers to run arbitrary commands in the server.  
Parsing the following formula creates a `test` file in the present directory:  
`"SUM([(function(){require('child_process').execSync('touch test')})(),2])"`


## Recommendation

Upgrade to version 3.0.1 or later.
Vulnerability: GHSA-wwf2-5cj8-jx6w
Summary: Hijacked Environment Variables in nodesqlite
Aliases: CVE-2017-16049
Severity: MODERATE
CWE: CWE-506
Published: 2018-07-23T20:50:21Z

The `nodesqlite` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-x65c-4fgj-5fc3
Summary: Cross-site Scripting in pandao
Aliases: CVE-2019-14653
Severity: MODERATE
CWE: CWE-79
Published: 2019-08-23T00:05:00Z

pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.
Vulnerability: GHSA-536q-8gxx-m782
Summary: Cross-Site Scripting in dojo
Aliases: CVE-2010-2273
Severity: MODERATE
CWE: CWE-79
Published: 2019-09-11T23:02:57Z

Versions of `dojo` prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the `_testCommon.js` and `runner.html` test files, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 1.4.2 or later.
Vulnerability: GHSA-cr8h-x88h-jwj2
Summary: Downloads Resources over HTTP in wixtoolset
Aliases: CVE-2016-10663
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:44:45Z

Affected versions of `wixtoolset` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `wixtoolset`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rjvj-673q-4hfw
Summary: Command Injection in traceroute
Severity: CRITICAL
CWE: CWE-77
Published: 2020-09-04T17:54:31Z

All versions of `traceroute` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an `exec` call, which may allow attackers to execute arbitrary code in the system. The `trace` function is vulnerable and can be abused if the `host` value is controlled by an attacker.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-q2qh-cgc2-qhr3
Summary: Directory Traversal in serve
Aliases: CVE-2018-3712
Severity: MODERATE
CWE: CWE-22
Published: 2018-07-27T17:07:50Z

Affected versions of `serve` do not properly handle `%2e` (.) and `%2f` (/) characters, and allow the, characters to be used in paths. This can be used to traverse the directory tree and list content of any directory the user running the process has access to.

Mitigating factors:
This vulnerability only allows listing of directory contents and does not allow reading of arbitrary files.


## Recommendation

Update to version 6.4.9 later.
Vulnerability: GHSA-hhff-3c89-5m7p
Summary: Directory Traversal in byucslabsix
Aliases: CVE-2017-16166
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:45:42Z

Affected versions of `byucslabsix` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-whjr-jj69-7prm
Summary: Malicious Package in import-mysql
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:44:35Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-rffp-mc78-wjf7
Summary: Command Injection in cocos-utils
Severity: HIGH
CWE: CWE-77
Published: 2020-09-02T18:26:48Z

All versions of `cocos-utils` are vulnerable to Remote Code Execution. The `unzip()` function concatenates user input to `exec()` which may allow attackers to execute arbitrary commands  on the server.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-hh8v-jmh3-9437
Summary: Cross-site scripting in SocksJS-node
Aliases: CVE-2020-8823
Severity: MODERATE
CWE: CWE-79
Published: 2021-04-13T15:25:33Z

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
Vulnerability: GHSA-g84j-95x2-7g67
Summary: Downloads Resources over HTTP in tomita
Aliases: CVE-2016-10662
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:44:50Z

Affected versions of `tomita` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `tomita`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-fj93-7wm4-8x2g
Summary: Cross-Site Scripting in jquery-mobile
Severity: HIGH
CWE: CWE-79
Published: 2020-09-02T21:22:47Z

All version of `jquery-mobile` are vulnerable to Cross-Site Scripting. The package checks for content in `location.hash` and if a URL is found it does an XmlHttpRequest (XHR) to the URL and renders the response with `innerHTML`. It fails to validate the `Content-Type` of the response, allowing attackers to include malicious payloads as part of query parameters that are reflected back to the user. A response such as `{"q":"<iframe/src='javascript:alert(1)'></iframe>","results":[]}` would be parsed as HTML and the JavaScript payload executed.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-gmw6-94gg-2rc2
Summary: UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
Aliases: CVE-2021-39135
Severity: MODERATE
CWE: CWE-61, CWE-59
Published: 2021-08-31T16:03:34Z

### Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder.

