TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-v73m-fjxv-w4rh
Summary: Hijacked Environment Variables in fabric-js
Aliases: CVE-2017-16053
Severity: MODERATE
CWE: CWE-506
Published: 2018-07-23T20:50:18Z

The `fabric-js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-3crj-w4f5-gwh4
Summary: Processing untrusted theming resources might execute arbitrary code (ACE)
Aliases: CVE-2021-21316
Severity: HIGH
CWE: CWE-74
Published: 2021-01-29T20:51:37Z

### Impact
When processing theming resources (i.e. `*.less` files) with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be executed in the context of the build process.

While this is a [feature](http://lesscss.org/usage/#less-options-enable-inline-javascript-deprecated-) of the [Less.js library](https://github.com/less/less.js), it is an unexpected behavior in the context of OpenUI5 and SAPUI5 development.

Especially in the context of [UI5 Tooling](https://github.com/SAP/ui5-tooling), which relies on less-openui5, this poses a security threat:

An attacker might create a [library](https://sap.github.io/ui5-tooling/pages/Builder/#library) or [theme-library](https://sap.github.io/ui5-tooling/pages/Builder/#theme-library) containing a custom control or theme, hiding malicious JavaScript code in one of the `.less` files.

This is an example of inline JavaScript in a Less file:
```less
.rule {
	@var: `(function(){console.log('Hello from JavaScript'); process.exit(1);})()`;
	color: @var;
}
```

Starting with Less.js version 3.0.0, the Inline JavaScript feature is disabled by default. less-openui5 however currently uses [a fork](https://github.com/SAP/less-openui5/tree/master/lib/thirdparty/less) of Less.js v1.6.3.

Note that disabling the Inline JavaScript feature in Less.js versions 1.x, still evaluates code has additional double codes around it:
```less
.rule {
	@var: "`(function(){console.log('Hello from JavaScript'); process.exit(1);})()`";
	color: @var;
}
```

### Patches
We decided to remove the inline JavaScript evaluation feature completely from the code of our Less.js fork.

This fix is available in less-openui5 version [v0.10.0](https://github.com/SAP/less-openui5/releases/tag/v0.10.0)

### Workarounds
Only process trusted theming resources.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/SAP/less-openui5
* Email us at secure@sap.com
Vulnerability: GHSA-q5c4-39f5-m68j
Summary: Regular Expression Denial of Service in decamelize
Aliases: CVE-2017-16023
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T20:00:17Z

Affected versions of `decamelize` are susceptible to a denial of service vulnerability when user input is passed directly into `decamelize`.




## Recommendation

Update to version 1.1.2 or later.
Vulnerability: GHSA-p6mc-m468-83gw
Summary: Prototype Pollution in lodash
Aliases: CVE-2020-8203
Severity: HIGH
CWE: CWE-1321, CWE-770
Published: 2020-07-15T19:15:48Z

Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The function zipObjectDeep allows a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires zipping objects based on user-provided property arrays.

This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.
Vulnerability: GHSA-cwx2-736x-mf6w
Summary: Prototype pollution in object-path
Aliases: CVE-2020-15256
Severity: HIGH
CWE: CWE-471, CWE-20
Published: 2020-10-19T20:55:55Z

### Impact
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable.
 
### Patches
Upgrade to version >= 0.11.5

### Workarounds
Don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.

### References
[Read more about the prototype pollution vulnerability](https://codeburst.io/what-is-prototype-pollution-49482fc4b638)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [object-path](https://github.com/mariocasciaro/object-path)
Vulnerability: GHSA-p9pm-55vp-2jqw
Summary: Downloads Resources over HTTP in soci
Aliases: CVE-2016-10669
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:44:32Z

Affected versions of `soci` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `soci`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-x949-7cm6-fm6p
Summary: Code Injection in md-to-pdf.
Aliases: CVE-2021-23639
Severity: CRITICAL
CWE: CWE-94
Published: 2021-12-16T14:34:40Z

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.
Vulnerability: GHSA-x26f-26qw-hhhx
Summary: Path Traversal in hekto
Aliases: CVE-2018-3725
Severity: HIGH
CWE: CWE-22
Published: 2018-07-26T15:22:00Z

Versions of `hekto` before 0.2.3 are vulnerable to path traversal. This allows a remote attacker to read content of arbitrary files.


