TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-7ww4-c3mj-93cf
Summary: Downloads Resources over HTTP in pm2-kafka
Aliases: CVE-2016-10693
Severity: HIGH
CWE: CWE-311
Published: 2020-09-01T16:16:33Z

Affected versions of `pm2-kafka` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `pm2-kafka`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-9xgh-xgw5-p5cw
Summary: Hijacked Environment Variables in nodemssql
Aliases: CVE-2017-16057
Severity: MODERATE
CWE: CWE-506
Published: 2018-11-09T17:42:54Z

The `nodemssql` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-7fpw-cfc4-3p2c
Summary: High severity vulnerability that affects passport-wsfed-saml2
Aliases: CVE-2017-16897
Severity: HIGH
CWE: CWE-290
Published: 2017-12-28T22:51:45Z

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response).
Vulnerability: GHSA-fr76-2wp8-fp92
Summary: Insecure template handling in Express-handlebars
Aliases: CVE-2021-32820
Severity: HIGH
CWE: CWE-200
Published: 2022-02-10T23:35:21Z

Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .handlebars appended to them. For complete details refer to the referenced GHSL-2021-018 report. Notes in documentation have been added to help users avoid this potential information exposure vulnerability.

A fix is discussed in https://github.com/express-handlebars/express-handlebars/pull/163
Vulnerability: GHSA-h6q6-9hqw-rwfv
Summary: Misinterpretation of malicious XML input
Aliases: CVE-2021-21366
Severity: LOW
CWE: CWE-436, CWE-115
Published: 2021-03-12T22:39:39Z

### Impact

xmldom versions 0.4.0 and older do not correctly preserve [system identifiers](https://www.w3.org/TR/2008/REC-xml-20081126/#d0e4313), [FPIs](https://en.wikipedia.org/wiki/Formal_Public_Identifier) or [namespaces](https://www.w3.org/TR/xml-names11/) when repeatedly parsing and serializing maliciously crafted documents.

This may lead to unexpected syntactic changes during XML processing in some downstream applications.

### Patches

Update to 0.5.0 (once it is released)

### Workarounds

Downstream applications can validate the input and reject the maliciously crafted documents.

### References

Similar to this one reported on the Go standard library:

- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [`xmldom/xmldom`](https://github.com/xmldom/xmldom)
* Email us: send an email to **all** addresses that are shown by `npm owner ls xmldom`
Vulnerability: GHSA-29gp-92wp-94q8
Summary: Remote Code Execution in react-dev-utils
Aliases: CVE-2018-6342
Severity: HIGH
CWE: CWE-78
Published: 2019-01-04T17:41:20Z

`react-dev-utils` on Windows is vulnerable to remote code execution.


## Recommendation

Update to one of the follow versions, depending on the release line that you are using.
- 1.0.4
- 2.0.2
- 3.1.2
- 4.2.2
- 5.0.2
- 6.0.0-next.a671462c
Vulnerability: GHSA-m9r7-q9fc-qwx5
Summary: Malicious Package in maybemaliciouspackage
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:22:24Z

All versions of `maybemaliciouspackage` contain malicious code. The package prints the system's SSH keys to the console as a postinstall script.


## Recommendation

Remove the package from your environment. There are no further signs of compromise.
Vulnerability: GHSA-hqv3-qq72-78cv
Summary: Directory Traversal in startserver
Aliases: CVE-2021-23430
Severity: HIGH
CWE: CWE-22
Published: 2021-09-02T17:09:40Z

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.
Vulnerability: GHSA-jxqq-cqm6-pfq9
Summary: Regular Expression Denial of Service in slug
Aliases: CVE-2017-16117
Severity: MODERATE
CWE: CWE-400
Published: 2018-07-24T20:06:45Z

Affected versions of `slug` are vulnerable to a regular expression denial of service when parsing untrusted user input.

The issue is low severity, as it takes 50,000 characters to cause the event loop to block for 2 seconds,

About 50k characters can block the event loop for 2 seconds.