This is accomplished by extracting package contents into a project's `node_modules` folder.

If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system.

Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed.

1. A `preinstall` script could replace `node_modules` with a symlink.  (This is prevented by using `--ignore-scripts`.)
2. An attacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root.  This may be successful, because `npm install --ignore-scripts` is typically not capable of making changes outside of the project directory, so it may be deemed safe.

### Patches

2.8.2 (included in npm v7.20.7 and above)

### Workarounds

Do not run `npm install` on untrusted codebases, without first ensuring that the `node_modules` directory in the project is not a symbolic link.

### Fix

Prior to extracting any package contents, the `node_modules` folder into which it is extracted is verified to be a real directory.  If it is not, then it is removed.

Caveat: if you are currently relying on creating a symbolic link to the `node_modules` folder in order to share dependencies between projects, then that will no longer be possible.  Please use the `npm link` command, explicit `file:...` dependencies, and/or `workspaces` to share dependencies in a development environment.
Vulnerability: GHSA-jcgr-9698-82jx
Summary: Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build
Severity: LOW
CWE: CWE-77
Published: 2021-05-28T15:53:40Z

### Impact
If you are using the esbuild target or command you are at risk of code/option injection. Attackers can use the command line option to maliciously change your settings in order to damage your project.

### Patches
The problem has been patched in v1.0.0 as it uses a proper method to pass configs to esbuild/estrella.

### Workarounds
There is no work around. You should update asap.

### Notes
This notice is mainly just to make sure people update to the latest version. This isn't that bad, but should encourage you to update.
Vulnerability: GHSA-394c-5j6w-4xmx
Summary: Regular Expression Denial of Service (ReDoS) in ua-parser-js
Aliases: CVE-2020-7793
Severity: HIGH
CWE: CWE-400
Published: 2022-02-09T22:46:53Z

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).
Vulnerability: GHSA-mg8r-9g6j-hwv9
Summary: Authentication Bypass in hapi-auth-jwt2
Aliases: CVE-2016-10525
Severity: CRITICAL
CWE: CWE-287
Published: 2019-02-18T23:39:00Z

Versions of `hapi-auth-jwt2` prior to version 5.1.2 are affected by a complete authentication bypass vulnerability when in the `try` authentication mode. 


## Recommendation

Update to version 5.1.2 or later.
Vulnerability: GHSA-2mw7-wggm-m6w3
Summary: Low severity vulnerability that affects ethereumjs-vm
Aliases: CVE-2018-19183
Severity: HIGH
CWE: CWE-119
Published: 2018-11-21T22:22:46Z

ethereumjs-vm 2.4.0 allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a "code: Buffer.from(my_code, 'hex')" attribute.
Vulnerability: GHSA-q4cq-539c-3mmm
Summary: Directory Traversal in serveryztyzt
Aliases: CVE-2017-16103
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T16:48:14Z

Affected versions of `serveryztyzt` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-m33v-338h-4v9f
Summary: Path traversal in Node-Red
Aliases: CVE-2021-21298
Severity: LOW
CWE: CWE-22
Published: 2021-02-26T16:31:23Z

### Impact

This vulnerability allows arbitrary path traversal via the Projects API.

If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API.

### Patches

The issue has been patched in Node-RED 1.2.8

### Workarounds

The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED.

The primary workaround is not give untrusted users read access to the Node-RED editor.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@nodered.org](mailto:team@nodered.org)

### Acknowledgements

Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.
Vulnerability: GHSA-vmhw-fhj6-m3g5
Summary: Path Traversal in angular-http-server
Severity: HIGH
CWE: CWE-22
Published: 2019-05-31T23:46:33Z

Versions of `angular-http-server` before 1.4.4 are vulnerable to path traversal.


## Recommendation

Update to version 1.4.4 or later.
Vulnerability: GHSA-f34m-x9pj-62vq
Summary: Cross-Site Scripting Vulnerability in @joeattardi/emoji-button
Aliases: CVE-2021-43785
Severity: HIGH
CWE: CWE-79
Published: 2021-12-01T18:29:02Z

### Impact

There are two vectors for XSS attacks with versions of @joeattardi/emoji-button before 4.6.2:

- A URL for a custom emoji
- An i18n string

In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.

### Patches

This vulnerability is fixed starting in version 4.6.2. This is resolved by properly escaping strings that are inserted into the HTML document.

