TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-9cp3-fh5x-xfcj
Summary: Regular Expression Denial of Service in charset
Aliases: CVE-2017-16098
Severity: MODERATE
CWE: CWE-400
Published: 2018-08-09T20:55:46Z

Affected versions of `charset` are susceptible to a regular expression denial of service.

The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.


If node was compiled using the `-DHTTP_MAX_HEADER_SIZE` however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.


## Recommendation

Update to version 1.0.1 or later.
Vulnerability: GHSA-545q-3fg6-48m7
Summary: Regular expression denial of service (ReDoS)
Aliases: CVE-2021-23346
Severity: MODERATE
CWE: CWE-400
Published: 2021-03-18T19:39:31Z

This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.
Vulnerability: GHSA-82v2-mx6x-wq7q
Summary: Incorrect Default Permissions in log4js
Aliases: CVE-2022-21704
Severity: MODERATE
CWE: CWE-276
Published: 2022-01-21T18:53:27Z

### Impact
Default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config.

### Patches
Fixed by:
* https://github.com/log4js-node/log4js-node/pull/1141
* https://github.com/log4js-node/streamroller/pull/87

Released to NPM in log4js@6.4.0

### Workarounds
Every version of log4js published allows passing the mode parameter to the configuration of file appenders, see the documentation for details.

### References

Thanks to [ranjit-git](https://www.huntr.dev/users/ranjit-git) for raising the issue, and to @peteriman for fixing the problem.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [logj4s-node](https://github.com/log4js-node/log4js-node)
* Ask a question in the [slack channel](https://join.slack.com/t/log4js-node/shared_invite/enQtODkzMDQ3MzExMDczLWUzZmY0MmI0YWI1ZjFhODY0YjI0YmU1N2U5ZTRkOTYyYzg3MjY5NWI4M2FjZThjYjdiOGM0NjU2NzBmYTJjOGI)
* Email us at [gareth.nomiddlename@gmail.com](mailto:gareth.nomiddlename@gmail.com)
Vulnerability: GHSA-8qp3-pvwc-2g4p
Summary: Hijacked Environment Variables in nodefabric
Aliases: CVE-2017-16054
Severity: MODERATE
CWE: CWE-506
Published: 2018-07-23T20:49:58Z

The `nodefabric` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation



As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-fhjf-83wg-r2j9
Summary: Prototype Pollution in mixin-deep
Aliases: CVE-2019-10746
Severity: CRITICAL
CWE: CWE-88
Published: 2019-08-27T17:42:33Z

Versions of `mixin-deep` prior to 2.0.1 or 1.3.2 are vulnerable to Prototype Pollution. The `mixinDeep` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.




## Recommendation

If you are using `mixin-deep` 2.x, upgrade to version 2.0.1 or later.
If you are using `mixin-deep` 1.x, upgrade to version 1.3.2 or later.
Vulnerability: GHSA-h97f-5258-5593
Summary: Incorrect Authorization in serverless-offline
Aliases: CVE-2021-38384
Severity: MODERATE
CWE: CWE-863
Published: 2021-09-01T18:32:22Z

Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e., possibly greater than expected permissions).
Vulnerability: GHSA-cqp5-m4pq-gfgp
Summary: Prototype Pollution in defaults-deep
Aliases: CVE-2018-3723
Severity: LOW
CWE: CWE-471
Published: 2018-07-26T15:18:43Z

Versions of `default-deep` before 0.2.4 are vulnerable to prototype pollution


## Recommendation

Update to version 0.2.4 or later.
Vulnerability: GHSA-h3vq-wv8j-36gw
Summary: Cross-site Scripting in Scratch-Svg-Renderer
Aliases: CVE-2020-27428
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-08T00:44:33Z

A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file.
Vulnerability: GHSA-qr9h-vr5p-pwwx
Summary: Denial of Service (DoS) in restify-paginate
Aliases: CVE-2020-27543
Severity: HIGH
CWE: CWE-755
Published: 2021-04-12T18:59:11Z

