TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-mxhp-79qh-mcx6
Summary: taffy can allow access to any data items in the DB
Aliases: CVE-2019-10790
Severity: HIGH
CWE: CWE-668, CWE-20
Published: 2020-02-19T16:43:42Z

taffy through 2.6.2 allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properties into user-input. If index is found in the query, taffyDB will ignore other query conditions and directly return the indexed data item. Moreover, the internal index is in an easily-guessable format (e.g., T000002R000001). As such, attackers can use this vulnerability to access any data items in the DB.
Vulnerability: GHSA-6m6m-j2hm-pxrg
Summary: Malicious Package in cicada-render
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:37:05Z

All versions of `cicada-render` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-qm4q-f956-fg64
Summary: Malicious Package in luna-mock
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:39:13Z

All versions of `luna-mock` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-3rpr-mg43-xhq4
Summary: High severity vulnerability that affects auth0-js
Aliases: CVE-2017-17068
Severity: HIGH
CWE: CWE-200
Published: 2017-12-21T00:47:20Z

A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions &lt; 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback().
Vulnerability: GHSA-87vv-r9j6-g5qv
Summary: Regular Expression Denial of Service in moment
Aliases: CVE-2016-4055
Severity: MODERATE
CWE: CWE-400
Published: 2017-10-24T18:33:35Z

Versions of `moment` prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into `moment.duration()`.


## Proof of concept
```
var moment = require('moment');

var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}


for (i=20000;i<=10000000;i=i+10000) {
    console.log("COUNT: " + i);
    var str = '-' + genstr(i, '1')
    console.log("LENGTH: " + str.length);
    var start = process.hrtime();
    moment.duration(str)

    var end = process.hrtime(start);
    console.log(end);
}
```

### Results
```
$ node moment.js
COUNT: 20000
LENGTH: 20002
[ 0, 618931029 ]
COUNT: 30001
LENGTH: 30003
[ 1, 401413894 ]
COUNT: 40002
LENGTH: 40004
[ 2, 437075303 ]
COUNT: 50003
LENGTH: 50005
[ 3, 824664804 ]
COUNT: 60004
LENGTH: 60006
[ 5, 651335262 ]
```


## Recommendation

Please update to version 2.11.2 or later.
Vulnerability: GHSA-5rm3-qhxf-rh3r
Summary: Downloads Resources over HTTP in co-cli-installer
Aliases: CVE-2016-10657
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:45:10Z

Affected versions of `co-cli-installer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `co-cli-installer`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-8c3f-x5f9-6h62
Summary: Command injection in @diez/generation
Aliases: CVE-2021-32830
Severity: LOW
CWE: CWE-77, CWE-78
Published: 2021-09-02T17:08:20Z

The `@diez/generation` npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/generation library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. All versions of this package are vulnerable as of the writing of this CVE.
Vulnerability: GHSA-wxrm-2h86-v95f
Summary: Malicious Package in pizza-pasta
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:04:20Z

Version 1.0.3 of `pizza-pasta` contains malicious code as a install scripts. The package created folders in the system's Desktop and downloaded an image from `imgur.com`. The package also printed the users SSH keys to the console.


## Recommendation

Remove the package from your environment. There are no evidences of further compromise.
Vulnerability: GHSA-vgjp-vh3c-32v3
Summary: Directory Traversal in mockserve
Aliases: CVE-2017-16146
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:46:55Z

Affected versions of `mockserve` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-cvfm-xjc8-f2vm
Summary: Denial of Service in @commercial/subtext
Severity: HIGH
Published: 2020-09-03T15:46:36Z

Version 5.1.1 of `@commercial/subtext` is vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 5.1.2 or later.
Vulnerability: GHSA-2598-2f59-rmhq
Summary: SQL Injection in sequelize
Aliases: CVE-2019-10749
Severity: CRITICAL
CWE: CWE-89
Published: 2019-11-08T17:05:17Z

Versions of `sequelize` prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect,  which may allow attackers to inject SQL statements and execute arbitrary SQL queries.


