TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-qmw8-3v4g-gwj4
Summary: Prefix escape
Aliases: CVE-2021-21321
Severity: CRITICAL
CWE: CWE-20
Published: 2021-03-03T01:52:05Z

### Impact

By crafting a specific URL, it is possible to escape the prefix of the proxied backend service.
If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. Unfortunately, it is.

[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

### Patches

A patch have been submitted by Corey Farrell git@cfware.com, the reporter.
All releases after v4.0.2 include the fix.

### Workarounds

There are no workaround available.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fastify-reply-from](https://github.com/fastify/fastify-reply-from)
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Vulnerability: GHSA-h9mj-fghc-664w
Summary: Denial of Service in mqtt
Aliases: CVE-2017-10910
Severity: MODERATE
CWE: CWE-674
Published: 2017-12-28T22:51:58Z

Affected versions of `mqtt` do not properly handle PUBLISH packets returning from the server, leading to a Denial of Service condition.

The vulnerability is completely mitigated if the only connected servers are trusted, guaranteed not to be under the control of a malicious actor.

## Proof of Concept

The following is a demonstration of how to generate the malicious packet sequence, but does not include information on handling the initial network connections and MQTT overhead.
```
var mqttp = require('mqtt-packet');
var packets = [];
for(var i=0; i<=1000;i++){
    packets.push(
        mqttp.generate({
            cmd:'publish',
            topic:Buffer.from('hello'),
            payload:Buffer.from('world'),
            retain: false,
            dup: false, 
            messageId: ++i, 
            qos: 1
        })
    )
}

```


## Recommendation

Update to version 2.15.0 or later.
Vulnerability: GHSA-5w9c-rv96-fr7g
Summary: Removal of functional code in faker.js
Severity: HIGH
Published: 2022-03-22T19:28:24Z

Faker.js helps users create large amounts of data for testing and development. The maintainer deliberately removed the functional code from this package. This appears to be a purposeful and successful attempt to make the package unusable. This is related to the colors.js [CVE-2021-23567](https://github.com/advisories/GHSA-gh88-3pxp-6fm8). 

The functional code for this package was forked and can be found [here](https://github.com/faker-js/faker).
Vulnerability: GHSA-mmj4-777p-fpq9
Summary: Validation bypass in frourio-express
Aliases: CVE-2022-23624
Severity: HIGH
CWE: CWE-20
Published: 2022-02-07T22:38:37Z

## 日本語

### 影響
v0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。

### パッチ
frourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには `class-transformer` と `reflect-metadata` の依存への追加も必要となります。

### ワークアラウンド
controller側で自分でclass-transformerを使用してチェックする、vaildatorを使わない、など。

### さらなる情報

このセキュリティ勧告に関する質問やコメントについては、以下の方法でお問い合わせいただけます。
* [frourio](https://github.com/frouriojs/frourio)にIssueを開く。

## English

### Impact
Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder. Validators does not work properly for request bodies and queries in specific situations. Addtionally, some kind of input is not validated. (false positives)

### Patches
Please update your frourio to v0.26.0 or later. You also need to install `class-transformer` and `reflect-metadata` to your project.

### Workarounds
Validate objects from request with class-transformer in controllers by yourself, or prevent using validators.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [frourio](https://github.com/frouriojs/frourio)
Vulnerability: GHSA-mf6x-7mm4-x2g7
Summary: Out-of-bounds Read in stringstream
Aliases: CVE-2018-21270
Severity: MODERATE
CWE: CWE-125
Published: 2019-06-20T18:22:32Z

All versions of `stringstream` are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is being passed in to `stringstream`.
Vulnerability: GHSA-4vmm-mhcq-4x9j
Summary: Sandbox Bypass Leading to Arbitrary Code Execution in constantinople
Severity: CRITICAL
Published: 2019-06-14T16:15:14Z

Versions of `constantinople` prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution.


## Recommendation

Update to version 3.1.1 or later.
Vulnerability: GHSA-v66p-w7qx-wv98
Summary: Authentication Bypass in express-laravel-passport
Severity: CRITICAL
CWE: CWE-287
Published: 2020-09-04T17:29:34Z

All versions of `express-laravel-passport` are vulnerable to an Authentication Bypass. The package fails to properly validate JWTs, allowing attackers to send HTTP requests impersonating other users.