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception.
Vulnerability: GHSA-cpp2-q66x-fq44
Summary: Directory Traversal in jikes
Aliases: CVE-2017-16139
Severity: MODERATE
CWE: CWE-22
Published: 2018-08-06T21:39:12Z

Affected versions of `jikes` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-w23f-f3c5-r9qh
Summary: Downloads Resources over HTTP in ikst
Aliases: CVE-2017-16041
Severity: HIGH
CWE: CWE-311
Published: 2018-07-24T15:56:19Z

Affected versions of `ikst` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Upgrade to version 1.1.2 or greater.
Vulnerability: GHSA-m8gw-hjpr-rjv7
Summary: Prototype Pollution in dojo
Aliases: CVE-2021-23450
Severity: HIGH
CWE: CWE-1321
Published: 2022-01-05T15:01:46Z

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
Vulnerability: GHSA-pv4c-p2j5-38j4
Summary: Open Redirect in url-parse
Aliases: CVE-2018-3774
Severity: HIGH
CWE: CWE-425
Published: 2018-08-13T15:02:15Z

Versions of `url-parse` before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities.


## Recommendation

Update to version 1.4.3 or later.
Vulnerability: GHSA-phwq-j96m-2c2q
Summary: Template injection in ejs
Aliases: CVE-2022-29078
Severity: HIGH
CWE: CWE-74
Published: 2022-04-26T00:00:40Z

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Vulnerability: GHSA-xw79-hhv6-578c
Summary: Cross-Site Scripting in serve
Severity: HIGH
CWE: CWE-79
Published: 2020-09-11T21:16:59Z

Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered.


## Recommendation

Upgrade to version 10.0.2 or later.
Vulnerability: GHSA-4m3j-h8f2-4xh4
Summary: Malicious Package in coinstrig
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:41:31Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4c87-gg2q-fc6m
Summary: Malicious Package in rc-calendar-jhorst
Severity: CRITICAL
Published: 2020-09-01T20:31:04Z

Version 8.4.3 of `rc-calendar-jhorst` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 8.4.3 of this module is found installed you will want to replace it with a version before or after 8.4.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-pmpr-vc5q-h3jw
Summary: Exposure of Resource to Wrong Sphere in valib
Aliases: CVE-2019-10805
Severity: MODERATE
CWE: CWE-668
Published: 2021-04-13T15:21:59Z

valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object. It is possible for a crafted payload to overwrite this function to manipulate the inspection results to bypass security checks.
Vulnerability: GHSA-pp7h-53gx-mx7r
Summary: Remote Memory Exposure in bl
Aliases: CVE-2020-8244
Severity: HIGH
CWE: CWE-126, CWE-125
Published: 2020-09-02T15:26:19Z

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Vulnerability: GHSA-vh8f-xw5v-8993
Summary: Command Injection in macfromip
Aliases: CVE-2020-7786
Severity: CRITICAL
CWE: CWE-74
Published: 2021-04-12T19:01:20Z

All versions of npm package macfromip are affected by a command injection vulnerability. The injection point is located in line 66 in macfromip.js.
Vulnerability: GHSA-mxmj-84q8-34r7
Summary: Command Injection in expressfs
Severity: HIGH
CWE: CWE-77
Published: 2020-09-03T02:39:49Z

All versions of `expressfs` are vulnerable to Command Injection. The package does not validate user input on several API endpoints, allowing attackers to run arbitrary commands in the system. The affected endpoints are: `expressfs.appendFile`,  `expressfs.cp`, `expressfs.create` and `expressfs.rmdir`.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-c8h6-89q2-mgv8
Summary: Malicious Package in dossier
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T19:55:48Z

Version 0.0.4 of `dossier` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.4 of this module is found installed you will want to replace it with a version before or after 0.0.4. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-2r7f-4h2c-5x73
Summary: Arbitrary File Read in fury-adapter-swagger
Aliases: CVE-2016-1000249
Severity: CRITICAL
Published: 2020-09-01T16:38:33Z

Affected versions of `fury-adapter-swagger` have a weakness that allows an attacker to read arbitrary files off of the system. This can be used to read sensitive data, or to cause a denial of service condition by attempting to read something like `/dev/zero`.