## Recommendation

Upgrade to version 3.35.1 or later.
Vulnerability: GHSA-wh33-4p32-g7vh
Summary: Directory Traversal in serverxxx
Aliases: CVE-2017-16182
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:43:56Z

Affected versions of `serverxxx` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-cf4h-3jhx-xvhq
Summary: Arbitrary Code Execution in underscore
Aliases: CVE-2021-23358
Severity: HIGH
CWE: CWE-94
Published: 2021-05-06T16:09:43Z

The package `underscore` from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Vulnerability: GHSA-4g77-cvgw-grvw
Summary: Prototype Pollution in putil-merge
Aliases: CVE-2021-23470
Severity: HIGH
CWE: CWE-1321
Published: 2022-02-05T00:00:31Z

This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077
Vulnerability: GHSA-cq8r-fc3q-6hg2
Summary: Denial of Service (DoS) via the unsetByPath function in jsjoints
Aliases: CVE-2020-28479
Severity: HIGH
CWE: CWE-400
Published: 2021-04-13T15:29:40Z

The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.
Vulnerability: GHSA-p4mf-4qvh-w8g5
Summary: Malicious Package in bitcionjslib
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:41:42Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-6495-8jvh-f28x
Summary: File restriction bypass in socket.io-file
Severity: HIGH
CWE: CWE-20
Published: 2020-10-02T15:39:54Z

All versions of `socket.io-file`are vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker to intercept the Websocket request post-validation and alter the `name` value to upload any file types.

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-rwcq-qpm6-7867
Summary: Malicious Package in riped160
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:04:32Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-72q2-5rxx-xfff
Summary: Downloads Resources over HTTP in gfe-sass
Aliases: CVE-2017-16040
Severity: HIGH
CWE: CWE-311
Published: 2020-09-01T16:12:12Z

Affected versions of `gfe-sass` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `gfe-sass`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-8qpm-5c82-rf96
Summary: Prototype Pollution in backbone-query-parameters
Aliases: CVE-2021-20085
Severity: HIGH
CWE: CWE-1321
Published: 2021-05-06T15:52:02Z

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject properties into Object.prototype.
Vulnerability: GHSA-qvp5-mm7v-4f36
Summary: Cross-site Scripting in Strapi
Aliases: CVE-2020-27666
Severity: HIGH
CWE: CWE-79
Published: 2020-10-29T19:40:08Z

Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.
Vulnerability: GHSA-qc22-qwm9-j8rx
Summary: Remote Code Execution in npm-groovy-lint
Severity: CRITICAL
CWE: CWE-20
Published: 2021-12-20T16:59:31Z

Versions of npm-groovy-lint prior to 9.1.0 bundle vulnerable versions of the Log4j library which are subject to remote code execution via jndi rendering. As a result npm-groovy-lint prior to 9.1.0 is also vulnerable.
Vulnerability: GHSA-p6jh-p7q8-pcrg
Summary: Prototype Pollution in nodee-utils
Aliases: CVE-2020-7722
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-06T18:26:21Z

All versions of package nodee-utils below version 1.2.3 are vulnerable to Prototype Pollution via the deepSet function.
Vulnerability: GHSA-566m-qj78-rww5
Summary: Regular Expression Denial of Service in postcss
Aliases: CVE-2021-23382
Severity: MODERATE
CWE: CWE-400
Published: 2022-01-07T00:21:36Z

The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
Vulnerability: GHSA-cqqh-49mx-fq63
Summary: Prototype Pollution in merge
Aliases: CVE-2021-3645
Severity: MODERATE
CWE: CWE-915, CWE-1321
Published: 2021-09-13T20:16:54Z

merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerability: GHSA-265q-28rp-chq5
Summary: Insecure Entropy Source - Math.random() in node-uuid
Aliases: CVE-2015-8851
Severity: HIGH
CWE: CWE-331
Published: 2020-04-16T03:14:50Z

Affected versions of `node-uuid` consistently fall back to using `Math.random` as an entropy source instead of `crypto`, which may result in guessable UUID's.