## Recommendation

Update to version 0.2.3 or later.
Vulnerability: GHSA-p59g-6cqr-m73w
Summary: Malicious Package in bmap
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T20:45:27Z

Version 1.0.3 of `bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 1.0.3 of this module is found installed you will want to replace it with a version before or after 1.0.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-pg97-ww7h-5mjr
Summary: XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode 
Aliases: CVE-2019-10785
Severity: MODERATE
CWE: CWE-79
Published: 2020-02-13T22:21:06Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Potential XSS vulnerability for users of `dojox/xmpp` and `dojox/dtl`.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes, patches are available for the 1.11 through 1.16 versions. Users should upgrade to one of these versions of Dojo:

* 1.16.1
* 1.15.2
* 1.14.5
* 1.13.6
* 1.12.7
* 1.11.9

Users of Dojo 1.10.x and earlier should review this change and determine if it impacts them, and backport the change as appropriate.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

The change applied in https://github.com/dojo/dojox/pull/315 could get added separately as a patch.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [dojo/dojox](https://github.com/dojo/dojox/)
Vulnerability: GHSA-3949-f494-cm99
Summary: Cross-site Scripting in Prism
Aliases: CVE-2022-23647
Severity: HIGH
CWE: CWE-79
Published: 2022-02-22T19:32:18Z

### Impact
Prism's [Command line plugin](https://prismjs.com/plugins/command-line/) can be used by attackers to achieve an XSS attack. The Command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code.

Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted.

### Patches
This bug has been fixed in v1.27.0.

### Workarounds
Do not use the Command line plugin on untrusted inputs, or sanitized all code blocks (remove all HTML code text) from all code blocks that use the Command line plugin.

### References
- https://github.com/PrismJS/prism/pull/3341
Vulnerability: GHSA-rph7-j9qr-h8q8
Summary: Potential Command Injection in codem-transcode
Aliases: CVE-2013-7377
Severity: HIGH
CWE: CWE-77
Published: 2017-11-28T22:20:17Z

When the ffprobe functionality is enabled on the server, HTTP POST requests can be made to /probe. These requests are passed to the ffprobe binary on the server. Through this HTTP endpoint it is possible to send a malformed source file name to ffprobe that results in arbitrary command execution.

### Mitigating Factors:
The ffprobe functionality is not enabled by default. In addition, exploitation opportunities are limited in a standard configuration because the server binds to the local interface by default.


## Recommendation

An updated and patched version of the module (version 0.5.0) is available via npm. Users who have enabled the ffprobe functionality are especially encouraged to upgrade..
Vulnerability: GHSA-xx4c-jj58-r7x6
Summary:  Inefficient Regular Expression Complexity in Validator.js
Severity: MODERATE
CWE: CWE-1333
Published: 2021-11-19T20:14:23Z

### Impact
Versions of `validator` prior to 13.7.0 are affected by an inefficient Regular Expression complexity  when using the `rtrim` and `trim` sanitizers.

### Patches
The problem has been patched in validator 13.7.0
Vulnerability: GHSA-8w9j-6wg6-qv4f
Summary: Malicious Package in axioss
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:41:17Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-m273-wwfv-h6jp
Summary: Directory Traversal in fancy-server
Aliases: CVE-2014-10066
Severity: HIGH
CWE: CWE-22
Published: 2020-08-31T22:44:33Z

Versions 0.1.4 and earlier of fancy-server are vulnerable to a directory traversal attack. 

Standard attack vectors such as `../` will allow an attacker to read files outside of the served directory.


## Recommendation

Upgrade to version 0.1.4 or greater.
Vulnerability: GHSA-7r28-3m3f-r2pr
Summary: Regular Expression Denial of Service (ReDoS)
Aliases: CVE-2021-28092
Severity: HIGH
CWE: CWE-400
Published: 2021-03-19T21:25:50Z

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time.
Vulnerability: GHSA-563h-49v8-g7x4
Summary: Malicious Package in ks-sha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:17:01Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-9hqj-38j2-5jgm
Summary: Command Injection in ascii-art
Severity: LOW
CWE: CWE-77
Published: 2020-09-01T21:19:23Z

Versions of `ascii-art` before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the `ascii-art preview` command. 


Example Proof of concept:
`ascii-art preview 'doom"; touch /tmp/malicious; echo "'`

Given that the input is passed on the command line and none of the api methods are vulnerable to this,  the likely exploitation vector is when the ascii-art comment is being called programmatically using something like `execFile`.