## Recommendation

Update to version 0.9.2 or later.
Vulnerability: GHSA-g87g-4x3w-f8jp
Summary: Directory Traversal in serverwzl
Aliases: CVE-2017-16105
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T16:51:28Z

Affected versions of `serverwzl` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-qxrj-x7rm-2h49
Summary: Malicious Package in dhkey
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:05:59Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-pq37-4c4g-v38c
Summary: Cross-site Scripting in vditor
Aliases: CVE-2022-0341
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-15T00:01:02Z

vditor prior to version 3.8.11 is vulnerable to cross-site scripting.
Vulnerability: GHSA-4j54-mmmv-hjpm
Summary: Malicious Package in slush-fullstack-framework
Severity: CRITICAL
Published: 2020-09-03T19:17:51Z

Version 0.9.2 of `slush-fullstack-framework` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-qf8x-vqjv-92gr
Summary: Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter 
Aliases: CVE-2022-24901
Severity: HIGH
CWE: CWE-287, CWE-295
Published: 2022-05-04T18:59:46Z

Weak validation of the Apple certificate URL in the Apple Game Center authentication adapter allows to bypass authentication and makes the server vulnerable to DoS attacks. The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.
Vulnerability: GHSA-pv6r-vchh-cxg9
Summary: Denial of Service in apostrophe
Severity: LOW
CWE: CWE-400
Published: 2020-09-03T20:42:09Z

Versions of `apostrophe` prior to 2.97.1 are vulnerable to Denial of Service. The `apostrophe-jobs` module sets a callback for incoming jobs and doesn't clear it regardless of its status. This causes the server to accumulate callbacks, allowing an attacker to start a large number of jobs and exhaust system memory.


## Recommendation

Upgrade to version 2.97.1 or later.
Vulnerability: GHSA-238x-q7xf-p4xw
Summary: Downloads Resources over HTTP in arrayfire-js
Aliases: CVE-2016-10598
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:50:32Z

Affected versions of `arrayfire-js` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `arrayfire-js`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-m8xj-5v73-3hh8
Summary: curlrequest allows execution of arbitrary commands
Aliases: CVE-2020-7646
Severity: CRITICAL
CWE: CWE-78
Published: 2020-05-13T16:29:43Z

curlrequest through 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands by using a semicolon char in any of the `options` values.
Vulnerability: GHSA-gm9g-2g8v-fvxj
Summary: Prototype Pollution in upmerge
Severity: MODERATE
CWE: CWE-345, CWE-400
Published: 2019-06-06T15:32:28Z

All versions of `upmerge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-9cw2-jqp5-7x39
Summary: Multiple Content Injection Vulnerabilities in marked
Aliases: CVE-2014-3743
Severity: MODERATE
CWE: CWE-79
Published: 2020-08-31T22:52:52Z

Versions 0.3.0 and earlier of `marked` are affected by two cross-site scripting vulnerabilities, even when `sanitize: true` is set.

The attack vectors for this vulnerability are GFM Codeblocks and JavaScript URLs.


## Recommendation

Upgrade to version 0.3.1 or later.
Vulnerability: GHSA-27v7-qhfv-rqq8
Summary: Insecure Credential Storage in web3
Severity: LOW
Published: 2019-05-30T17:26:30Z

All versions of `web3` are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this vulnerability likely requires a Cross-Site Scripting vulnerability to access the private key.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-pxcc-hj8w-fmm7
Summary: Command injection vulnerability in @prisma/sdk in getPackedPackage function
Aliases: CVE-2021-21414
Severity: HIGH
CWE: CWE-78
Published: 2021-04-06T17:25:12Z

### Impact

As of today, we are not aware of any Prisma users or external consumers of the `@prisma/sdk` package who are affected by this security vulnerability.

This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

It only affects the `getPackedPackage` function and this function is not advertised and only used for tests & building our CLI, no malicious code was found after checking our codebase.

### Patches

Fixed in 
- @prisma/sdk@2.20.0 (latest channel)
- @prisma/sdk@2.20.0-dev.29 (dev channel)

Pull Request closing this vulnerability [https://github.com/prisma/prisma/pull/6245](https://github.com/prisma/prisma/pull/6245)

### Acknowledgements

This issue was discovered and reported by GitHub Engineer [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh).

### For more information

If you have any questions or comments about this advisory:

- Create a discussion in [the Prisma repository](https://github.com/prisma/prisma/discussions)
- Email us at security@prisma.io
Vulnerability: GHSA-73v8-v6g4-vrpm
Summary: Arbitrary File Overwrite in decompress-zip
Severity: HIGH
Published: 2020-09-02T15:58:13Z

Vulnerable versions of `decompress-zip` are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because `decompress-zip` does not verify that extracted files do not resolve to targets outside of the extraction root directory.