## Recommendation

Update to version 1.4.4 or later.
Vulnerability: GHSA-m6rw-m2v9-7hx4
Summary: OS Command Injection in wifiscanner
Aliases: CVE-2020-15362
Severity: CRITICAL
CWE: CWE-78
Published: 2021-05-17T21:00:59Z

wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code Injection because it can be used with options to overwrite the default executable/binary path and its arguments. An attacker can abuse this functionality to execute arbitrary code.
Vulnerability: GHSA-3xph-cp8f-2229
Summary: Prototype Pollution in @fabiocaccamo/utils.js
Aliases: CVE-2021-3815
Severity: HIGH
CWE: CWE-1321
Published: 2021-12-10T20:31:32Z

utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
Vulnerability: GHSA-cff4-rrq6-h78w
Summary: Command Injection in command-exists
Severity: CRITICAL
CWE: CWE-77
Published: 2019-06-03T17:31:26Z

Versions of `command-exists` before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module.


## Recommendation

Update to version 1.2.4 or later.
Vulnerability: GHSA-9gqr-xp86-f87h
Summary: Code injection in npm git
Aliases: CVE-2021-23632
Severity: MODERATE
CWE: CWE-94, CWE-78
Published: 2022-03-18T00:01:11Z

All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. At this time, there is no known workaround. There has been no patch released.
Vulnerability: GHSA-xrjf-phvv-r4vr
Summary: Command injection in strapi
Aliases: CVE-2022-0764
Severity: MODERATE
CWE: CWE-77, CWE-78
Published: 2022-02-27T00:00:15Z

When creating a strapi app using npxcreate-strapi-app, we can inject arbitrary commands through the template cli argument as per the code in this particular [link](https://github.com/strapi/strapi/blob/master/packages/generators/app/lib/utils/fetch-npm-template.js#L13), this happens due to improper sanitization of user input.
Vulnerability: GHSA-pf8j-vhg8-xmc3
Summary: Injection in karma-mojo
Aliases: CVE-2020-7626
Severity: CRITICAL
CWE: CWE-78
Published: 2022-02-10T23:42:58Z

karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument.
Vulnerability: GHSA-wg85-p6j7-gp3w
Summary: Moderate severity vulnerability that affects simplemde
Aliases: CVE-2018-19057
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-21T22:21:25Z

SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.
Vulnerability: GHSA-wx3q-6x7x-jjw4
Summary: Downloads Resources over HTTP in mystem
Aliases: CVE-2016-10664
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:44:39Z

Affected versions of `mystem` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mystem`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-vcjf-mgcg-jxjq
Summary: Cross-site Scripting in CKEditor 4.0
Aliases: CVE-2020-9281
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-07T16:32:17Z

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
Vulnerability: GHSA-wvh7-5p38-2qfc
Summary: Storing Password in Local Storage
Severity: MODERATE
CWE: CWE-256
Published: 2020-07-23T18:20:10Z

The `setPassword` method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the documentation under Users > Signing Up, it clearly states, "We never store passwords in plaintext, nor will we ever transmit passwords back to the client in plaintext."

Example Code:
```js
async () => {
    const user = Parse.User.current()
    if (user) {
        user.setPassword('newpass')
        await user.save()
    }
}
```
After running the above code, the new password will be stored in localStorage as a property named "password".

Proposed Solution:
Before saving anything to localStorage, Parse should strip out any properties named "password" that are attempting to be stored with a Parse.User type object.

Configuration:
Parse SDK: 2.9.1
Parse Server: 3.9.0
Vulnerability: GHSA-762f-c2wg-m8c8
Summary: Denial of Service in protobufjs
Aliases: CVE-2018-3738
Severity: MODERATE
CWE: CWE-770
Published: 2018-10-09T00:27:15Z

Versions of `protobufjs` before 5.0.3 and 6.8.6 are vulnerable to denial of service when parsing crafted invalid *.proto files.