## Proof of Concept:

```
---
swagger: '2.0'
info:
  title: Read local files
  version: '1.0'

paths:
  /foo:
    get:
      responses:
        200:
          description: Some description
          examples:
            text/html:
              example:
                $ref: '/etc/passwd'
```


## Recommendation

Upgrade to version 0.9.7 or later
Vulnerability: GHSA-5634-rv46-48jf
Summary: Cross-Site Scripting in bleach
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T17:13:45Z

All versions of `bleach` are vulnerable to Cross-Site Scripting. It is possible to bypass the package's HTML sanitization with payloads such as `"<<script><</script>script>alert('xss');</<script><</script>script>"` regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-45q2-34rf-mr94
Summary: Code Injection in mquery
Aliases: CVE-2020-35149
Severity: MODERATE
CWE: CWE-94
Published: 2020-12-18T18:23:43Z

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., __proto__) can be copied during a merge or clone operation.
Vulnerability: GHSA-mjxr-4v3x-q3m4
Summary: Improper Input Validation in sanitize-html
Aliases: CVE-2021-26540
Severity: MODERATE
CWE: CWE-20
Published: 2021-05-06T16:10:19Z

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".
Vulnerability: GHSA-f757-9c4x-chff
Summary: Downloads Resources over HTTP in poco
Aliases: CVE-2016-10659
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:54:44Z

Affected versions of `poco` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `poco`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-9qgh-7pgp-hp7r
Summary: Cross-Site Scripting in graylog-web-interface
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T17:10:31Z

All versions of  `graylog-web-interface` are vulnerable to Cross-Site Scripting (XSS). The package fails to escape output on the `TypeAhead` and `QueryInput` components, which may allow attackers to execute arbitrary JavaScript on the victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-hxcm-v35h-mg2x
Summary: Prototype Pollution
Severity: HIGH
CWE: CWE-1312
Published: 2019-06-07T21:12:50Z

A vulnerability was found in querystringify before 2.0.0. It's possible to override built-in properties of the resulting query string object if a malicious string is inserted in the query string.
Vulnerability: GHSA-p7j5-4mwm-hv86
Summary: Cross-site scripting in TinyMCE
Aliases: CVE-2020-17480
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-06T17:28:14Z

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.
Vulnerability: GHSA-xf5p-87ch-gxw2
Summary: Regular Expression Denial of Service in marked
Severity: MODERATE
CWE: CWE-400
Published: 2019-06-05T14:10:03Z

Versions of `marked` prior to 0.6.2 and later than 0.3.14 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion.


## Recommendation

Upgrade to version 0.6.2 or later.
Vulnerability: GHSA-f8jj-45fj-44r6
Summary: Malicious Package in js-she3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:05:43Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-3vjf-82ff-p4r3
Summary: Incorrect protocol extraction via \r, \n and \t characters
Aliases: CVE-2022-1243
Severity: HIGH
CWE: CWE-20
Published: 2022-04-06T00:01:31Z

\r, \n and \t characters in user-input URLs can potentially lead to incorrect protocol extraction when using npm package urijs prior to version 1.19.11.

This can lead to XSS when the module is used to prevent passing in malicious javascript: links into HTML or Javascript (see following example):
````
const parse = require('urijs')
const express = require('express')
const app = express()
const port = 3000

input = "ja\r\nvascript:alert(1)"
url = parse(input)

console.log(url)

app.get('/', (req, res) => {
 if (url.protocol !== "javascript:") {res.send("<iframe src=\'" + input + "\'>CLICK ME!</iframe>")}
})

app.listen(port, () => {
 console.log(`Example app listening on port ${port}`)
})
````
Vulnerability: GHSA-2877-693q-pj33
Summary: OS Command Injection in GenieACS
Aliases: CVE-2021-46704
Severity: CRITICAL
CWE: CWE-78
Published: 2022-03-07T00:00:40Z