## Recommendation

For `decompress-zip` 0.2.x upgrade to 0.2.2 or later.
For `decompress-zip` 0.3.x upgrade to 0.3.2 or later.
Vulnerability: GHSA-79jw-6wg7-r9g4
Summary: Use of Potentially Dangerous Function in mixme
Aliases: CVE-2021-29491
Severity: HIGH
CWE: CWE-913
Published: 2021-05-06T15:45:39Z

### Impact

In Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).

### Patches
The problem is corrected starting with version 0.5.1.

### References
Issue: https://github.com/adaltas/node-mixme/issues/1
Commit: https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028
Vulnerability: GHSA-r773-pmw3-f4mr
Summary: Open Redirect in koa-remove-trailing-slashes
Aliases: CVE-2021-23384
Severity: MODERATE
CWE: CWE-601
Published: 2022-02-10T23:47:27Z

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::removeTrailingSlashes(), as the web server uses relative URLs instead of absolute URLs.
Vulnerability: GHSA-fm7r-2pr7-rw2p
Summary: Malicious Package in yeoman-genrator
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:45:02Z

Version 3.1.1 of `yeoman-genrator` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-p6h4-93qp-jhcm
Summary: Command injection in Parse Server through prototype pollution
Aliases: CVE-2022-24760
Severity: CRITICAL
CWE: CWE-74, CWE-1321
Published: 2022-03-11T23:53:23Z

### Impact
This is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows.

### Patches
Upgrade to Parse Server >=4.10.7. If you are using a prerelease version of Parse Server 5.0 (alpha, beta) we will publish a timely fix for these. However, as a general reminder we do not consider prerelease versions to be suitable for production deployment.

Note that as part of the fix a new security feature scans for sensitive keywords in request data to prevent JavaScript prototype pollution. If such a keyword is found, the request is rejected with HTTP response code `400` and Parse Error `105` (`INVALID_KEY_NAME`). By default these keywords are: `{_bsontype: "Code"}`, `constructor`, `__proto__`. If you are using any of these keywords in your request data, you can override the default keywords by setting the new Parse Server option `requestKeywordDenylist` to `[]` and specify your own keywords as needed.

### Workarounds
Although the fix is more broad and includes several aspects of the vulnerability, a quick and targeted fix can be achieved by patching the MongoDB Node.js driver and disable BSON code execution. To apply the patch, add the following code to be executed before starting Parse Server, for example in `index.js`.

```
const BSON = require('bson');
 const internalDeserialize = BSON.prototype.deserialize;
 BSON.prototype.deserialize = (buffer, options = Object.create(null), ...others) => {
   if (options.constructor) {
     options = Object.assign(Object.create(null), options);
   }
   return internalDeserialize(buffer, options, ...others);
 };
 const internalDeserializeStream = BSON.prototype.deserializeStream;
 BSON.prototype.deserializeStream = (
   data,
   startIndex,
   numberOfDocuments,
   documents,
   docStartIndex,
   options = Object.create(null),
   ...others
 ) => {
   if (options.constructor) {
     options = Object.assign(Object.create(null), options);
   }
   return internalDeserializeStream(
     data,
     startIndex,
     numberOfDocuments,
     documents,
     docStartIndex,
     options,
     ...others
   );
 };
```

### References
- Original report on [huntr.dev](https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099/)
Vulnerability: GHSA-hpfq-8wx8-cgqw
Summary: Cross-Site Scripting in ids-enterprise
Severity: HIGH
CWE: CWE-79
Published: 2019-06-13T18:59:18Z

Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `modal` component fails to sanitize input to the `title` attribute, which may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 4.18.2 or later
Vulnerability: GHSA-fw2f-7f87-5r6c
Summary: Improper Input Validation in access-policy
Aliases: CVE-2020-7674
Severity: CRITICAL
CWE: CWE-94
Published: 2021-05-17T21:00:29Z

access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the `template` function is executed by the `eval` function resulting in code execution.
Vulnerability: GHSA-vfrc-7r7c-w9mx
Summary: Prototype Pollution in highlight.js
Aliases: CVE-2020-26237
Severity: LOW
CWE: CWE-471
Published: 2020-11-24T22:58:41Z

### Impact

Affected versions of this package are vulnerable to Prototype Pollution.  A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting.  If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. 

The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. 

_If your website or application does not render user provided data it should be unaffected._

### Patches

Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability.  If you are using version 7 or 8 you are encouraged to upgrade to a newer release.