## Recommendation

Update to version 5.0.3, 6.8.6 or later.
Vulnerability: GHSA-85q4-v37c-wfpc
Summary: Malicious Package in bitcion-ops
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:39:28Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-cqr2-xhg6-p268
Summary: OS Command Injection in node-mpv
Aliases: CVE-2020-7632
Severity: CRITICAL
CWE: CWE-78
Published: 2022-01-07T00:20:27Z

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
Vulnerability: GHSA-v464-rcx7-j875
Summary: Directory Traversal in infraserver
Aliases: CVE-2017-16142
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:48:29Z

Affected versions of `infraserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-4rx9-58m7-gr8w
Summary: Malicious Package in css_transform_step
Severity: CRITICAL
Published: 2020-09-01T19:53:40Z

Version 1.0.6 of `css_transform_step` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.6 of this module is found installed you will want to replace it with a version before or after 1.0.6. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-6m8p-4fxj-pgc2
Summary: OS Command Injection in mversion
Aliases: CVE-2020-7688
Severity: MODERATE
CWE: CWE-78
Published: 2021-05-17T21:01:08Z

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
Vulnerability: GHSA-435c-qcpm-wjw5
Summary: Malicious Package in fs-extar
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:05:43Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hxwc-5vw9-2w4w
Summary: NoSQL Injection in loopback-connector-mongodb
Severity: HIGH
CWE: CWE-89
Published: 2020-09-02T15:52:39Z

Versions of `loopback-connector-mongodb` prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak.


## Recommendation

Upgrade to version 3.6.0 or later.
Vulnerability: GHSA-45j8-pm75-5v8x
Summary: Path Traversal in simplehttpserver
Aliases: CVE-2018-16493
Severity: HIGH
CWE: CWE-548
Published: 2019-02-07T18:18:04Z

Versions of `simplehttpserver` prior to 0.2.1 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to version 0.2.1 or later.
Vulnerability: GHSA-68hw-vfh7-xvg8
Summary: Forced Logout in keycloak-connect
Aliases: CVE-2019-10157
Severity: MODERATE
CWE: CWE-287, CWE-345
Published: 2019-06-13T20:38:09Z

Versions of `keycloak-connect` prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the `/k_logout` route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely.


## Recommendation

Upgrade to version 4.4.0 or later.
Vulnerability: GHSA-4v4g-726h-xvfv
Summary: Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime
Aliases: CVE-2021-29445
Severity: MODERATE
CWE: CWE-696, CWE-203, CWE-208
Published: 2021-04-19T14:59:06Z

### Impact

[AES_CBC_HMAC_SHA2 Algorithm](https://tools.ietf.org/html/rfc7518#section-5.2) (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).

### Patches

A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`.

Users should upgrade to `^3.11.4`.

### Credits
Thanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
Vulnerability: GHSA-4j54-mxf6-wxx2
Summary: OS Command Injection in pomelo-monitor
Aliases: CVE-2020-7620
Severity: CRITICAL
CWE: CWE-78
Published: 2021-05-10T18:37:16Z

pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params.
Vulnerability: GHSA-5rwj-j5m3-3chj
Summary: Missing Release of Memory after Effective Lifetime in detect-character-encoding
Aliases: CVE-2021-39176
Severity: HIGH
CWE: CWE-401
Published: 2021-09-01T18:25:16Z

### Impact

In detect-character-encoding v0.3.0 and earlier, allocated memory is not released.

### Patches

The problem has been patched in [detect-character-encoding v0.3.1](https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.3.1).

### CVSS score

[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C)

Base Score: 7.5 (High)
Temporal Score: 7.2 (High)

Since detect-character-encoding is a library, the scoring is based on the “[reasonable worst-case implementation scenario](https://www.first.org/cvss/v3.1/user-guide#3-7-Scoring-Vulnerabilities-in-Software-Libraries-and-Similar)”, namely, using detect-character-encoding in a program accessible over the internet which becomes unavailable when running out of memory. Depending on your specific implementation, the vulnerability’s severity in your program may be different.

### Proof of concept

```js
const express = require("express");
const detectCharacterEncoding = require("detect-character-encoding");

const app = express();

app.get("/", (req, res) => {
  detectCharacterEncoding(Buffer.from("foo"));

  res.end();
});

app.listen(3000);
```

`hey -n 1000000 http://localhost:3000` ([`hey`](https://github.com/rakyll/hey)) causes the Node.js process to consume more and more memory.

