TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-pgf8-28gg-vpr6
Summary: Path traversal
Aliases: CVE-2021-32662
Severity: MODERATE
CWE: CWE-22
Published: 2021-06-04T19:09:20Z

### Impact

A malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for `docs_dir` in `mkdocs.yml`. These files would then be available over the TechDocs backend API.

This vulnerability is mitigated by the fact that an attacker would need access to modify the `mkdocs.yml` in the documentation source code, and would also need access to the TechDocs backend API.

### Patches

The vulnerability is patched in the `0.6.3` release of `@backstage/techdocs-common`.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-j665-rvj7-2jv9
Summary: Code Injection in mosc
Aliases: CVE-2020-7672
Severity: HIGH
CWE: CWE-94
Published: 2021-05-17T21:00:17Z

mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in code execution.
Vulnerability: GHSA-q42c-rrp3-r3xm
Summary: Malicious Package in commmander
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-11T21:13:44Z

All versions of `commmander` contain malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.
Vulnerability: GHSA-rj38-87f3-93p6
Summary: Downloads Resources over HTTP in limbus-buildgen
Aliases: CVE-2016-10674
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:42:27Z

Affected versions of `limbus-buildgen` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `limbus-buildgen`.


## Recommendation

Update to version 0.1.1 or later.
Vulnerability: GHSA-46hv-7769-j7rx
Summary: Unauthorized File Access in harp
Aliases: CVE-2019-5437
Severity: MODERATE
CWE: CWE-548
Published: 2019-06-13T16:12:22Z

Affected versions of `harp` are vulnerable to Unauthorized File Access. The package states that it ignores files and directories with names that start with an underscore, such as `_secret-folder`. If the underscore character is URL encoded the server delivers the file.

## Recommendation

Upgrade to version `0.40.2` or later.
Vulnerability: GHSA-6343-m2qr-66gf
Summary: Malicious Package in js-sja3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:10:41Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-w457-6q6x-cgp9
Summary: Prototype Pollution in handlebars
Aliases: CVE-2019-19919
Severity: CRITICAL
CWE: CWE-74
Published: 2019-12-26T17:58:13Z

Versions of `handlebars` prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' `__proto__` and `__defineGetter__` properties, which may allow an attacker to execute arbitrary code through crafted payloads.


## Recommendation

Upgrade to version 3.0.8, 4.3.0 or later.
Vulnerability: GHSA-g37j-v5gh-g25c
Summary: Malicious Package in js-shi3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:06:48Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-49c6-3wr4-8jr4
Summary: Malicious Package in malicious-npm-package
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:05:26Z

All versions of `malicious-npm-package` contain malicious code. The malware targets Windows systems. It runs a powershell command that downloads an executable file from a remote server and runs it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hxxf-q3w9-4xgw
Summary: Malicious Package in eslint-scope
Severity: CRITICAL
CWE: CWE-506
Published: 2018-07-12T19:52:02Z

Version 3.7.2 of `eslint-scope` was published without authorization and was found to contain malicious code. This code would read the users `.npmrc` file and send any found authentication tokens to 2 remote servers.


## Recommendation

The best course of action if you found this package installed in your environment is to revoke all your npm tokens. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens
Vulnerability: GHSA-8g4m-cjm2-96wq
Summary: Sandbox escape in notevil and argencoders-notevil
Aliases: CVE-2021-23771
Severity: MODERATE
CWE: CWE-1321
Published: 2022-03-18T00:01:11Z

This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. **Note:** This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878). This package has been deprecated.
Vulnerability: GHSA-6jmr-jfh7-xg3h
Summary: False-positive validity for NFT1 genesis transactions
Aliases: CVE-2020-15131
Severity: CRITICAL
CWE: CWE-697
Published: 2020-07-30T14:58:53Z

### Impact
In the npm package named "slp-validate", versions prior to 1.2.2 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification.