### Workarounds

There is no workaround other than upgrading to a non-vulnerable version.

### Credit

This issue was discovered by GitHub team member [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh) and was reported by the GitHub Security Lab team.
Vulnerability: GHSA-3mpp-xfvh-qh37
Summary: node-ipc behavior change
Severity: LOW
Published: 2022-03-16T23:54:35Z

node-ipc version 11.0.0 and newer include a message from the maintainer that is written to the user’s desktop. Please review the version changes before proceeding.
Vulnerability: GHSA-g7j3-p357-cw8p
Summary: Directory Traversal in f2e-server
Aliases: CVE-2017-16038
Severity: HIGH
CWE: CWE-22
Published: 2018-07-24T16:29:12Z

Affected versions of `f2e-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

Update to version 1.12.12 or later.
Vulnerability: GHSA-4x7w-frcq-v4m3
Summary: Path Traversal in @wturyn/swagger-injector
Severity: CRITICAL
CWE: CWE-22
Published: 2020-09-03T20:38:47Z

All versions of `@wturyn/swagger-injector` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured `dist` folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-g93h-75m9-3qq4
Summary: Downloads Resources over HTTP in pngcrush-installer
Aliases: CVE-2016-10570
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:52:27Z

Affected versions of `pngcrush-installer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `pngcrush-installer`.


## Recommendation

Update to version 1.8.10 or later.
Vulnerability: GHSA-pmv6-gf98-p3r5
Summary: Command Injection in kill-port
Aliases: CVE-2019-5414
Severity: HIGH
CWE: CWE-77
Published: 2019-03-25T16:17:18Z

Versions of `kill-port` prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the `kill` function. This may allow attackers to run arbitrary commands in the system if user input (such as the port number) is passed directly to the function.


## Recommendation

Upgrade to version 1.3.2 or later.
Vulnerability: GHSA-93f3-23rq-pjfp
Summary: Sensitive information exposure through logs in npm CLI
Aliases: CVE-2020-15095
Severity: LOW
CWE: CWE-532
Published: 2020-07-07T18:56:16Z

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is printed to stdout and also to any generated log files.
Vulnerability: GHSA-pxmp-fwjc-4x7q
Summary: HTML Injection in marky-markdown
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-03T15:45:23Z

All versions of `marky-markdown` are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is `youtube.com` but it is possible to bypass the validation with sources where `youtube.com` is the sub-domain, such as `youtube.com.evil.co`. This 


## Recommendation

This package is no longer maintained. Please upgrade to `@npmcorp/marky-markdown`
Vulnerability: GHSA-6jx3-rqcx-g3ww
Summary: Downloads Resources over HTTP in air-sdk
Aliases: CVE-2016-10603
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:33:48Z

Affected versions of `air-sdk` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `air-sdk`.


## Recommendation

No patch is currently available for this vulnerability, and the package hasn't seen an update since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-f7r3-p866-q9qr
Summary: Denial of Service in ircdkit
Severity: LOW
CWE: CWE-400
Published: 2019-06-03T17:27:49Z

Versions of `ircdkit` before 1.0.3 are vulnerable to a remote denial of service.


## Recommendation

Upgrade to version 1.0.4.
Vulnerability: GHSA-fgp6-8g62-qx6w
Summary: Malicious Package in smartsearchwp
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:01:45Z

All versions of `smartsearchwp` contain malicious code. The package is malware intended to steal credentials from websites it is loaded in. It traverses DOM elements looking for fields such as `username` and `password` and uploads it to a remote server. The package also port-scans the local gateway and uploads the information to the remote server. It has a feature to fetch commands from the remote server and execute them with `eval`. The npm security team analysis found several bugs in the malware that prevent it from actually performing its actions. The malicious code is also not invoked upon installation or require; it would require transpiling TypeScript code and using it in a website.



## Recommendation

Remove the package from your environment. There is no indication of further compromise.
Vulnerability: GHSA-5hxw-r847-qfwp
Summary: Moderate severity vulnerability that affects opencv.js
Aliases: CVE-2017-16066
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-29T23:47:07Z

opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Vulnerability: GHSA-rjhc-w3fj-j6x9
Summary: Malicious Package in alipayjsapi
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:32:45Z

All versions of `alipayjsapi` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.