### References

- https://github.com/sonicdoe/detect-character-encoding/commit/d44356927b92e3b13e178071bf6d7c671766f588
- https://github.com/sonicdoe/detect-character-encoding/pull/6
Vulnerability: GHSA-ggq8-j54v-54x8
Summary: Directory Traversal in sspa
Aliases: CVE-2017-16145
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:47:02Z

Affected versions of `sspa` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-h73g-8g27-xxcx
Summary: Command injection in corenlp-js-prefab
Aliases: CVE-2020-28439
Severity: CRITICAL
CWE: CWE-78
Published: 2021-04-13T15:22:58Z

This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.'
Vulnerability: GHSA-22gq-x6pg-752j
Summary: Hijacked Environment Variables in openssl.js
Aliases: CVE-2017-16065
Severity: CRITICAL
CWE: CWE-506, CWE-433
Published: 2018-08-29T23:45:41Z

The `openssl.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-c2gp-86p4-5935
Summary: Use-After-Free in puppeteer
Aliases: CVE-2019-5786
Severity: MODERATE
CWE: CWE-416
Published: 2020-09-02T18:25:43Z

Versions of `puppeteer` prior to 1.13.0 are vulnerable to the Use-After-Free vulnerability in Chromium (CVE-2019-5786). The Chromium FileReader API is vulnerable to Use-After-Free which may lead to Remote Code Execution.


## Recommendation

Upgrade to version 1.13.0 or later.
Vulnerability: GHSA-p7c9-jqhq-vr3v
Summary: Remote Code Execution in markdown-pdf
Aliases: CVE-2018-3770
Severity: HIGH
CWE: CWE-22
Published: 2018-07-27T17:03:46Z

Versions of `markdown-pdf` prior to 9.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize HTML code in markdown files. If markdown files with malicious HTML are converted to PDF, the resulting PDF file will execute any JavaScript code in the original markdown file. This may allow attackers to execute Remote Code.


## Recommendation

Upgrade to version 9.0.0 or later.
Vulnerability: GHSA-rw4r-h883-8pf9
Summary: Malicious Package in reequest
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:30:02Z

All versions of `reequest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-gfjr-3jmm-4g9v
Summary: Symlink Arbitrary File Overwrite in tar
Aliases: CVE-2015-8860
Severity: HIGH
CWE: CWE-59
Published: 2017-10-24T18:33:36Z

Versions of `tar` prior to 2.0.0 are affected by an arbitrary file write vulnerability. The vulnerability occurs because `tar` does not verify that extracted symbolic links to not resolve to targets outside of the extraction root directory.



## Recommendation

Update to version 2.0.0 or later
Vulnerability: GHSA-899g-6q6w-7v94
Summary: Low severity vulnerability that affects m-server
Aliases: CVE-2018-16485
Severity: LOW
CWE: CWE-22
Published: 2019-02-18T23:58:00Z

Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request.
Vulnerability: GHSA-rw6j-rhw7-q94c
Summary: Directory Traversal in sly07
Aliases: CVE-2017-16189
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:40:34Z

Affected versions of `sly07` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-q69p-5h74-w36f
Summary: Content Injection via TileJSON Name in mapbox.js
Aliases: CVE-2017-1000043
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-09T17:48:34Z

Versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 of `mapbox.js` are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.

If `L.mapbox.map` or `L.mapbox.shareControl` are used in a manner that gives users control of the TileJSON content, it is possible to inject script content into the name value of the TileJSON. After clicking on the share control, the malicious code will execute in the context of the page using Mapbox.js.



## Recommendation

Version 1.x: Update to version 1.6.6 or later.
Version 2.x: Update to version 2.2.4 or later.
Vulnerability: GHSA-jf5r-8hm2-f872
Summary: Incorrect hostname / protocol due to unstripped leading control characters.
Aliases: CVE-2022-0691
Severity: MODERATE
CWE: CWE-639
Published: 2022-02-22T00:00:30Z

Leading control characters in a URL are not stripped when passed into url-parse. This can cause input URLs to be mistakenly be interpreted as a relative URL without a hostname and protocol, while the WHATWG URL parser will trim control characters and treat it as an absolute URL.

If url-parse is used in security decisions involving the hostname / protocol, and the input URL is used in a client which uses the WHATWG URL parser, the decision may be incorrect.