### Patches
npm package "slp-validate" has been patched and is published and tagged as version 1.2.2.

### Workarounds
Upgrade to slp-validate 1.2.2.

### References
* Package location: https://www.npmjs.com/package/slp-validate
* SLP NFT1 spec: https://slp.dev/specs/slp-nft-1/#nft1-protocol-requirements
* Git commit hash fixing this issue: https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65c
* Unit tests have been added to assist validator implementations in avoiding this bug: https://github.com/simpleledger/slp-unit-test-data/commit/8c942eacfae12686dcf1f3366321445a4fba73e7

### For more information
If you have any questions or comments about this advisory please open an issue in the [slp-validate](https://github.com/simpleledger/slp-validate.js/issues) repository.
Vulnerability: GHSA-j59f-6m4q-62h6
Summary: Improper Key Verification in ipns
Severity: HIGH
CWE: CWE-287
Published: 2019-05-30T17:28:48Z

Versions 0.1.1 or 0.1.2 of `ipns` are vulnerable to improper key validation. This is due to the public key verification was not being performed properly, resulting in any key being valid.


## Recommendation

Update to version 0.1.3 or later.
Vulnerability: GHSA-x6fg-f45m-jf5q
Summary: Regular Expression Denial of Service in semver
Aliases: CVE-2015-8855
Severity: HIGH
Published: 2017-10-24T18:33:36Z

Versions 4.3.1 and earlier of `semver` are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.



## Recommendation

Update to version 4.3.2 or later
Vulnerability: GHSA-p33q-w45h-2hcj
Summary: Malicious Package in 4equest
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T18:30:03Z

All versions of `4equest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-55r9-7mf8-m382
Summary: Cross-site Scripting in edge.js
Aliases: CVE-2021-23443
Severity: MODERATE
CWE: CWE-79, CWE-843
Published: 2021-09-22T20:36:46Z

Edge is a logical and batteries included template engine for Node.js. This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used.
Vulnerability: GHSA-pfr3-87q3-65rc
Summary: Cross-site Scripting in vmd
Aliases: CVE-2021-33041
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-10T23:46:28Z

vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS.
Vulnerability: GHSA-vp77-fqqp-79j8
Summary: Prototype Pollution in decal
Aliases: CVE-2020-28449
Severity: HIGH
CWE: CWE-400, CWE-1321
Published: 2021-04-13T15:20:27Z

This affects all versions of package decal. The vulnerability is in the set function.
Vulnerability: GHSA-mgv2-57vj-99xc
Summary: Low severity vulnerability that affects eye.js
Severity: LOW
Published: 2019-10-07T16:54:24Z

## Test breaking

### Impact
In v1.2.0, tests are broken: all tests are always succeeding. If tests are looking for security vulnerabilities, these were compromised.

### Patches
Users should upgrade to `v1.2.1`

### Workarounds
Users who don't use eye.js for looking for vulnerabilities are safe. Upgrading will just fix some bugs.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [EyeJS](https://github.com/arguiot/EyeJS)
* Email us at [arguiot@gmail.com](mailto:arguiot@gmail.com)
Vulnerability: GHSA-2wpq-vvw6-67wr
Summary: Hijacked Environment Variables in nodecaffe
Aliases: CVE-2017-16070
Severity: CRITICAL
CWE: CWE-506, CWE-433
Published: 2018-08-29T23:38:35Z

The `nodecaffe` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-p7w2-mc6m-mfx2
Summary: Malicious Package in scroool
Severity: CRITICAL
Published: 2020-09-11T21:22:25Z

Version 0.1.7 of `scroool` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-f2c5-997w-7f5c
Summary: Cross-site Scripting in peertube
Aliases: CVE-2021-3780
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-20T20:42:41Z

peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It was found that one could upload a SVG image and then send the url of that to other users and when they open the link we can get their complete session keys as the session keys stored in local storage and with Javascript easily can be stolen by attackers.
Vulnerability: GHSA-qjf4-7642-c57p
Summary: Downloads Resources over HTTP in unicode
Aliases: CVE-2016-10578
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:51:52Z

Affected versions of `unicode` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Update to version 9.0.0 or later.
Vulnerability: GHSA-488m-6gh8-9j36
Summary: Moderate severity vulnerability that affects bracket-template
Aliases: CVE-2018-3735
Severity: MODERATE
CWE: CWE-79
Published: 2018-07-27T17:05:06Z

bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template
Vulnerability: GHSA-mx3x-ghqm-r43h
Summary: Prototype pollution vulnerability in 'predefine'
Aliases: CVE-2020-28280
Severity: CRITICAL
Published: 2021-10-12T16:27:18Z

Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-p82g-2xpp-m5r3
Summary: Cross-Site Scripting in dojo
Aliases: CVE-2015-5654
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-11T21:18:05Z

Versions of `dojo` prior to 1.2.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize HTML code in user-controlled input, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 1.2.0 or later.
Vulnerability: GHSA-4gp3-p7ph-x2jr
Summary: OS Command Injection in devcert-sanscache
Aliases: CVE-2019-10778
Severity: CRITICAL
CWE: CWE-78
Published: 2020-04-14T23:09:00Z

devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `commonName` controlled by user input is used as part of the `exec` function without any sanitization.
Vulnerability: GHSA-3mpr-hq3p-49h9
Summary: Prototype Pollution in mixin-deep
Aliases: CVE-2018-3719
Severity: LOW
CWE: CWE-471
Published: 2018-07-26T15:10:54Z

Versions of `mixin-deep` before 1.3.1 are vulnerable to prototype pollution via merging functions.


## Recommendation

Update to version 1.3.1 or later.
Vulnerability: GHSA-ww4j-c2rq-47q8
Summary: Command injection in ts-process-promises
Aliases: CVE-2020-7784
Severity: CRITICAL
CWE: CWE-77
Published: 2021-01-13T18:22:28Z

This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js.
Vulnerability: GHSA-7vq3-wcjw-3fxh
Summary: Directory Traversal in lab6.brit95
Aliases: CVE-2017-16140
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:48:53Z

Affected versions of `lab6.brit95` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-83rx-c8cr-6j8q
Summary: Insecure Default Configuration in tesseract.js
Severity: MODERATE
CWE: CWE-829
Published: 2019-06-05T20:48:55Z

Versions of `tesseract.js` prior to 1.0.19 default to using a third-party proxy.  Requests may be proxied through `crossorigin.me` which clearly states is not suitable for production use. This may lead to instability and privacy violations.


## Recommendation

Upgrade to version 1.0.19 or later.
Vulnerability: GHSA-rjqq-98f6-6j3r
Summary: Improper Input Validation in sanitize-html
Aliases: CVE-2021-26539
Severity: MODERATE
CWE: CWE-20
Published: 2021-05-06T16:10:05Z

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
Vulnerability: GHSA-g2c4-4m64-vxm3
Summary: Malicious Package in buffer-yor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:15:25Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-c27r-x354-4m68
Summary: HMAC-SHA1 signatures can bypass validation via key confusion
Severity: HIGH
CWE: CWE-287
Published: 2020-10-27T20:39:46Z

### Impact
An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation.

### Patches
Version 2.0.0 has the fix.

### Workarounds
The recommendation is to upgrade. In case that is not possible remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from SignedXml.SignatureAlgorithms.
Vulnerability: GHSA-qmxf-fxq7-w59f
Summary: Malicious Package in angular-material-sidenav-rnd
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T19:43:53Z

Version 0.1.1 of `angular-material-sidenav-rnd` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 0.1.1 of this module is found installed you will want to replace it with a version before or after 0.1.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-h3cq-j957-vhxg
Summary: Cross-site Scripting in fullpage.js
Aliases: CVE-2022-1330
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-13T00:00:16Z

using fullpage.js you can create a anchor tag . But when put href in anchor then it does not sanitize the url which allow for a break in the context of anchor element and can add our new element.
Vulnerability: GHSA-724c-6vrf-99rq
Summary: Sensitive Data Exposure in loopback
Severity: LOW
CWE: CWE-200
Published: 2020-09-02T21:49:48Z

Versions of `loopback` prior to 3.26.0 (3.x) and 2.42.0 (2.x) are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for credential theft.