In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.
Vulnerability: GHSA-j4f2-536g-r55m
Summary: Resource exhaustion in engine.io 
Aliases: CVE-2020-36048
Severity: HIGH
CWE: CWE-400
Published: 2022-02-09T22:29:04Z

Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
Vulnerability: GHSA-8gv6-g7vp-hr34
Summary: Hijacked Environment Variables in mysqljs
Aliases: CVE-2017-16047
Severity: MODERATE
CWE: CWE-506
Published: 2020-09-01T18:58:47Z

The `mysqljs` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-vr5m-3h59-7jcp
Summary: Prototype Pollution in think-helper
Aliases: CVE-2021-32736
Severity: HIGH
CWE: CWE-915, CWE-1321
Published: 2021-07-01T17:01:59Z

### Impact

The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

### Patches

`think-helper@1.1.3` patched it, anyone used `think-helper` should upgrade to `>=1.1.3` version.

### References

https://cwe.mitre.org/data/definitions/1321.html

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [thinkjs/thinkjs](https://github.com/thinkjs/thinkjs)
* Email us at [i@imnerd.org](mailto:i@imnerd.org)
Vulnerability: GHSA-992f-wf4w-x36v
Summary: Prototype Pollution in merge-objects
Severity: LOW
CWE: CWE-1321
Published: 2020-09-01T21:16:13Z

All versions of `merge-objects` are vulnerable to Prototype Pollution.


## Recommendation

No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package.
Vulnerability: GHSA-vv52-3mrp-455m
Summary: Malicious Package in m-backdoor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T15:53:36Z

All versions of `m-backdoor` contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly from the DOM. 


## Recommendation

Remove the package from your system.
Vulnerability: GHSA-54xj-q58h-9x57
Summary: Arbitrary File Write in iobroker.admin
Aliases: CVE-2019-10765
Severity: CRITICAL
CWE: CWE-22
Published: 2020-09-04T15:24:56Z

Versions of `iobroker.admin` prior to 3.6.12 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended folder in the `/log/` route, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the attack but the package has authentication disabled by default.


## Recommendation

Upgrade to version 3.6.12 or later.
Vulnerability: GHSA-3wjm-33mw-h388
Summary: Malicious Package in s3asy
Severity: CRITICAL
Published: 2020-09-01T20:34:14Z

Version 0.4.8 of `s3asy` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.4.8 of this module is found installed you will want to replace it with a version before or after 0.4.8. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-3gx7-xhv7-5mx3
Summary: Arbitrary Code Execution in eslint-utils
Aliases: CVE-2019-15657
Severity: CRITICAL
CWE: CWE-20
Published: 2019-08-26T16:59:56Z

Versions of `eslint-utils` >=1.2.0 or <1.4.1 are vulnerable to Arbitrary Code Execution. The `getStaticValue` does not properly sanitize user input allowing attackers to supply malicious input that executes arbitrary code during the linting process. The `getStringIfConstant` and `getPropertyName` functions are not affected.


## Recommendation

Upgrade to version 1.4.1 or later.
Vulnerability: GHSA-4vcm-qfxh-p6c3
Summary: Directory Traversal in getcityapi.yoehoehne
Aliases: CVE-2017-16192
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:40:29Z

Affected versions of `getcityapi.yoehoehne` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-q54r-r9pr-w7qv
Summary: XSS in Hexo
Aliases: CVE-2021-25987
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-01T18:27:44Z

Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.
Vulnerability: GHSA-w5mp-8p8w-mhh8
Summary: Command injection in connection-tester
Aliases: CVE-2020-7781
Severity: CRITICAL
CWE: CWE-78
Published: 2020-12-17T21:00:53Z

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. Affected versions of this package are vulnerable to Command Injection
Vulnerability: GHSA-ffxg-xm4w-3wg9
Summary: Command Injection in corenlp-js-interface
Aliases: CVE-2020-28440
Severity: CRITICAL
CWE: CWE-78
Published: 2020-12-18T18:23:04Z

All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.
Vulnerability: GHSA-fwhp-2hqr-6g72
Summary: Downloads Resources over HTTP in pk-app-wonderbox
Aliases: CVE-2016-10685
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:42:01Z

Affected versions of `pk-app-wonderbox` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `pk-app-wonderbox`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rqwh-c535-j9hw
Summary: Downloads Resources over HTTP in js-given
Aliases: CVE-2016-10638
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:09Z

Affected versions of `js-given` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `js-given`.