This can also lead to a cross-site scripting (XSS) vulnerability if url-parse is used to check for the javascript: protocol in URLs. See following example:
`````
const parse = require('url-parse')
const express = require('express')
const app = express()
const port = 3000

url = parse(\"\\bjavascript:alert(1)\")

console.log(url)

app.get('/', (req, res) => {
 if (url.protocol !== \"javascript:\") {res.send(\"<a href=\\'\" + url.href + \"\\'>CLICK ME!</a>\")}
 })

app.listen(port, () => {
 console.log(`Example app listening on port ${port}`)
 })
`````
Vulnerability: GHSA-x45v-pvpg-hcrh
Summary: Malicious Package in mysql-koa
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:54:36Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-g3fq-3v3g-mh32
Summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs
Aliases: CVE-2021-29438
Severity: MODERATE
CWE: CWE-79, CWE-80
Published: 2021-04-16T19:52:58Z

### Impact

The Nextcloud dialogs library before 3.1.2 did insufficiently escape text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability.

_Note_: Nextcloud Server employs a strict Content Security Policy that mitigates the risk of these XSS vulnerabilities.

### Patches

The vulnerability has been patched in version 3.1.2. If you need to display HTML in the toast, explicitly pass the `options.isHTML` config flag.

### Workarounds

Make sure no user-supplied input flows into toasts.
Vulnerability: GHSA-9x9j-836w-8f55
Summary: Incorrect Calculation in the MSR JavaScript Cryptography Library
Aliases: CVE-2020-1026
Severity: HIGH
CWE: CWE-682
Published: 2022-01-06T19:44:01Z

A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library's Elliptic Curve Cryptography (ECC) implementation.An attacker could potentially abuse these bugs to learn information about a server's private ECC key (a key leakage attack) or craft an invalid ECDSA signature that nevertheless passes as valid.The security update addresses the vulnerability by fixing the bugs disclosed in the ECC implementation, aka `MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability`.
Vulnerability: GHSA-56r9-v65c-34jm
Summary: Malicious Package in radicjs
Severity: CRITICAL
Published: 2020-09-03T02:33:37Z

Version 0.2.1 of `radicjs` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-8mmf-qp7j-2w24
Summary: Malicious Package in colour-string
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:35:33Z

Version 1.5.3 of `colour-string` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-897m-rjf5-jp39
Summary: Prototype Pollution in copy-props
Aliases: CVE-2020-28503
Severity: HIGH
CWE: CWE-1321
Published: 2022-01-06T20:35:05Z

The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.
Vulnerability: GHSA-9qmh-276g-x5pj
Summary: Prototype Pollution in immer
Aliases: CVE-2020-28477
Severity: HIGH
CWE: CWE-471
Published: 2021-01-20T21:27:56Z

## Overview

Affected versions of immer are vulnerable to Prototype Pollution.

## Proof of exploit

```
const {applyPatches, enablePatches} = require("immer");
enablePatches();
let obj = {};
console.log("Before : " + obj.polluted);
applyPatches({}, [ { op: 'add', path: [ "__proto__", "polluted" ], value: "yes" } ]);
// applyPatches({}, [ { op: 'replace', path: [ "__proto__", "polluted" ], value: "yes" } ]);
console.log("After : " + obj.polluted);
```

## Remediation

Version 8.0.1 contains a [fix](https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5) for this vulnerability, updating is recommended.
Vulnerability: GHSA-35jh-r3h4-6jhm
Summary: Command Injection in lodash
Aliases: CVE-2021-23337
Severity: HIGH
CWE: CWE-77
Published: 2021-05-06T16:05:51Z

`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Vulnerability: GHSA-hc94-2wfr-4pwf
Summary: Downloads Resources over HTTP in appium-chromedriver
Aliases: CVE-2016-10557
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:40:19Z

Affected versions of `appium-chromedriver` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read items send over HTTP at will. In this case, that includes the chromedriver binary, which may result in remote code execution if overwritten with a malicious binary.


## Recommendation

Update to version 2.9.4 or later.
Vulnerability: GHSA-x48m-gp6r-gp4v
Summary: Malicious Package in rate-map
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T18:21:26Z

Version 1.0.3 of `rate-map`  contains malicious code. The malware breaks functionality of the `purescript-installer` package by rewriting code of the `dl-tar` dependency.