## Recommendation

Update to version 1.4.4 or later.
Vulnerability: GHSA-4x6x-782q-jfc4
Summary: Command Injection in node-wifi
Severity: CRITICAL
CWE: CWE-77
Published: 2020-09-03T02:38:47Z

Versions of `node-wifi` prior to 2.0.12 are vulnerable to Command Injection. The package fails to sanitize user input, allowing attackers to inject commands through the `ssid` variable and possibly achieving Remote Code Execution on the system.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-pp7m-6j83-m7r6
Summary: Cross-site Scripting in video.js
Aliases: CVE-2021-23414
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-10T16:09:36Z

This affects the package video.js before 7.14.3.
 The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
Vulnerability: GHSA-q9q6-f556-gpm7
Summary: Improper Verification of Cryptographic Signature in starkbank-ecdsa
Aliases: CVE-2021-43571
Severity: CRITICAL
CWE: CWE-347
Published: 2021-11-10T20:58:42Z

The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
Vulnerability: GHSA-cfhg-9x44-78h2
Summary: Command Injection in ps
Aliases: CVE-2018-16460
Severity: MODERATE
CWE: CWE-77
Published: 2018-09-17T20:43:59Z

Versions of `ps` before 1.0.0 are vulnerable to command injection.

Proof of concept:

```
var ps = require('ps');

ps.lookup({ pid: "$(touch success.txt)" }, function(err, proc) { // this method is vulnerable to command injection
    if (err) {throw err;}
    if (proc) {
        console.log(proc);  // Process name, something like "node" or "bash"
    } else {
        console.log('No such process');
    }
});

// Result: The file success.txt will exist on the filesystem if the touch command was executed
```


## Recommendation

Update to version 1.0.0 or later.
Vulnerability: GHSA-m744-2jj8-vpfv
Summary: Command injection in git-parse
Aliases: CVE-2021-26543
Severity: HIGH
CWE: CWE-74
Published: 2022-02-10T23:51:16Z

The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.
Vulnerability: GHSA-6xvq-2gj8-4276
Summary: Cross site scripting in valine
Aliases: CVE-2020-28847
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-06T00:01:29Z

valine is a fast, simple & powerful comment system. Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment. A fix was released in version 1.4.15.
Vulnerability: GHSA-rf54-44jr-q5vf
Summary: Improper Input Validation in url-js
Aliases: CVE-2022-25839
Severity: MODERATE
CWE: CWE-20
Published: 2022-03-12T00:00:26Z

The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
Vulnerability: GHSA-4x37-5rh2-hp8c
Summary: Hijacked Environment Variables in node-opencv
Aliases: CVE-2017-16067
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-29T23:50:59Z

The `node-opencv` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-j7j5-752x-wr4v
Summary: Downloads Resources over HTTP in xd-testing
Aliases: CVE-2016-10653
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:45:21Z

Affected versions of `xd-testing` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `xd-testing`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-f246-xrrj-g8j6
Summary: Cross-site Scripting in markdown-it-highlightjs
Aliases: CVE-2020-7773
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-10T20:19:47Z

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require("markdown-it-highlightjs"); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.">js}'); console.log(reuslt_xss);
Vulnerability: GHSA-x9p2-fxq6-2m5f
Summary: Reverse Tabnapping in swagger-ui
Severity: MODERATE
CWE: CWE-1022
Published: 2019-06-20T14:33:07Z

Versions of `swagger-ui` prior to 3.18.0 are vulnerable to [Reverse Tabnapping](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page. This is commonly used for phishing attacks.


## Recommendation

Upgrade to version 3.18.0 or later.
Vulnerability: GHSA-934x-72xh-5hrg
Summary: OS command injection in aws-lambda
Aliases: CVE-2019-10777
Severity: CRITICAL
CWE: CWE-78
Published: 2020-02-14T23:09:45Z

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName".
Vulnerability: GHSA-jcpv-g9rr-qxrc
Summary: Regular Expression Denial of Service in hawk
Aliases: CVE-2016-2515
Severity: HIGH
Published: 2018-07-31T22:52:00Z

Versions of `hawk` prior to 3.1.3, or 4.x prior to 4.1.1 are affected by a regular expression denial of service vulnerability related to excessively long headers and URI's.