## Recommendation

Update to version 0.0.18 or later.
Vulnerability: GHSA-vh6r-g38f-q3w8
Summary: Validation bypass in jpv
Aliases: CVE-2020-17479
Severity: CRITICAL
CWE: CWE-20
Published: 2021-05-06T17:27:58Z

jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.
Vulnerability: GHSA-x87g-rgrh-r6g3
Summary: Malicious Package in rpc-websocket
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:07:15Z

Versions of `rpc-websocket` >= 0.7.6 contained malicious code. The package opens a backdoor to a remote server and executes arbitrary commands, effectively acting as a backdoor.


## Recommendation

Any computer that has these versions of the package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-9mjp-gv34-3jcf
Summary: Malicious Package in aasync
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T18:37:35Z

All versions of `aasync` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-x268-6jhm-2mx8
Summary: Downloads Resources over HTTP in libsbmlsim
Aliases: CVE-2016-10675
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:42:22Z

Affected versions of `libsbmlsim` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `libsbmlsim`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-g64q-3vg8-8f93
Summary: Prototype Pollution in subtext
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-03T15:47:10Z

All versions of `subtext` are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.


## Recommendation

This package is deprecated and is now maintained as `@hapi/subtext`. Please update your dependencies to use `@hapi/subtext`.
Vulnerability: GHSA-vv6q-9cfw-4c83
Summary: Hijacked Environment Variables in smb
Aliases: CVE-2017-16079
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-29T23:20:27Z

The `smb` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-4qqc-mp5f-ccv4
Summary: Command Injection in bestzip
Severity: CRITICAL
CWE: CWE-77
Published: 2020-09-02T15:05:51Z

Versions of `bestzip` prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `zip` function . This may allow attackers to execute arbitrary code in the system as long as the values of `destination` is user-controlled. This only affects users with a native `zip` command available. The following examples demonstrate the issue from the CLI and also programatically:
- `bestzip test.zip 'sourcefile; mkdir folder'`
- `zip({ source: 'sourcefile', destination: './test.zip; mkdir folder' })`
Vulnerability: GHSA-5645-gc7h-98h8
Summary: Malicious Package in react-dates-sc
Severity: CRITICAL
Published: 2020-09-01T20:32:07Z

Version 0.3.0 of `react-dates-sc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.3.0 of this module is found installed you will want to replace it with a version before or after 0.3.0. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-2548-q746-x5x6
Summary: Code injection in port-killer
Aliases: CVE-2021-23359
Severity: HIGH
CWE: CWE-77, CWE-20
Published: 2021-04-13T15:20:49Z

This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.
Vulnerability: GHSA-64g7-mvw6-v9qj
Summary: Improper Privilege Management in shelljs
Severity: MODERATE
CWE: CWE-269
Published: 2022-01-14T21:09:50Z

### Impact
Output from the synchronous version of `shell.exec()` may be visible to other users on the same system. You may be affected if you execute `shell.exec()` in multi-user Mac, Linux, or WSL environments, or if you execute `shell.exec()` as the root user.

Other shelljs functions (including the asynchronous version of `shell.exec()`) are not impacted.

### Patches
Patched in shelljs 0.8.5

### Workarounds
Recommended action is to upgrade to 0.8.5.

### References
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/

### For more information
If you have any questions or comments about this advisory:
* Ask at https://github.com/shelljs/shelljs/issues/1058
* Open an issue at https://github.com/shelljs/shelljs/issues/new
Vulnerability: GHSA-mpcf-4gmh-23w8
Summary: Regular Expression Denial of Service in forwarded
Aliases: CVE-2017-16118
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T20:16:30Z

Affected versions of `forwarded` are vulnerable to regular expression denial of service when parsing specially crafted user input.