## Recommendation

Upgrade to version 2.0.5 or later.
Vulnerability: GHSA-gpfj-4j6g-c4w9
Summary: Clipboard-based DOM-XSS
Aliases: CVE-2021-37700
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-12T20:42:17Z

### Impact

A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown library. If the clipboard data contains the string `<table>`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected.

The following @github/paste-markdown code snippet is triggered when the user pastes something and the browser's clipboard data contains an entry whose content-type is **text/HTML**.

```typescript
function generateText(transfer: DataTransfer): string | undefined {
  if (Array.from(transfer.types).indexOf('text/html') === -1) return

  let html = transfer.getData('text/html')
  if (!/<table/i.test(html)) return

  html = html.replace(/<meta.*?>/, '')

  const el = document.createElement('div')
  el.innerHTML = html
  const tables = el.querySelectorAll('table')

  for (const table of tables) {
    if (table.closest('[data-paste-markdown-skip]')) {
      table.replaceWith(new Text(table.textContent || ''))
    }
    const formattedTable = tableMarkdown(table)
    table.replaceWith(new Text(formattedTable))
  }

  return el.innerHTML
}
```

### Patches
A security patch was released in [version 0.3.4](https://github.com/github/paste-markdown/releases/tag/v0.3.4).

### Workarounds
A Content Security Policy that prevents `unsafe-inline` helps reduce the likelihood of this vulnerability being exploited in modern browsers.

<!--
### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
*
-->
Vulnerability: GHSA-38h8-x697-gh8q
Summary: Tmp files readable by other users in sync-exec
Aliases: CVE-2017-16024
Severity: MODERATE
CWE: CWE-377
Published: 2018-11-09T17:45:30Z

Affected versions of `sync-exec` use files located in `/tmp/` to buffer command results before returning values. As `/tmp/` is almost always set with world readable permissions, this may allow low privilege users on the system to read the results of commands run via `sync-exec` under a higher privilege user.


## Recommendation

There is currently no direct patch for `sync-exec`, as the `child_process.execSync` function provided in Node.js v0.12.0 and later provides the same functionality natively. 

The best mitigation currently is to update to Node.js v0.12.0 or later, and migrate all uses of `sync-exec` to `child_process.execSync()`.
Vulnerability: GHSA-6qc7-jgq7-34rf
Summary: Malicious Package in exprss
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:18:18Z

All versions of `exprss` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-pxcf-v868-m492
Summary: Injection and Cross-site Scripting in osm-static-maps
Aliases: CVE-2020-7749
Severity: HIGH
CWE: CWE-74, CWE-79
Published: 2021-05-10T18:43:45Z

This affects all versions of package osm-static-maps under 3.9.0. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.
Vulnerability: GHSA-9prh-257w-9277
Summary: Cross-Site Scripting in handlebars
Aliases: CVE-2015-8861
Severity: MODERATE
CWE: CWE-79
Published: 2018-10-23T17:20:12Z

Versions of `handlebars` prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted.