### Workarounds

#### Patch your library

Manually patch your library to create null objects for both `languages` and `aliases`:

```js
const HLJS = function(hljs) {
  // ...
  var languages = Object.create(null);
  var aliases = Object.create(null);
```

#### Filter out bad data from end users

Filter the language names that users are allowed to inject into your HTML to guarantee they are valid.

### References

* [What is Prototype Pollution?](https://codeburst.io/what-is-prototype-pollution-49482fc4b638)
* https://github.com/highlightjs/highlight.js/pull/2636

### For more information

If you have any questions or comments about this advisory:

* Please file an issue against [highlight.js](https://github.com/highlightjs/highlight.js/issues/)
Vulnerability: GHSA-rh46-3fgc-mvrf
Summary: Validation bypass is possible in Json Pattern Validator
Aliases: CVE-2019-19507
Severity: MODERATE
CWE: CWE-287
Published: 2019-12-04T21:25:28Z

In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Vulnerability: GHSA-hfwx-c7q6-g54c
Summary: Vulnerability allowing for reading internal HTTP resources
Severity: HIGH
CWE: CWE-552
Published: 2021-03-12T23:04:46Z

### Impact

The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read access to internal web-resources.

The impact is limited to internal services that serve content via. HTTP(S), and requires the attacker to know internal hostnames/IP addresses.

The previous versions have been marked as deprecated on NPM.

### Patches

Version 2.1.0 released alongside this security advisory addresses the issue. **Please note that this release is not backwards compatible out of the box. See the [changelog](https://github.com/highcharts/node-export-server/blob/master/CHANGELOG.md) for details.**

Additionally, it's also recommended to upgrade to the latest version of Highcharts to get the added input sanitation implemented in version 9.0 and later. 

### Workarounds

There are no known workarounds to the issue - an upgrade to version 2.1.0 is required.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the export server issue tracker](https://github.com/highcharts/node-export-server/issues)
* Email us at [security@highsoft.com](mailto:security@highsoft.com)
Vulnerability: GHSA-w992-2gmj-9xxj
Summary: Cross-Site Scripting in swagger-ui
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-11T21:23:29Z

Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package allows HTML code in the `swagger.apiInfo.description` value without proper sanitization, which may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 2.2.1 or later.
Vulnerability: GHSA-c82c-8pjw-6829
Summary: Malicious Package in @impala/bmap
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T19:41:45Z

Version 1.0.3 of `@impala/bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 1.0.3 of this module is found installed you will want to replace it with a version before or after 1.0.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-896r-f27r-55mw
Summary: json-schema is vulnerable to Prototype Pollution
Aliases: CVE-2021-3918
Severity: MODERATE
CWE: CWE-915, CWE-1321
Published: 2021-11-19T20:16:17Z

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerability: GHSA-w8f3-pvx4-4c3h
Summary: Prototype Pollution in arr-flatten-unflatten
Aliases: CVE-2020-7713
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-06T18:11:39Z

All versions of package arr-flatten-unflatten up to and including version 1.1.4 are vulnerable to Prototype Pollution via the constructor.
Vulnerability: GHSA-j383-35pm-c5h4
Summary: Path Traversal in Grunt
Aliases: CVE-2022-0436
Severity: MODERATE
CWE: CWE-22
Published: 2022-04-13T00:00:16Z

Grunt prior to version 1.5.2 is vulnerable to path traversal.
Vulnerability: GHSA-5ff8-jcf9-fw62
Summary: Cross-Site Scripting in markdown-it-katex
Severity: HIGH
CWE: CWE-79
Published: 2020-09-04T17:55:35Z

All versions of `markdown-it-katex` are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser by triggering an error.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-gjc9-932x-c59p
Summary: Malicious Package in leaflet-gpx
Severity: CRITICAL
Published: 2020-09-03T00:34:33Z

Version 1.0.1 of `leaflet-gpx` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-cmh5-qc8w-xvcq
Summary: Cross-Site Scripting in i18next
Aliases: CVE-2017-16010
Severity: MODERATE
CWE: CWE-79
Published: 2018-07-24T19:58:33Z

Affected versions of `i18next` may fail to sanitize user input when certain configuration options are used. When using the `.init` method, passing interpolation options without passing an `escapeValue` will default to `undefined` rather than the assumed `true`. 