## Recommendation

Update to hawk version 4.1.1 or later.
Vulnerability: GHSA-p6vg-p826-qp3v
Summary: URL Redirection to Untrusted Site ('Open Redirect') in fastify-static
Aliases: CVE-2021-22963
Severity: MODERATE
CWE: CWE-601
Published: 2021-10-05T20:24:49Z

### Impact

A redirect vulnerability in the `fastify-static` module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//google.com/%2e%2e`.

The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.

### Patches
The issue has been patched in `fastify-static@4.2.4`

### Workarounds
If updating is not an option, you can sanitize the input URLs using the [`rewriteUrl`](https://www.fastify.io/docs/latest/Server/#rewriteurl) server option.

### References

+ Bug founder: drstrnegth
+ [hackerone Report](https://hackerone.com/reports/1354255)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fastify-static](https://github.com/fastify/fastify-static)
* Contact the [security team](https://github.com/fastify/fastify/blob/main/SECURITY.md#the-fastify-security-team)
Vulnerability: GHSA-3fx5-fwvr-xrjg
Summary: Regular Expression Denial of Service in ms
Aliases: CVE-2015-8315
Severity: HIGH
CWE: CWE-400
Published: 2017-10-24T18:33:36Z

Versions of `ms` prior to 0.7.1 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.

## Proof of Concept
```javascript
var ms = require('ms');
var genstr = function (len, chr) {
   var result = "";
   for (i=0; i<=len; i++) {
       result = result + chr;
   }

   return result;
}

ms(genstr(process.argv[2], "5") + " minutea");

```

### Results
Showing increase in execution time based on the input string.
```
$ time node ms.js 10000

real	0m0.758s
user	0m0.724s
sys	0m0.031s

$ time node ms.js 20000

real	0m2.580s
user	0m2.494s
sys	0m0.047s

$ time node ms.js 30000

real	0m5.747s
user	0m5.483s
sys	0m0.080s

$ time node ms.js 80000

real	0m41.022s
user	0m38.894s
sys	0m0.529s
```
Vulnerability: GHSA-6rv4-4qv6-88g2
Summary: Prototype Pollution in set-or-get
Aliases: CVE-2021-25913
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-04-12T17:39:19Z

Prototype pollution vulnerability in ‘set-or-get’ version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-cqv6-7fwc-8m3c
Summary: Directory Traversal in xtalk
Aliases: CVE-2017-16091
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T16:44:59Z

Affected versions of `xtalk` are vulnerable to directory traversal, allowing access to the filesystem by placing "../" in the URL.

## Proof of Concept

```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:localhost
```




## Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2014.

The best mitigation is currently to avoid using this package, and using a different, functionally equivalent package.
Vulnerability: GHSA-84g3-cv89-m9gm
Summary: Prototype pollution vulnerability in 'patchmerge'
Aliases: CVE-2021-25916
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-10-13T15:33:20Z

Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-25pr-6pr6-68v7
Summary: Path traversal in atlasboard
Aliases: CVE-2021-39109
Severity: HIGH
CWE: CWE-22
Published: 2021-09-02T17:17:25Z

The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.
Vulnerability: GHSA-jh5w-6964-x5cf
Summary: Downloads Resources over HTTP in chromedriver
Aliases: CVE-2016-10579
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:58:05Z

Affected versions of `chromedriver` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This may result in arbitrary code execution if an attacker intercepts and modifies the downloaded binary file, replacing it with a malicious one. 



## Recommendation

Update to version 2.26.1 or later.
Vulnerability: GHSA-pgcr-7wm4-mcv6
Summary: Sensitive Data Exposure in pem
Severity: CRITICAL
CWE: CWE-200
Published: 2019-06-04T15:42:45Z

Versions of `pem` before 1.13.2 expose sensitive data when the `readPkcs12` is used. 

The `readPkcs12` function reads the certificate and key data from a pkcs12 file using the encryption password. As part of this process it creates a globally readable file with a filename of 20 random 0-f characters in the temporary directory containing the password which is then read by OpenSSL. The file containing the password is never cleaned up after it is used giving access to the pkcs12 password to any other users with access to read files from the system.