## Proof of Concept
Template:
```<a href={{foo}}/>```

Input:
```{ 'foo' : 'test.com onload=alert(1)'}```

Rendered result:
```<a href=test.com onload=alert(1)/>```


## Recommendation

Update to version 4.0.0 or later.
Alternatively, ensure that all attributes in handlebars templates are encapsulated with quotes.
Vulnerability: GHSA-jgpq-g82g-6c39
Summary: confinit vulnerable to prototype pollution
Aliases: CVE-2020-7638
Severity: MODERATE
CWE: CWE-915
Published: 2020-04-07T15:52:05Z

confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
Vulnerability: GHSA-fj58-h2fr-3pp2
Summary: SQL Injection and Cross-site Scripting in class-validator
Aliases: CVE-2019-18413
Severity: MODERATE
CWE: CWE-79, CWE-89
Published: 2021-10-12T16:35:45Z

In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.
Vulnerability: GHSA-4jg2-84c2-pj95
Summary: Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina
Severity: CRITICAL
CWE: CWE-94
Published: 2021-09-21T18:41:59Z

### Impact
Anyone who is using the default presets and/or does not handle the functionality themself.

### Patches
It has not been patched yet.

### Workarounds
Fully custom presets that change the entire rendering process which can then escape the user input.

### For more information
Even though that I changed all the presets here, the vulnerability is still present throughout. I am using a JSON Schema here for simplicity.
```ts
const jsonSchemaDoc = {
  $id: 'CustomClass',
  type: 'object',
  properties: {
      'property: any; \n constructor(){console.log("injected")} \n private _temp': { type: 'string' },
  }
};
generator = new TypeScriptGenerator(
  { 
    presets: [
      {
        class: {
            property({ propertyName, content }) {
              return `private ${propertyName}: any;`;
            },
            ctor() {
              return '';
            },
            getter() {
              return '';
            },
            setter() {
              return '';
            }
        }
      }
    ]
  }
);
const inputModel = await generator.process(jsonSchemaDoc);
```
This would render
```ts
export class CustomClass {
  private property: any; 
   constructor(){console.log("injected")} 
   private _temp: any;
  private additionalProperties: any;
}
```
Vulnerability: GHSA-8w74-g84v-c5w8
Summary: Directory Traversal in chatbyvista
Aliases: CVE-2017-16177
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:52:26Z

Affected versions of `chatbyvista` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-gvcj-pfq2-wxj7
Summary: High severity vulnerability that affects electron
Aliases: CVE-2016-1202
Severity: HIGH
CWE: CWE-426
Published: 2017-10-24T18:33:35Z

Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.
Vulnerability: GHSA-w3pp-wp5v-fjvp
Summary: Malicious Package in mogodb
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:51:18Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-qvjc-g5vr-mfgr
Summary: Regular Expression Denial of Service in papaparse
Severity: HIGH
CWE: CWE-185
Published: 2020-09-04T18:03:04Z

Versions of `papaparse` prior to 5.2.0 are vulnerable to Regular Expression Denial of Service (ReDos). The `parse` function contains a malformed regular expression that takes exponentially longer to process non-numerical inputs. This allows attackers to stall systems and lead to Denial of Service.


## Recommendation

Upgrade to version 5.2.0 or later.
Vulnerability: GHSA-fpf2-pr3j-4cm3
Summary: Malicious Package in ecruve
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:06:06Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-7w54-gp8x-f33m
Summary: Potential exposure of tokens to an Unauthorized Actor
Aliases: CVE-2022-21671
Severity: HIGH
CWE: CWE-200
Published: 2022-01-12T22:44:47Z

### Impact

When using this library as a way to programmatically communicate with Replit in a standalone fashion, if there are multiple failed attempts to contact Replit through a WebSocket, the library will attempt to communicate using a fallback poll-based proxy. The URL of the proxy has changed, so any communication done to the previous URL could potentially reach a server that is outside of Replit's control and the token used to connect to the Repl could be obtained by an attacker, leading to full compromise of that Repl (not of the account).

### Patches

This was patched in 7.3.1, by updating the address of the fallback WebSocket polling proxy to the new one.

### Workarounds

Specify the new address for the polling host (`gp-v2.replit.com`) in the `ConnectArgs`:

```typescript
const connectOptions: ConnectArgs = {
  // ...
  pollingHost: 'gp-v2.replit.com',
};
client.connect(connectOptions);
```

### For more information

Thanks to https://hackerone.com/orlserg for disclosing this.

If you have any questions or comments about this advisory:
* Open an issue in [replit/crosis](https://github.com/replit/crosis)
* Email us at [security@replit.com](mailto:security@replit.com)
Vulnerability: GHSA-4hjg-w3ww-38c6
Summary: Malicious Package in tiar
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T18:03:49Z

All versions of `tiar` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-qw3g-35hc-fcrh
Summary: Cross-Site Scripting (XSS) in restify
Aliases: CVE-2017-16018
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-09T17:45:38Z

Affected versions of `restify` are susceptible to a cross-site scripting vulnerability when using URL encoded script tags in a non-existent URL.

## Proof of Concept:

Request
```
https://localhost:3000/no5_such3_file7.pl?%22%3E%3Cscript%3Ealert(73541);%3C/script%3E
```

Will be included in response:

```<script>alert(73541);</script>```


## Recommendation

Update to version 4.1.0 or later.
Vulnerability: GHSA-6hwh-rqwf-cxxr
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util
Aliases: CVE-2019-10806
Severity: MODERATE
CWE: CWE-915, CWE-20
Published: 2021-05-07T16:32:02Z

vega-util prior to 1.13.1 allows manipulation of object prototype. The &#39;vega.mergeConfig&#39; method within vega-util could be tricked into adding or modifying properties of the Object.prototype.
Vulnerability: GHSA-9m6j-fcg5-2442
Summary: Path traversal in url-parse
Aliases: CVE-2021-27515
Severity: HIGH
CWE: CWE-23
Published: 2021-05-06T16:10:51Z

url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Vulnerability: GHSA-74f5-4m28-gq5c
Summary: Directory Traversal in peiserver
Aliases: CVE-2017-16214
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:09:59Z

Affected versions of `peiserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-rr77-w4w8-w8wp
Summary: Directory Traversal in tencent-server
Aliases: CVE-2017-16216
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:37:46Z

Affected versions of `tencent-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-hwch-749c-rv63
Summary: Potential Command Injection in hubot-scripts
Aliases: CVE-2013-7378
Severity: CRITICAL
CWE: CWE-74
Published: 2020-08-31T22:46:38Z

Versions 2.4.3 and earlier of hubot-scripts are vulnerable to a command injection vulnerablity in the `hubot-scripts/package/src/scripts/email.coffee` module.


### Mitigating Factors
The email script is not enabled by default, it has to be manually added to hubot's list of loaded scripts.


## Recommendation

Update hubot-scripts to version 2.4.4 or later.
Vulnerability: GHSA-8vv3-jxm8-f4vf
Summary: Prototype Pollution in connie-lang
Aliases: CVE-2020-7706
Severity: CRITICAL
CWE: CWE-915
Published: 2021-05-06T17:29:25Z

The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.
Vulnerability: GHSA-5w65-6875-rhq8
Summary: Undefined Behavior in sailsjs-cacheman
Severity: LOW
Published: 2019-09-11T23:01:57Z

All versions of `sailsjs-cacheman` have a vulnerability that may lead to Undefined Behavior. The config variable is exposing to the global scope which may overwrite other variables and cause the application to misbehave.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-h68q-55jf-x68w
Summary: Prototype pollution in chart.js
Aliases: CVE-2020-7746
Severity: HIGH
CWE: CWE-915
Published: 2021-05-10T18:47:53Z

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.
Vulnerability: GHSA-34gh-3cwv-wvp2
Summary: Directory traversal in rollup-plugin-server
Aliases: CVE-2020-7683
Severity: HIGH
CWE: CWE-22
Published: 2020-07-29T18:07:11Z

This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function.
Vulnerability: GHSA-xfmw-2vmm-579c
Summary: Hijacked Environment Variables in nodesass
Aliases: CVE-2017-16080
Severity: MODERATE
CWE: CWE-506
Published: 2020-09-01T18:59:50Z

The `nodesass` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-p62r-jf56-h429
Summary: Malicious Package in evil-package
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T20:29:58Z

All versions of `evil-package` contain malicious code. The package uploads the contents of `process.env` to `example.com/log`.


## Recommendation

Remove the package from your environment. Given the host where the information was uploaded to there is no further indication of compromise.
Vulnerability: GHSA-fm4j-4xhm-xpwx
Summary: Sandbox Breakout / Arbitrary Code Execution in sandbox
Severity: MODERATE
Published: 2020-09-02T15:51:34Z

All versions of `sandbox` are vulnerable to Sandbox Escape leading to Remote Code Execution. Due to insufficient input sanitization it is possible to escape the sandbox using constructors.

## Proof of concept
```
var Sandbox = require("sandbox")
s = new Sandbox()
code = `new Function("return (this.constructor.constructor('return (this.process.mainModule.constructor._load)')())")()("util").inspect("hi")`
s.run(code)
```


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-98pq-pmw9-4gpm
Summary: SQL Injection in sequelize
Aliases: CVE-2016-10550
Severity: HIGH
CWE: CWE-89
Published: 2019-02-18T23:54:34Z

Affected versions of `sequelize` are vulnerable to SQL Injection in locations where user input is passed into the `limit` or `order` parameters of `sequelize` query calls, such as `findOne` or `findAll`.