## Recommendation

Update to version 0.1.2 or later
Vulnerability: GHSA-pp57-mqmh-44h7
Summary: Command Injection in macaddress
Aliases: CVE-2018-13797
Severity: CRITICAL
CWE: CWE-78
Published: 2018-09-06T23:24:21Z

All versions of `macaddress` are vulnerable to command injection. For this vulnerability to be exploited an attacker needs to control the `iface` argument to the `one` method.


## Recommendation

Update to version 0.2.9 or later.
Vulnerability: GHSA-f52g-6jhx-586p
Summary: Denial of Service in handlebars
Severity: MODERATE
CWE: CWE-400
Published: 2020-09-03T23:20:12Z

Affected versions of `handlebars` are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service.


## Recommendation

Upgrade to version 4.4.5 or later.
Vulnerability: GHSA-6vrv-94jv-crrg
Summary: Context isolation bypass via Promise in Electron
Aliases: CVE-2020-15096
Severity: LOW
CWE: CWE-501
Published: 2020-07-07T00:01:05Z

### Impact
Apps using `contextIsolation` are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

### Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.

### Fixed Versions
* `9.0.0-beta.21`
* `8.2.4`
* `7.2.4`
* `6.1.11`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)
Vulnerability: GHSA-92vm-wfm5-mxvv
Summary: Timing Attack in cookie-signature
Aliases: CVE-2016-1000236
Severity: MODERATE
CWE: CWE-362
Published: 2020-01-06T18:44:10Z

Affected versions of `cookie-signature` are vulnerable to timing attacks as a result of using a fail-early comparison instead of a constant-time comparison. 

Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback on the correctness of a guess via miniscule timing differences.

Under favorable network conditions, an attacker can exploit this to guess the secret in no more than `charset*length` guesses, instead of `charset^length` guesses required were the timing attack not present. 



## Recommendation

Update to 1.0.6 or later.
Vulnerability: GHSA-28gr-86hg-r48w
Summary: Unauthenticated Remote Command Injection in ep_imageconvert
Aliases: CVE-2013-3364
Severity: HIGH
CWE: CWE-77
Published: 2020-08-31T22:43:31Z

ep_imageconvert is a plugin for [Etherpad Lite](https://github.com/ether/etherpad-lite). ep_imageconvert <= 0.0.2 is vulnerable to remote command injection.

Authentication is not required for remote exploitation.


## Recommendation

Update to version 0.0.3 or greater.
Vulnerability: GHSA-9qgm-w87q-hx89
Summary: Unrestricted Upload of File with Dangerous Type in Strapi
Aliases: CVE-2022-27263
Severity: CRITICAL
CWE: CWE-434
Published: 2022-04-13T00:00:25Z

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.
Vulnerability: GHSA-85g2-29m8-qf2p
Summary: Prototype Pollution Vulnerability in object-collider
Aliases: CVE-2021-25914
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-03-19T21:18:33Z

Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-hwhq-3hrj-v6v5
Summary: Hijacked Environment Variables in cross-env.js
Aliases: CVE-2017-16081
Severity: MODERATE
CWE: CWE-506
Published: 2020-09-01T19:00:54Z

The `cross-env.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-88xx-23mf-rcj2
Summary: Malicious Package in bs-sha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:51:52Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-67mp-pcv9-vvq6
Summary: Malicious Package in jr-sha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:57:14Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-r8j5-h5cx-65gg
Summary: ReDOS in IS-SVG
Aliases: CVE-2021-29059
Severity: HIGH
CWE: CWE-770
Published: 2021-12-10T19:02:37Z

A vulnerability was discovered in IS-SVG version 4.3.1 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.
Vulnerability: GHSA-6hr9-4692-fch9
Summary: OS Command Injection in effect
Aliases: CVE-2020-7624
Severity: CRITICAL
CWE: CWE-78
Published: 2022-02-10T23:45:54Z

effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.
Vulnerability: GHSA-f7g4-fm4c-54m9
Summary: Malicious Package in yeoman-genrator
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:06:31Z