## Proof of Concept

```
var init = i18n.init({
  interpolation: {
    prefix: "__",
    suffix: "__",
    escapeValue: true
  }
}, function(){
  var test = i18n.t('__firstName__ __lastName__', {
        firstName: 'Bob',
        lastName: '["foo","bar"]',
  });
  console.log(test);
});
```
When `escapeValue` is explicitly passed, the result of `test` is: 

```
&lt;script&gt;alert(1)&lt;&#x2F;script&gt; Johnson
```

This is supposed to be the default. However, if `escapeValue` is not included, the result is the unescaped string: 
 
```
<script>alert(1)</script> Johnson
```


## Recommendation

Update to version 3.4.4 or later.
Vulnerability: GHSA-pc58-wgmc-hfjr
Summary: Prototype Pollution in mout
Aliases: CVE-2020-7792
Severity: HIGH
CWE: CWE-1321
Published: 2022-02-09T22:49:10Z

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects into the target object, recursively mixing existing child objects as well'. In both cases, the key used to access the target object recursively is not checked, leading to a Prototype Pollution.
Vulnerability: GHSA-gp2f-254m-rh32
Summary: Unauthorized access to data in @sap-cloud-sdk/core
Aliases: CVE-2021-41251
Severity: MODERATE
CWE: CWE-200
Published: 2021-11-10T16:51:41Z

### Impact
This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations.
In some cases, when user information was missing, destinations were cached without user information, allowing other users to retrieve the same destination with its permissions.
By default, destination caching is disabled. If it is enabled the maximum lifetime is 5 minutes which limits the attack vector.

### Patches
The problem was fixed by #1769 and #1770. The security for caching has been increased. The changes are released in version 1.52.0.

### Workarounds
Disable destination caching (it is disabled by default).

### References
[destination cache API docs](https://sap.github.io/cloud-sdk/api/1.51.0/modules/sap_cloud_sdk_core#destinationCache)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/SAP/cloud-sdk-js
Vulnerability: GHSA-rqff-837h-mm52
Summary: Authorization bypass in url-parse
Aliases: CVE-2022-0512
Severity: MODERATE
CWE: CWE-639
Published: 2022-02-15T00:02:46Z

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
Vulnerability: GHSA-h6pr-c536-6rjg
Summary: Prototype Pollution in object-path-set
Aliases: CVE-2021-23507
Severity: HIGH
CWE: CWE-1321
Published: 2022-02-05T00:00:31Z

The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908
Vulnerability: GHSA-7p6h-3fmw-539q
Summary: Downloads Resources over HTTP in selenium-chromedriver
Aliases: CVE-2016-10624
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:27Z

Affected versions of `selenium-chromedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-chromedriver`.


## Recommendation

No patch is currently available for this vulnerability, and the author has marked the package as deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised yo
Vulnerability: GHSA-8q2c-2396-hf7j
Summary: Malicious Package in appx-compiler
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:34:55Z

All versions of `appx-compiler` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-f294-27fc-wgj7
Summary: Malicious Package in buffer-zor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:16:31Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-vcph-57hv-89c4
Summary: Downloads Resources over HTTP in serc.js
Aliases: CVE-2016-10678
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:42:11Z

Affected versions of `serc.js` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `serc.js`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rhwp-9vm9-547q
Summary: Command Injection in onion-oled-js
Aliases: CVE-2021-23377
Severity: CRITICAL
CWE: CWE-77
Published: 2021-05-07T16:06:16Z

This affects all versions up to and including version 0.0.2 of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-vpq5-4rc8-c222
Summary: Denial of Service in canvas
Severity: MODERATE
Published: 2019-06-05T14:10:45Z

Versions of `canvas` prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process.


## Recommendation

Upgrade to version 1.6.10
Vulnerability: GHSA-4q97-fh3f-j294
Summary: Prototype Pollution in tiny-conf
Aliases: CVE-2020-7724
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-10T15:59:24Z

All versions of package tiny-conf up to and including version 1.1.0 are vulnerable to Prototype Pollution via the set function.
Vulnerability: GHSA-84qj-9qf2-q92r
Summary: Malicious Package in pm-controls
Severity: CRITICAL
Published: 2020-09-03T00:32:30Z

Version 1.1.8 of `pm-controls` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-g785-775g-f2g8
Summary: Downloads Resources over HTTP in haxe
Aliases: CVE-2016-10602
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2019-02-18T23:50:21Z

Affected versions of `haxe` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `haxe`.