## Recommendation

Update to version 3.17.0 or later.
Vulnerability: GHSA-w8h4-vw8f-rvvj
Summary: Improper Control of Dynamically-Managed Code Resources in config-shield
Aliases: CVE-2021-26276
Severity: MODERATE
CWE: CWE-913
Published: 2021-04-13T15:30:09Z

scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data.
Vulnerability: GHSA-w5p7-h5w8-2hfq
Summary: Regular Expression Denial of Service in trim
Aliases: CVE-2020-7753
Severity: HIGH
CWE: CWE-400
Published: 2021-05-10T18:44:22Z

All versions of package trim lower than 0.0.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
Vulnerability: GHSA-2w8g-m5j8-7m87
Summary: Zalgo-like output that crashes the server
Severity: CRITICAL
Published: 2022-01-12T21:45:59Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

[`colors`](https://npmjs.com/package/colors) package caused zalgo-like output (see https://github.com/soketi/soketi/issues/276, https://github.com/Marak/colors.js/issues/289), breaking the servers.

**Only NPM users that recently upgraded or installed the NPM package are affected.**

Docker users seem to not be affected as the dependencies were bundled at the time of the build, which were tested.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Latest patch. `0.26.1` to be exact at the time of writing.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

You cannot get around this as it's related to dependencies.

### References
_Are there any links users can visit to find out more?_

- https://github.com/Marak/colors.js/issues/289

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the issues board](https://github.com/soketi/soketi/issues)
* Email us at [alex@renoki.org](mailto:alex@renoki.org)
Vulnerability: GHSA-2mm9-c2fx-c7m4
Summary: XSS in docsify
Aliases: CVE-2021-23342
Severity: HIGH
CWE: CWE-79
Published: 2021-03-01T19:44:27Z

This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” characters
Vulnerability: GHSA-59m2-j944-839w
Summary: Downloads Resources over HTTP in clang-extra
Aliases: CVE-2016-10655
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:45:13Z

Affected versions of `clang-extra` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `clang-extra`.


## Recommendation

No patch is currently available for this vulnerability. The package author stated that no patch is possible until llvm provides HTTPS support, and a patch would be possible if that ever happened in the future.

The best mitigation option is to reduce the risk of exploitation as much as possible. This can be done by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-3hvm-hgpw-rx4j
Summary: Path Traversal in knightjs
Aliases: CVE-2018-16475
Severity: HIGH
CWE: CWE-22
Published: 2018-11-06T23:11:10Z

All versions of `knightjs` are vulnerable to Path Traversal. 

This vulnerability allows an attacker to read content of arbitrary files on the server due to lack of input validation.


## Recommendation

As there is currently no fix for this module we recommend not using this module in production environments.
Vulnerability: GHSA-prv2-xwr7-hr57
Summary: Uncontrolled Resource Consumption in rdf-graph-array
Aliases: CVE-2019-10798
Severity: MODERATE
CWE: CWE-400
Published: 2021-04-13T15:23:21Z

rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype.
Vulnerability: GHSA-56pc-6jqp-xqj8
Summary: Context isolation bypass in Electron
Aliases: CVE-2020-15215
Severity: LOW
CWE: CWE-668, CWE-693
Published: 2020-10-06T17:46:40Z

### Impact
Apps using both `contextIsolation` and `sandbox: true` are affected.
Apps using both `contextIsolation` and `nativeWindowOpen: true` are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

### Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.

### Fixed Versions
* `11.0.0-beta.6`
* `10.1.2`
* `9.3.1`
* `8.5.2`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)
Vulnerability: GHSA-5v9h-q3gj-c32x
Summary: SQL Injection via GeoJSON in sequelize
Aliases: CVE-2016-1000225
Severity: CRITICAL
CWE: CWE-89
Published: 2020-09-01T15:27:40Z

Affected versions of `sequelize` are vulnerable to SQL Injection in Models that have fields with the `GEOMETRY` DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using `ST_GeomFromGeoJSON`, and MySQL GeoJSON documents using `GeomFromText`.