## Recommendation

Upgrade to version 1.0.5 or later. There is no indication of further compromise.
Vulnerability: GHSA-wqgq-mfvj-6qxp
Summary: Malicious Package in koa-body-parse
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:49:03Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-vrv8-v4w8-f95h
Summary: Cross-site scripting vulnerability in TinyMCE
Severity: MODERATE
CWE: CWE-79
Published: 2020-08-11T14:55:01Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.

### Patches
This vulnerability has been patched in TinyMCE 4.9.11 and 5.4.1 by improved HTML parsing and sanitization logic.

### Workarounds
The workarounds available are:
- upgrade to either TinyMCE 4.9.11 or TinyMCE 5.4.1
or
- enable the media plugin, which overrides the default parsing behaviour for iframes
or
- add the following workaround to update the parsing schema rules for iframes:

#### Example: Change the default schema for iframes
```js
setup: function(editor) {
  editor.on('PreInit', function() {
    editor.schema.getSpecialElements()['iframe'] = /</iframe[^>]*>/gi;
  });
}
```

### Acknowledgements
Tiny Technologies would like to thank George Steketee and Chris Davis at [Bishop Fox](https://www.bishopfox.com/) for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
Vulnerability: GHSA-5p26-hw7f-3cpr
Summary: Cross-Site Scripting in html-pages
Aliases: CVE-2018-16481
Severity: HIGH
CWE: CWE-79, CWE-64
Published: 2019-02-07T18:14:44Z

All versions of `html-pages` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize folder names, allowing attackers to execute arbitrary JavaScript in the victim's browser through folders with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-h4mc-r4f4-hcf4
Summary: Downloads Resources over HTTP in selenium-binaries
Aliases: CVE-2016-10589
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:34:37Z

Affected versions of `selenium-binaries` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-binaries`.


## Recommendation

No fix is currently available for this vulnerability.

The best mitigation currently available is to use an alternate package, such as [selenium-webdriver](https://www.npmjs.com/package/selenium-webdriver), the official selenium bindings for node.js.
Vulnerability: GHSA-9vxc-g2jx-qj3p
Summary: API Admin Auth Weakness in tomato
Aliases: CVE-2013-7379
Severity: CRITICAL
CWE: CWE-287
Published: 2020-08-31T22:59:07Z

Versions of `tomato` prior to 0.0.6 are affected by a somewhat complex authentication bypass vulnerability in the admin service when only a single access key is configured on the server. The vulnerability allows an attacker to guess the password for the admin service, no matter how complex that password is, in less than 200 requests.


## Details
The tomato API has an admin service that is enabled by setting up an `access_key` in the config options. This `access_key` is intended to protect the API admin from unauthorized access.


Tomato verifies the `access_key` by checking to see if the server `access_key` incorporates the user provided value at any location. This allows an attacker to provide a single character as an `access_key`, and so long as the server key contains at least one instance of that character it will be considered a valid key.

## Proof of Concept
This is the snippet of code that does the comparison to authorize requests.

```
if (access_key && config.master.api.access_key.indexOf(access_key) !== -1) {
```

For an access_key that is set to anything that includes the letter 'a' the following request would be authorized.

```
$ curl -X POST "http://localhost:8081/api/exec" -H "Content-Type: application/json" -d @test -H "access-key: a"
{
 "cmd": "ls",
 "path": ".",
 "stdout": "app.js\nconfig.js\nlog\nnode_modules\nserver.js\n",
 "stderr": ""
}
```



## Recommendation

Update to version 0.0.6 or later.
Vulnerability: GHSA-gmjp-776j-2394
Summary: Malicious Package in ripmed160
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:04:24Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-3f95-r44v-8mrg
Summary: Command injection in simple-git
Aliases: CVE-2022-24433
Severity: HIGH
CWE: CWE-74, CWE-77
Published: 2022-03-12T00:00:33Z

The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it was possible to get arbitrary command execution.
Vulnerability: GHSA-9fp7-4fjm-q3mf
Summary: Prototype Pollution in keyget
Aliases: CVE-2021-23760
Severity: MODERATE
CWE: CWE-1321
Published: 2022-02-01T00:51:01Z

The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-28272](https://security.snyk.io/vuln/SNYK-JS-KEYGET-1048048)