## Recommendation

Update to version 5.0.10 or later.
Vulnerability: GHSA-8vj3-jgcf-77jv
Summary: Malicious Package in requeest
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:26:49Z

All versions of `requeest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-3c6g-pvg8-gqw2
Summary: Command injection in json
Aliases: CVE-2020-7712
Severity: HIGH
CWE: CWE-78
Published: 2021-05-06T18:11:21Z

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
Vulnerability: GHSA-533p-g2hq-qr26
Summary: Command Injection in treekill
Severity: HIGH
CWE: CWE-77
Published: 2020-09-04T17:16:35Z

All versions of `treekill` are vulnerable to Command Injection. The package fails to sanitize values passed to the  `kill` function. If this value is user-controlled it  may allow attackers to run arbitrary commands in the server. The issue only affects Windows systems.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-45hw-29x7-9x95
Summary: Arbitrary File Read in Snyk Broker
Aliases: CVE-2020-7651
Severity: MODERATE
CWE: CWE-22
Published: 2020-06-03T22:02:11Z

All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API.
Vulnerability: GHSA-p33m-7w7f-gmj8
Summary: Uncontrolled Resource Consumption in fun-map
Aliases: CVE-2020-7644
Severity: HIGH
CWE: CWE-915
Published: 2021-12-10T20:05:07Z

fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
Vulnerability: GHSA-6fw4-hr69-g3rv
Summary: Prototype Pollution in property-expr
Aliases: CVE-2020-7707
Severity: CRITICAL
CWE: CWE-915
Published: 2021-05-06T17:29:47Z

The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.
Vulnerability: GHSA-xgf5-5gjr-4hjq
Summary: Directory Traversal in zjjserver
Aliases: CVE-2017-16201
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:15:20Z

Affected versions of `zjjserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-xrmp-99wj-p6jc
Summary: Prototype Pollution in deap
Severity: HIGH
CWE: CWE-400
Published: 2019-05-31T23:43:09Z

Versions of `deap` before 1.0.1 are vulnerable to prototype pollution.


## Recommendation

Update to version 1.0.1 or later.
Vulnerability: GHSA-97mp-9g5c-6c93
Summary: Malicious Package in bs58chcek
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:50:48Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-48ww-j4fc-435p
Summary: Command injection in nodemailer
Aliases: CVE-2020-7769
Severity: CRITICAL
CWE: CWE-88
Published: 2021-05-10T19:16:52Z

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
Vulnerability: GHSA-g36h-6r4f-3mqp
Summary: Regular Expression Denial of Service in string
Aliases: CVE-2017-16116
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T20:16:11Z

Affected versions of `string` are vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the `underscore` or `unescapeHTML` methods.


## Recommendation

There is currently no direct patch for this vulnerability. 

Currently, the best solution is to avoid passing user input to the `underscore` and `unescapeHTML` methods.

Alternatively, a user provided patch is available in [Pull Request #217]( https://github.com/jprichardson/string.js/pull/217/commits/eab9511e4efbc8c521e18b6cf2e8565ae50c5a16), however this patch has not been tested, nor has it been merged by the package author.
Vulnerability: GHSA-44vf-8ffm-v2qh
Summary: Sensitive Data Exposure in rails-session-decoder
Severity: HIGH
Published: 2020-09-02T15:42:47Z

All versions of `rails-session-decoder` are missing verification of the Message Authentication Code appended to the cookies. This may lead to decryption of cipher text thus exposing encrypted information.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-jr3j-whm4-9wwm
Summary: Reflected XSS when using flashMessages or languageDictionary
Aliases: CVE-2021-32641
Severity: HIGH
CWE: CWE-79
Published: 2021-06-04T19:10:34Z

### Overview

Versions before and including `11.30.0` are vulnerable to reflected XSS.  An attacker can execute arbitrary code when the library's
- `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage`.
- `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`.

### Am I affected?
You are affected by this vulnerability if you are using `auth0-lock` version `11.30.0` or lower and all of the following conditions apply:

- You are utilizing `flashMessage` feature.
- User input or data from URL parameters is incorporated into the `flashMessage`.