## Recommendation

Update to version 3.23.6 or later.
Vulnerability: GHSA-cxjc-r2fp-7mq6
Summary: XSS in dijit editor's LinkDialog plugin 
Aliases: CVE-2020-4051
Severity: LOW
CWE: CWE-79
Published: 2020-06-15T21:53:12Z

### Impact
XSS possible for users of the Dijit Editor's LinkDialog plugin

### Patches
Yes, 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3

### Workarounds
Users may apply the patch made in these releases.


### For more information
If you have any questions or comments about this advisory, open an issue in [dojo/dijit](https://github.com/dojo/dijit/)
Vulnerability: GHSA-7375-vjr2-3g7w
Summary: Cross-Site Scripting in glance
Aliases: CVE-2018-3748
Severity: MODERATE
CWE: CWE-79
Published: 2018-09-27T11:37:19Z

Versions of `glance` before 3.0.8 are vulnerable to Stored Cross-Site Scripting (XSS). This is only exploitable if the attacker is able to control the name of a file that is served by the `glance` package.
Vulnerability: GHSA-x2fc-mxcx-w4mf
Summary: Prototype Pollution in mathjs
Aliases: CVE-2020-7743
Severity: HIGH
CWE: CWE-915
Published: 2021-05-10T18:39:04Z

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.
Vulnerability: GHSA-gcv8-gh4r-25x6
Summary: Authorization Bypass Through User-Controlled Key in urijs
Aliases: CVE-2022-0613
Severity: MODERATE
CWE: CWE-639
Published: 2022-02-17T00:00:35Z

Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647.
Vulnerability: GHSA-4r97-78gf-q24v
Summary: Prototype Pollution in klona
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-04T17:53:27Z

Versions of `klona` prior to 1.1.1 are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype when cloning objects, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

Upgrade to version 1.1.1 or later.
Vulnerability: GHSA-cgjx-mwpx-47jv
Summary: Private Data Disclosure in express-restify-mongoose
Aliases: CVE-2016-10533
Severity: HIGH
CWE: CWE-200
Published: 2018-10-23T17:14:57Z

Affected versions of `express-restify-mongoose` are susceptible to an information leakage vulnerability which may allow an attacker to access fields on a model even if those fields are marked as private.


## Proof of Concept

If you have a user model that you want to protect, such as the following User model:
```
const User = mongoose.model('User', new mongoose.Schema({
    name: String,
    password: String,
}));
```

You would normally do something such as:
```
restify.serve(router, User, {
    private: ['password'], // Set the password part of User as private, so outside people can't read it
})
```

This would hide the password field from people that send your application a `GET /User` and `GET /User/some-user-id` request. 

A malicious user can go to your application and send a request for `GET /User?distinct=password` and get all the passwords for all the users in the database, despite the field being set to private. This could be used for other private data, if the malicious user knew what was set as private for specific routes.


## Recommendation

Version 2.x: Update to version 2.5.0 or later.
Version 3.x: Update to version 3.1.0 or later.
Vulnerability: GHSA-m6wh-m8m8-6xx5
Summary: Exfiltrates data on installation in cofeescript
Aliases: CVE-2017-16202
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-06T20:05:28Z

The `cofeescript` package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

If you have found `cofeescript` installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your SSH keys, registry credentials, tokens, and any other sensitive credentials that may have been present in your bash history.

Additionally, any service which may have been exposed via credentials in your bash history or accessible via your ssh keys, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-4g54-95xv-f353
Summary: Hijacked Environment Variables in http-proxy.js
Aliases: CVE-2017-16075
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-29T23:16:56Z

The `http-proxy.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-pw2r-vq6v-hr8c
Summary: Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
Aliases: CVE-2022-0536
Severity: MODERATE
CWE: CWE-200
Published: 2022-02-10T00:00:31Z

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.
Vulnerability: GHSA-388g-jwpg-x6j4
Summary: Cross-Site Scripting in swagger-ui
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-11T21:20:14Z

Versions of `swagger-ui` prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 3.0.13 or later.
Vulnerability: GHSA-8qm2-24qc-c4qg
Summary: Malicious Package in freshdom
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T19:57:56Z

Version 0.0.6 of `freshdom` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.6 of this module is found installed you will want to replace it with a version before or after 0.0.6. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-9g9w-hmvj-5h57
Summary: Prototype Pollution in merge-deep
Aliases: CVE-2018-3722
Severity: LOW
CWE: CWE-471
Published: 2018-07-26T15:17:15Z

Versions of `merge-deep` before 3.0.1 are vulnerable to prototype pollution via merging functions.