## Recommendation

Update to version 1.13.2 or later.
Vulnerability: GHSA-37vc-gwvp-6cgv
Summary: Malicious Package in bitcoijns-lib
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:42:49Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-76p6-gpvf-6wmv
Summary: Directory Traversal in hftp
Aliases: CVE-2017-16039
Severity: HIGH
CWE: CWE-22
Published: 2018-07-24T15:50:28Z

Affected versions of `hftp` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-pr8j-3v7m-j4vv
Summary: Directory Traversal in myprolyz
Aliases: CVE-2017-16156
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:21:45Z

Affected versions of `myprolyz` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-5pxj-mhwj-x5gv
Summary: Prototype Pollution in asciitable.js
Aliases: CVE-2020-7771
Severity: CRITICAL
CWE: CWE-400
Published: 2021-04-13T15:24:59Z

The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function.
Vulnerability: GHSA-2q6w-rxf3-4wc9
Summary: Malicious Package in codify
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T19:49:18Z

Version 0.3.1 of `codify` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.3.1 of this module is found installed you will want to replace it with a version before or after 0.3.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-cxm3-v4mv-6mh8
Summary: Cross-site Scripting in vditor
Aliases: CVE-2021-4103
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-28T22:04:11Z

vditor does not filter user input
Vulnerability: GHSA-g9wg-wq4f-2x5w
Summary: Cross-Site Scripting in console-feed
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T19:00:10Z

Versions of `console-feed` prior to 2.8.10 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape the rendered output. If an application uses `console-feed` and a malicious JavaScript payload was passed to a `console.log('%_', payload)` call, the package would render HTML containing the malicious payload.


## Recommendation

Upgrade to version 2.8.10 or later.
Vulnerability: GHSA-vwr2-wj63-86gr
Summary: Path Traversal in simplehttpserver
Aliases: CVE-2018-16478
Severity: MODERATE
CWE: CWE-22, CWE-12
Published: 2018-12-06T15:49:10Z

All versions of `simplehttpserver` are vulnerable to Path Traversal. 

This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL.


## Recommendation

No fix is currently available. Do not use `simplehttpserver` in production or consider using an alternative module until a fix is made available.
Vulnerability: GHSA-8mrf-64fw-2x75
Summary: Command injection in fs-path
Aliases: CVE-2020-8298
Severity: CRITICAL
CWE: CWE-77
Published: 2021-03-25T21:06:41Z

fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` methods.
Vulnerability: GHSA-fpgg-r39h-3x5x
Summary: Malicious Package in cxt
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:06:22Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-2958-5r4r-wvv6
Summary: Directory Traversal in caolilinode
Aliases: CVE-2017-16159
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:27:05Z

Affected versions of `caolilinode` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-xfhh-g9f5-x4m4
Summary: Resource exhaustion in socket.io-parser
Aliases: CVE-2020-36049
Severity: HIGH
CWE: CWE-400
Published: 2021-06-30T16:51:31Z

The `socket.io-parser` npm package before versions 3.3.2 and 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
Vulnerability: GHSA-36m4-6v6m-4vpr
Summary: Cross-site Scripting in remarkable
Aliases: CVE-2019-12043
Severity: MODERATE
CWE: CWE-79
Published: 2019-05-29T18:04:55Z

In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.
Vulnerability: GHSA-wgw3-gf4p-62xc
Summary: Command Injection in wizard-syncronizer
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-11T21:16:59Z

All versions of `wizard-syncronizer` are vulnerable to Command Injection. The package does not validate input on the `cloneAndSync` function  and concatenates it to an exec call. This can be abused through a malicious widget containing the payload in the `gitURL` value or through a MITM attack since the package does not enforce HTTPS. This may allow attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-qw9c-8p76-3q2x
Summary: Directory Traversal in serve46
Aliases: CVE-2017-16148
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:49:11Z

Affected versions of `serve46` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-8g7p-74h8-hg48
Summary: Denial of Service in https-proxy-agent
Aliases: CVE-2018-3739
Severity: CRITICAL
CWE: CWE-400, CWE-125
Published: 2018-07-27T17:04:52Z

Versions of `https-proxy-agent` before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to `Buffer()`.


## Recommendation

Update to version 2.2.0 or later.
Vulnerability: GHSA-h8mc-42c3-r72p
Summary: Downloads resources over HTTP in hubl-server
Aliases: CVE-2017-16035
Severity: HIGH
CWE: CWE-311
Published: 2018-07-24T15:40:47Z

Affected versions of `hubl-server` insecurely download dependencies over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the responses and replace the dependencies with malicious ones, resulting in code execution on the system running `hubl-server`.


## Recommendation

No patch is currently available for this vulnerability, and it has not seen any updates since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised yo
Vulnerability: GHSA-qxg5-2qff-p49r
Summary: Passing in a non-string 'html' argument can lead to unsanitized output
Aliases: CVE-2021-32696
Severity: MODERATE
CWE: CWE-241, CWE-79, CWE-843
Published: 2021-06-18T19:31:35Z

A type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function.