Version 2.0.2 of `yoeman-generator` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-jpq3-xf27-5jf2
Summary: Prototype Pollution in safe-object2
Aliases: CVE-2020-7726
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-06T18:26:42Z

All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.
Vulnerability: GHSA-6c37-2rw5-9j7x
Summary: Malicious Package in requesst
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:25:46Z

All versions of `requesst` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-53jx-4wwh-gcqj
Summary: Malicious Package in angular-location-update
Severity: CRITICAL
Published: 2020-09-11T21:11:34Z

Version 0.0.3 of `angular-location-update` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-4228-7qvx-f4rq
Summary: Injection and Command Injection in devcert
Aliases: CVE-2020-8186
Severity: HIGH
CWE: CWE-74, CWE-77, CWE-78
Published: 2021-05-18T01:41:56Z

A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFor` function.
Vulnerability: GHSA-qccf-q7p4-3q3j
Summary: Prototype Pollution in safe-object2
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-04T15:16:42Z

All versions of `safe-object2` are vulnerable to prototype pollution. The `settter()` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-wc7q-qpm4-8pqv
Summary: Malicious Package in rrequest
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:32:10Z

All versions of `rrequest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-3mhm-jvqj-fvhg
Summary: Malicious Package in js-sia3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:09:37Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-45w5-pvr8-4rh5
Summary: Command injection in eslint-fixer
Aliases: CVE-2021-26275
Severity: CRITICAL
CWE: CWE-77
Published: 2021-04-13T15:19:14Z

The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The ozum/eslint-fixer GitHub repository has been intentionally deleted.
Vulnerability: GHSA-p94w-42g3-f7h4
Summary: Holder can (re)create authentic credentials after receiving a credential in vp-toolkit
Severity: HIGH
Published: 2020-03-06T01:16:00Z

### Impact
The [`verifyVerifiableCredential()`](https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-credential-signer.ts#L57) method check the cryptographic integrity of the Verifiable Credential, but it does not check if the [`credential.issuer`](https://github.com/rabobank-blockchain/vp-toolkit-models/blob/develop/src/model/verifiable-credential.ts#L129) DID matches the signer of the credential.

The **verifier** is impacted by this vulnerability.

### Patches
Patch will be available in version 0.2.2.

### Workarounds
In case you trust certain issuers for certain credentials as a verifier, trust the issuer&#39;s public key from the `credential.proof.verificationMethod` field.

### References
[Github issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/13)

### For more information
If you have any questions or comments about this advisory:
* Discuss in the existing [issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/13)
* [Contact me](https://github.com/rabomarnix)
Vulnerability: GHSA-h5vj-f7r9-w564
Summary: Entropy Backdoor in text-qrcode
Severity: HIGH
CWE: CWE-506
Published: 2020-09-01T21:22:35Z

All versions of `text-qrcode` contain malicious code that overwrites the `randomBytes` method for the `crypto` module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte value being returned, but one that is easily guessable. 


## Recommendation

Uninstall `text-qrcode` immediately. If the module was used to generate entropy that is load bearing, all such instances of generated entropy must be replaced. This includes things like bitcoin wallets, private keys, encrypted messages, etc.
Vulnerability: GHSA-5q54-8p9j-x74j
Summary: Cross-site Scripting in pandao editor.md
Aliases: CVE-2019-14517
Severity: MODERATE
CWE: CWE-79
Published: 2019-08-23T00:05:03Z

pandao Editor.md 1.5.0 allows XSS via the Javas&#99;ript: string.
Vulnerability: GHSA-gvm7-8fq3-qjj2
Summary: Malicious Package in bs85
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:43:18Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-g3r2-65gc-qpqc
Summary: Denial of Service in mqtt-packet
Aliases: CVE-2016-10523
Severity: HIGH
CWE: CWE-400
Published: 2019-02-18T23:38:45Z

Versions of `mqtt-packet` prior to 3.4.6, or 4.x prior to 4.0.5 are affected by a denial of service vulnerability wherein specific sequences of MQTT packets can crash the application.




## Recommendation

Version 3.x: Update to version 3.4.6 or later.
Version 4.x: Update to version 4.0.5 or later.