## Recommendation

Update to version 3.0.1 or later.
Vulnerability: GHSA-9j5m-873f-xh76
Summary: Directory Traversal in static-html-server
Aliases: CVE-2017-16152
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:46:32Z

Affected versions of `static-html-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-xqh8-5j36-4556
Summary: SQL Injection in connect-pg-simple
Aliases: CVE-2019-15658
Severity: HIGH
CWE: CWE-89
Published: 2019-08-26T16:59:45Z

Versions of `connect-pg-simple` are vulnerable to SQL Injection. The `PGStore.prototype.quotedTable` function allows for the query to be manipulated if the input has double quotes through the `schemaName` or `tableName` variables. These variables are passed to the constructor and are unlikely to be controlled by user-input. If they are controlled by user-input it could allow attackers to execute arbitrary SQL queries.


## Recommendation

Upgrade to version 6.0.1 or later.
Vulnerability: GHSA-f5cv-xrv9-r8w7
Summary: NoSQL injection in express-cart
Severity: HIGH
CWE: CWE-89
Published: 2020-09-01T21:17:16Z

Versions of `express-cart` before 1.1.8 are vulnerable to NoSQL injection. 

The vulnerability is caused by the lack of user input sanitization in the login handlers. In both cases, the customer login and the admin login, parameters from the JSON body are sent directly into the MongoDB query which allows to insert operators. 

These operators can be used to extract the value of the field blindly in the same manner of a blind SQL injection. In this case, the `$regex` operator is used to guess each character of the token from the start.


## Recommendation

Update to version 1.1.8 or later.
Vulnerability: GHSA-9fhw-r42p-5c7r
Summary: Regular expression Denial of Service in @progfay/scrapbox-parser
Aliases: CVE-2021-27405
Severity: MODERATE
CWE: CWE-400
Published: 2021-03-01T20:44:44Z

### Impact

A [Regular expression Denial of Service](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) flaw was found in the @progfay/scrapbox-parser package before 6.0.3, 7.0.2 for Node.js.
The attacker that is able to be parsed a specially crafted text may cause the application to consume an excessive amount of CPU.

### Patches

Upgrade to version 6.0.3, 7.0.2 or later.

### Workarounds

Avoid to parse text with a lot of `[` chars.

### References

* https://github.com/progfay/scrapbox-parser/pull/519
* https://github.com/progfay/scrapbox-parser/pull/539
* https://github.com/progfay/scrapbox-parser/pull/540
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-27405
* https://snyk.io/vuln/SNYK-JS-PROGFAYSCRAPBOXPARSER-1076803

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/progfay/scrapbox-parser](https://github.com/progfay/scrapbox-parser/issues)
Vulnerability: GHSA-mmph-wp49-r48h
Summary: Malicious Package in experss
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:20:26Z

All versions of `experss` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-fw76-p9p2-6pvf
Summary: Malicious Package in serilize
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:58:58Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-5mjw-6jrh-hvfq
Summary: Sandbox Breakout / Arbitrary Code Execution in static-eval
Aliases: CVE-2017-16226
Severity: MODERATE
CWE: CWE-20
Published: 2018-08-06T21:37:06Z

Affected versions of `static-eval` pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.

## Proof of concept
```
var evaluate = require('static-eval');
var parse = require('esprima').parse;
var src = '(function(){console.log(process.pid)})()';
var ast = parse(src).body[0].expression;
var res = evaluate(ast, {});
// Will print the process id
```


## Recommendation

Update to version 2.0.0 or later.
Vulnerability: GHSA-7cg8-pq9v-x98q
Summary: Sandbox Breakout in realms-shim
Severity: CRITICAL
Published: 2019-10-21T21:58:55Z

Versions of `realms-shim` prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting function. Confined code which used the evaluator itself could provide a malicious rewriter function that captured this object, and use it to breach the sandbox.