### Impact

XSS

### Patches

`3.2.0`

### Workarounds

Ensure that the `html` parameter is a string before calling the function.
Vulnerability: GHSA-8864-rhmw-5m6f
Summary: Cross-Site Scripting in status-board
Aliases: CVE-2019-15479
Severity: MODERATE
CWE: CWE-79
Published: 2019-09-23T18:32:42Z

All versions of `status-board` are vulnerable to Cross-Site Scripting. The `renderDashboard()` function concatenates the `safeDashboard` variable to the printed error message with insufficient sanitization. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-38hx-3542-8fh3
Summary: Malicious code in `electorn`
Severity: CRITICAL
CWE: CWE-506
Published: 2020-10-01T17:09:56Z

npm packages `loadyaml` and `electorn` were removed from the npm registry for containing malicious code. Upon installation the package runs a preinstall script that writes a public comment on GitHub containing the following information:
- IP and IP-based geolocation
- home directory name
- local username 

The malicious packages have been removed from the npm registry and the leaked content removed from GitHub.
Vulnerability: GHSA-fq77-7p7r-83rj
Summary: Directory Traversal in Next.js
Aliases: CVE-2020-5284
Severity: MODERATE
CWE: CWE-23
Published: 2020-03-30T20:40:50Z

### Impact

- **Not affected**: Deployments on ZEIT Now v2 ([https://zeit.co](https://zeit.co/)) are not affected
- **Not affected**: Deployments using the `serverless` target
- **Not affected**: Deployments using `next export`
- **Affected**: Users of Next.js below 9.3.2

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

### Patches

https://github.com/zeit/next.js/releases/tag/v9.3.2

### References

https://github.com/zeit/next.js/releases/tag/v9.3.2
Vulnerability: GHSA-8v63-cqqc-6r2c
Summary: Prototype Pollution in object-path
Aliases: CVE-2021-3805
Severity: HIGH
CWE: CWE-915, CWE-1321
Published: 2021-09-20T20:46:43Z

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerability: GHSA-w7q9-p3jq-fmhm
Summary: Uncontrolled resource consumption in jpeg-js
Aliases: CVE-2020-8175
Severity: MODERATE
CWE: CWE-400
Published: 2020-07-27T15:46:57Z

Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image.
Vulnerability: GHSA-h5vm-jhq7-w647
Summary: Malicious Package in momen
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:17:13Z

All versions of `momen` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-h47j-hc6x-h3qq
Summary: Remote Code Execution Vulnerability in NPM mongo-express
Aliases: CVE-2019-10758
Severity: HIGH
Published: 2019-12-30T19:30:31Z

### Impact

Remote code execution on the host machine by any authenticated user.

### Proof Of Concept

Launching mongo-express on a Mac, pasting the following into the "create index" field will pop open the Mac calculator:

```javascript
this.constructor.constructor("return process")().mainModule.require('child_process').execSync('/Applications/Calculator.app/Contents/MacOS/Calculator')
```

### Patches
Users should upgrade to version `0.54.0`

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References
[Snyk Security Advisory](https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215)
[CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10758)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)

#### Thanks

@JLLeitschuh for finding and reporting this vulnerability
Vulnerability: GHSA-4g88-fppr-53pp
Summary: Prototype Pollution in set-value
Aliases: CVE-2019-10747
Severity: CRITICAL
CWE: CWE-400
Published: 2019-08-27T17:43:33Z

Versions of `set-value` prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The `set` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.




## Recommendation

If you are using `set-value` 3.x, upgrade to version 3.0.1 or later.
If you are using `set-value` 2.x, upgrade to version 2.0.1 or later.
Vulnerability: GHSA-4xc9-xhrj-v574
Summary: Prototype Pollution in lodash
Aliases: CVE-2018-16487
Severity: HIGH
CWE: CWE-400
Published: 2019-02-07T18:16:48Z

Versions of `lodash` before 4.17.5 are vulnerable to prototype pollution. 

The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.17.11 or later.
Vulnerability: GHSA-pjh3-jv7w-9jpr
Summary: Command Injection in gm
Aliases: CVE-2015-7982
Severity: CRITICAL
CWE: CWE-77
Published: 2020-09-01T15:18:55Z

Versions of `gm` prior to 1.21.1 are affected by a command injection vulnerability. The vulnerability is triggered when user input is passed into `gm.compare()`, which fails to sanitize input correctly before calling the graphics magic binary.