An example of a vulnerable snippet where query parameters are used to populate the `text` property of a `flashMessage`.
```js
var params = new URLSearchParams(location.search);
var errorMessage = params.get('error__message');
var showParams = {};

if (!!errorMessage === true) {
  showParams.flashMessage = {
    type: 'error',
    text: 'We were unable to log you in. ' + errorMessage,
  };
}

lock.show(showParams);
```

OR

- You are utilizing `languageDictionary` feature.
- User input or data from URL parameters is used in `languageDictionary` properties.

An example of a vulnerable snippet where query parameters are used to populate the `socialLoginInstructions` property of a `languageDictionary`.
```js
var params = new URLSearchParams(location.search);
var instruction = params.get('instruction');

var options = {
  languageDictionary: {
    emailInputPlaceholder: "something@youremail.com",
    title: "title",
    socialLoginInstructions: instruction
  },
};

var lock = new Auth0LockPasswordless(
    CLIENT_ID,
    DOMAIN,
    options
);

lock.show()
```

### How to fix that?
Upgrade to version `11.30.1`.

### Will this update impact my users?
The fix uses [DOMPurify](https://github.com/cure53/DOMPurify) to sanitise the `flashMessage` and `languageDictionary` inputs. If you are including inline JavaScript in these fields, like `script` tags or `onclick` attributes, these will be removed.
Vulnerability: GHSA-g8vp-6hv4-m67c
Summary: Command Injection in entitlements
Severity: HIGH
CWE: CWE-77
Published: 2020-09-11T21:23:29Z

Versions of `entitlements` prior to 1.3.0 are vulnerable to Command Injection. The package does not validate input on the `entitlements` function  and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.


## Recommendation

Upgrade to version 1.3.0 or later.
Vulnerability: GHSA-vrw4-w73r-6mm8
Summary: TimelockController vulnerability in OpenZeppelin Contracts
Aliases: CVE-2021-39168
Severity: CRITICAL
CWE: CWE-269
Published: 2021-08-30T16:12:49Z

### Impact

A vulnerability in `TimelockController` allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to "open" allow anyone to use the executor role, thus leaving the timelock at risk of being taken over by an attacker.

### Patches

A fix is included in the following releases of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`:
- 4.3.1
- 3.4.2
- 3.4.2-solc-0.7

Deployed instances of `TimelockController` should be replaced with a fixed version by migrating all assets, ownership, and roles.

### Workarounds

Revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.

### References

[Post-mortem](https://forum.openzeppelin.com/t/timelockcontroller-vulnerability-postmortem/14958).

### Credits

The issue was identified by an anonymous white hat hacker through [Immunefi](https://immunefi.com/).

### For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
Vulnerability: GHSA-hpr5-wp7c-hh5q
Summary: Cross-Site Scripting in mrk.js
Severity: HIGH
CWE: CWE-79
Published: 2020-09-01T19:37:29Z

Versions of `mrk.js` before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML.


## Recommendation

Update to version 2.0.1 or later and use `mark.sanitizeURL()` for any `src` and `href` attributes when extending the markdown.
Vulnerability: GHSA-f39r-cpmj-whcg
Summary: Command Injection in ffmpegdotjs
Aliases: CVE-2021-23376
Severity: CRITICAL
CWE: CWE-77
Published: 2021-05-06T15:55:21Z

This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-3w5v-p54c-f74x
Summary: ejs is ivulnerable to remote code execution due to weak input validation
Aliases: CVE-2017-1000228
Severity: CRITICAL
CWE: CWE-20
Published: 2017-11-30T23:15:19Z

nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
Vulnerability: GHSA-28xr-mwxg-3qc8
Summary: Command injection in simple-git
Aliases: CVE-2022-24066
Severity: HIGH
CWE: CWE-74, CWE-77
Published: 2022-04-02T00:00:13Z

`simple-git` (maintained as [git-js](https://github.com/steveukx/git-js) named repository on GitHub) is a light weight interface for running git commands in any node.js application.The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover. A fix was released in simple-git@3.6.0.
Vulnerability: GHSA-63m4-fhf2-cmf7
Summary: Command Execution in windows-cpu
Aliases: CVE-2017-1000219
Severity: CRITICAL
CWE: CWE-78
Published: 2020-09-01T16:43:55Z

Version of `windows-cpu` before 0.1.5 will execute arbitrary code passed into the first argument of the `findLoad` method, resulting in remote code execution.

## Proof of Concept

```
var win = require('windows-cpu');
wind.findLoad('foo & calc.exe');
```


## Recommendation

Update to version 0.1.5 or later.