## Recommendation

Upgrade to version 1.2.1 or later.
Vulnerability: GHSA-3q32-j57w-q4w7
Summary: Path Traversal in total.js
Aliases: CVE-2019-8903
Severity: HIGH
CWE: CWE-22
Published: 2019-02-20T15:40:13Z

Affected versions of `total.js` are vulnerable to Path Traversal.  Due to insufficient input sanitization in URLs, attackers can access server files outside the `/public` folder by using relative paths.  
The files served are limited to these file types: `flac`, `jpg`, `jpeg`, `png`, `gif`, `ico`, `js`, `css`, `txt`, `xml`, `woff`, `woff2`, `otf`, `ttf`, `eot`, `svg`, `zip`, `rar`, `pdf`, `docx`, `xlsx`, `doc`, `xls`, `html`, `htm`, `appcache`, `manifest`, `map`, `ogv`, `ogg`, `mp4`, `mp3`, `webp`, `webm`, `swf`, `package`, `json`, `md`, `m4v`, `jsx`, `heif`, `heic`.


## Recommendation

- If you are using version 2.1.x, upgrade to 2.1.1 or later.
- If you are using version 2.2.x, upgrade to 2.2.1 or later.
- If you are using version 2.3.x, upgrade to 2.3.1 or later.
- If you are using version 2.4.x, upgrade to 2.4.1 or later.
- If you are using version 2.5.x, upgrade to 2.5.1 or later.
- If you are using version 2.6.x, upgrade to 2.6.3 or later.
- If you are using version 2.7.x, upgrade to 2.7.1 or later.
- If you are using version 2.8.x, upgrade to 2.8.1 or later.
- If you are using version 2.9.x, upgrade to 2.9.5 or later.
- If you are using version 3.0.x, upgrade to 3.0.1 or later.
- If you are using version 3.1.x, upgrade to 3.1.1 or later.
- If you are using version 3.2.x, upgrade to 3.2.4 or later.
Vulnerability: GHSA-q257-vv4p-fg92
Summary: Header Forgery in http-signature
Aliases: CVE-2017-16005
Severity: LOW
CWE: CWE-20
Published: 2018-11-09T17:49:34Z

Affected versions of `http-signature` contain a vulnerability which can allow an attacker in a privileged network position to modify header names and change the meaning of the request, without requiring an updated signature. 

This problem occurs because vulnerable versions of `http-signature` sign the contents of headers, but not the header names.

## Proof of Concept

Consider this to be the initial, untampered request:
```
POST /pay HTTP/1.1
Host: example.com
Date: Thu, 05 Jan 2012 21:31:40 GMT
X-Payment-Source: src@money.com
X-Payment-Destination: dst@money.com
Authorization: Signature keyId="Test",algorithm="rsa-sha256",headers="x-payment-source x-payment-destination" MDyO5tSvin5...
```

And the request is intercepted and tampered as follows:
```
X-Payment-Source: dst@money.com // Emails switched
X-Payment-Destination: src@money.com
Authorization: Signature keyId="Test",algorithm="rsa-sha256",headers="x-payment-destination x-payment-source" MDyO5tSvin5...
```

In the resulting responses, both requests would pass signature verification without issue.
```
src@money.com\n
dst@money.com\n
```



## Recommendation

Update to version 0.10.0 or higher.
Vulnerability: GHSA-v3wr-67px-44xg
Summary: Execution with Unnecessary Privileges in arc-electron
Severity: HIGH
Published: 2022-03-03T19:11:14Z

### Impact

When the end-user click on the response header that contains a link the target will be opened in ARC new window. This window will have the default preload script loaded which allows the scripts embedded in the link target to execute any logic that ARC has access to from the renderer process, which includes file system access, data store access (which may contain sensitive information), and some additional processes that only ARC should have access to.

### Patches

This is patched in version 17.0.9.

### Workarounds

Do not click onto any link in the response headers view.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [advanced-rest-client/arc-electron](https://github.com/advanced-rest-client/arc-electron)
* Email us at [Salesforce Security](mailto:security@salesforce.com)
Vulnerability: GHSA-h726-x36v-rx45
Summary: Prototype Pollution in lodash.merge
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-03T18:04:54Z

Versions of `lodash.merge` before 4.6.2 are vulnerable to prototype pollution. The function `merge` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.2 or later.
Vulnerability: GHSA-rrqv-vjrw-hrcr
Summary: Arbitrary Code Execution in json-ptr
Severity: HIGH
CWE: CWE-74
Published: 2021-05-26T19:59:19Z

There is a security vulnerability in `json-ptr` versions prior to v2.1.0 in which an unscrupulous actor may execute arbitrary code. If your code sends un-sanitized user input to json-ptr's .get() method, your project is vulnerable to this injection-style vulnerability.