## Recommendation

Update to version 1.21.1 or later.
Vulnerability: GHSA-86gv-xpwv-jprc
Summary: Malicious Package in diamond-clien
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:36:00Z

All versions of `diamond-clien` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-fp82-2h99-3fpp
Summary: Prototype Pollution in async merge-object
Aliases: CVE-2018-3753
Severity: CRITICAL
CWE: CWE-20, CWE-1321
Published: 2018-09-18T13:47:24Z

The utilities function in all versions of the merge-object node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Vulnerability: GHSA-3p22-ghq8-v749
Summary: Renderers can obtain access to random bluetooth device without permission in Electron
Aliases: CVE-2022-21718
Severity: LOW
CWE: CWE-668
Published: 2022-03-22T18:49:36Z

### Impact
This vulnerability allows renderers to obtain access to a random bluetooth device via the [web bluetooth API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Bluetooth_API) if the app has not configured a custom `select-bluetooth-device` event handler.  The device that is accessed is random and the attacker would have no way of selecting a specific device.

All current stable versions of Electron are affected.

### Patches
This has been patched and the following Electron versions contain the fix:
* `17.0.0-alpha.6`
* `16.0.6`
* `15.3.5`
* `14.2.4`
* `13.6.6`

### Workarounds
Adding this code to your app can workaround the issue.

```js
app.on('web-contents-created', (event, webContents) => {
  webContents.on('select-bluetooth-device', (event, devices, callback) => {
    // Prevent default behavior
    event.preventDefault();
    // Cancel the request
    callback('');
  });
});
```

For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org.
Vulnerability: GHSA-wpq7-q8j4-72jg
Summary: Auth0-js bypasses CSRF checks
Aliases: CVE-2018-7307
Severity: HIGH
CWE: CWE-352
Published: 2018-03-07T22:22:24Z

The Auth0.js library has a vulnerability affecting versions below 9.3 that allows an attacker to bypass the CSRF check from the state parameter if it's missing from the authorization response, leaving the client vulnerable to CSRF attacks.
Vulnerability: GHSA-4fc4-4p5g-6w89
Summary: Cross-site Scripting in CKEditor4
Aliases: CVE-2022-24728
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-16T22:47:55Z

### Affected packages
The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.

### Impact
A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.18.0.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.18.0.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank GHSL team member Kevin Backhouse ([@kevinbackhouse](https://github.com/kevinbackhouse)) for recognizing and reporting this vulnerability.
Vulnerability: GHSA-h2j3-gg8w-4858
Summary: Malicious Package in buffer-xos
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:12:09Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-49rv-g7w5-m8xx
Summary: Cross-Site Scripting in @novnc/novnc
Aliases: CVE-2017-18635
Severity: MODERATE
CWE: CWE-79
Published: 2020-08-28T21:24:59Z

Versions of `@novnc/novnc` prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects any users of `include/ui.js` and users of `vnc_auto.html` and `vnc.html`.


## Recommendation

Upgrade to version 0.6.2 or later.
Vulnerability: GHSA-2jm5-2cqf-6vw9
Summary: Malicious Package in baes-x
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:30:32Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-m5ch-gx8g-rg73
Summary: Remote Code Execution in pomelo-monitor
Severity: HIGH
CWE: CWE-20
Published: 2020-09-02T15:43:53Z

All versions of `pomelo-monitor` are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-2m53-83f3-562j
Summary: Prototype pollution in min-dash < 3.8.1
Severity: HIGH
CWE: CWE-1321
Published: 2022-02-01T00:44:35Z

### Impact

The `set` method is vulnerable to prototype pollution with specially crafted inputs.

```javascript
// insert the following into poc.js and run node poc,js (after installing the package)
 
let parser = require("min-dash");
parser.set({}, [["__proto__"], "polluted"], "success");
console.log(polluted);
```

### Patches

`min-dash>=3.8.1` fix the issue.

### Workarounds

No workarounds exist for the issue.

### References

Closed via https://github.com/bpmn-io/min-dash/pull/21.

### Credits

Credits to Cristian-Alexandru STAICU who found the vulnerability and to Idan Digmi from the Snyk Security Team who reported the vulnerability to us, responsibly.