## Recommendation

If you're using `loopback` 3.x upgrade to version 3.26.0 or later.
If you're using `loopback` 2.x upgrade to version 2.42.0 or later.
Vulnerability: GHSA-x6ch-c6rv-f7wh
Summary: Malicious Package in asymc
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T18:34:22Z

All versions of `asymc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-4pf7-579w-f4gm
Summary: Downloads Resources over HTTP in dwebp-bin
Aliases: CVE-2016-10633
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2019-02-18T23:57:04Z

Affected versions of `dwebp-bin` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dwebp-bin`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-wpvm-wqr4-p7cw
Summary: Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4
Aliases: CVE-2021-26272
Severity: MODERATE
CWE: CWE-829
Published: 2021-10-13T15:34:09Z

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
Vulnerability: GHSA-93q8-gq69-wqmw
Summary:  Inefficient Regular Expression Complexity in chalk/ansi-regex
Aliases: CVE-2021-3807
Severity: HIGH
CWE: CWE-1333
Published: 2021-09-20T20:20:09Z

ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-r6rj-9ch6-g264
Summary: Prototype pollution in Merge-deep
Aliases: CVE-2021-26707
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-06-07T22:09:26Z

The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
Vulnerability: GHSA-c4qp-h3m6-785f
Summary: Downloads Resources over HTTP in ibm_db
Aliases: CVE-2016-10577
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:51:59Z

Affected versions of `ibm_db` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Update to version 1.0.2 or later.
Vulnerability: GHSA-5wqj-f379-6jh4
Summary: Command injection in kill-process-on-port
Aliases: CVE-2020-28426
Severity: HIGH
CWE: CWE-77
Published: 2021-03-19T21:19:47Z

All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.
Vulnerability: GHSA-8f93-rv4p-x4jw
Summary: SQL Injection in sql
Severity: MODERATE
CWE: CWE-89
Published: 2019-06-12T16:36:52Z

All versions of `sql` are vulnerable to sql injection as it does not properly escape parameters when building SQL queries.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.
Vulnerability: GHSA-m7j4-fhg6-xf5v
Summary: Prototype pollution in datatables.net
Aliases: CVE-2020-28458
Severity: HIGH
CWE: CWE-1321
Published: 2020-12-17T21:00:50Z

All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
Vulnerability: GHSA-785g-gx74-gr39
Summary: Malicious Package in js-wha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:12:48Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-6c9x-mj3g-h47x
Summary: Spoofing attack in swagger-ui-dist
Aliases: CVE-2021-46708
Severity: MODERATE
CWE: CWE-1021
Published: 2022-03-12T00:00:36Z

The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
Vulnerability: GHSA-rrrm-qjm4-v8hf
Summary: Inefficient Regular Expression Complexity in marked
Aliases: CVE-2022-21680
Severity: HIGH
CWE: CWE-1333
Published: 2022-01-14T21:04:41Z

### Impact

_What kind of vulnerability is it?_

Denial of service.

The regular expression `block.def` may cause catastrophic backtracking against some strings.
PoC is the following.

```javascript
import * as marked from "marked";

marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
```

_Who is impacted?_

Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.

### Patches

_Has the problem been patched?_

Yes

_What versions should users upgrade to?_

4.0.10

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Do not run untrusted markdown through marked or run marked on a [worker](https://marked.js.org/using_advanced#workers) thread and set a reasonable time limit to prevent draining resources.

### References

_Are there any links users can visit to find out more?_

- https://marked.js.org/using_advanced#workers
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [marked](https://github.com/markedjs/marked)
Vulnerability: GHSA-x6hx-7gh3-3q98
Summary: Prototype Pollution in mootools
Aliases: CVE-2021-23432
Severity: MODERATE
CWE: CWE-1321
Published: 2021-09-02T17:09:30Z

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()
Vulnerability: GHSA-52r9-g5g6-2hjp
Summary: Path Traversal in node-srv
Aliases: CVE-2018-3714
Severity: HIGH
CWE: CWE-22
Published: 2018-07-26T14:50:41Z

Versions of `node-srv` before 2.1.1 are vulnerable to path traversal allowing a remote attacker to read files from the server that uses `node-srv`.


## Recommendation

Update to version 2.1.1 or later.
Vulnerability: GHSA-x9hc-rw35-f44h
Summary: Sandbox Breakout / Arbitrary Code Execution in static-eval
Severity: HIGH
CWE: CWE-94
Published: 2020-09-02T15:46:03Z

Versions of `static-eval`prior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.

## Proof of concept
```
var evaluate = require('static-eval');
var parse = require('esprima').parse;

var src = process.argv[2];
var payload = '(function({x}){return x.constructor})({x:"".sub})("console.log(process.env)")()'
var ast = parse(payload).body[0].expression;
console.log(evaluate(ast, {x:1}));
```


## Recommendation

Upgrade to version 2.0.2 or later.
Vulnerability: GHSA-q2c6-c6pm-g3gh
Summary: Arbitrary Code Execution in handlebars
Severity: HIGH
Published: 2020-09-04T15:07:38Z

Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).


## Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.
Vulnerability: GHSA-xc7v-wxcw-j472
Summary: Memory Exposure in tunnel-agent
Severity: MODERATE
CWE: CWE-200
Published: 2019-06-03T17:08:26Z

Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Proof-of-concept:
```js
require('request')({
  method: 'GET',
  uri: 'http://www.example.com',
  tunnel: true,
  proxy:{
    protocol: 'http:',
    host:'127.0.0.1',
    port:8080,
    auth:USERSUPPLIEDINPUT // number
  }
});
```


## Recommendation

Update to version 0.6.0 or later.
Vulnerability: GHSA-rfhr-62xp-2fp2
Summary: Open Redirect in trailing-slash
Aliases: CVE-2021-23387
Severity: MODERATE
CWE: CWE-601
Published: 2021-06-08T23:19:21Z

The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::createTrailing(), as the web server uses relative URLs instead of absolute URLs.
Vulnerability: GHSA-f7jg-mcvw-9gwv
Summary: Directory Traversal in reecerver
Aliases: CVE-2017-16188
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:40:40Z

Affected versions of `reecerver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-mm7h-323r-9p4g
Summary: Downloads Resources over HTTP in imageoptim
Aliases: CVE-2016-10596
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:50:33Z

imageoptim is a Node.js wrapper for some images compression algorithms.

imageoptim downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks.  It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.


## Recommendation

No fix is currently available for this vulnerability.

It is our recommendation to not install or use this module at this time.
Vulnerability: GHSA-4qwq-q4pr-rr7r
Summary: Vulnerability in packageCmd function leads to arbitrary code execution via filePath parameters
Aliases: CVE-2020-36378
Severity: CRITICAL
CWE: CWE-77, CWE-78
Published: 2021-11-02T15:42:38Z

aaptjs is a node wraper for aapt. An issue was discovered in the packageCmd function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
Vulnerability: GHSA-jg8v-48h5-wgxg
Summary: Prototype Pollution
Aliases: CVE-2021-23413
Severity: MODERATE
CWE: CWE-1321
Published: 2021-08-10T16:02:18Z

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.
Vulnerability: GHSA-r5xw-q988-826m
Summary: Remote Memory Exposure in mongoose
Severity: MODERATE
CWE: CWE-201
Published: 2020-09-01T19:39:37Z

Versions of `mongoose` before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.

Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.


## Recommendation

Update to version 4.3.6, 3.8.39 or later.
Vulnerability: GHSA-xj3h-vc9j-j823
Summary: Directory Traversal in nodeaaaaa
Aliases: CVE-2017-16223
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:39:32Z

Affected versions of `nodeaaaaa` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-cfm4-qjh2-4765
Summary: Improper Verification of Cryptographic Signature in node-forge
Aliases: CVE-2022-24771
Severity: HIGH
CWE: CWE-347
Published: 2022-03-18T23:09:54Z

### Impact

RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used.

### Patches

The issue has been addressed in `node-forge` `1.3.0`.

### References

For more information, please see
["Bleichenbacher's RSA signature forgery based on implementation error"](https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE/)
by Hal Finney.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge)
* Email us at [example email address](mailto:security@digitalbazaar.com)
Vulnerability: GHSA-jpcq-cgw6-v4j6
Summary: Potential XSS vulnerability in jQuery
Aliases: CVE-2020-11023
Severity: MODERATE
CWE: CWE-79
Published: 2020-04-29T22:19:14Z

### Impact
Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches
This problem is patched in jQuery 3.5.0.

### Workarounds
To workaround this issue without upgrading, use [DOMPurify](https://github.com/cure53/DOMPurify) with its `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a jQuery method.

### References
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.
Vulnerability: GHSA-x6m6-5hrf-fh6r
Summary: Denial of Service in markdown-it-toc-and-anchor
Severity: HIGH
CWE: CWE-400
Published: 2020-09-01T21:26:50Z

All versions of `markdown-it-toc-and-anchor` are vulnerable to Denial of Service. Parsing markdown containing `**text**+\n@[toc]` causes the application to enter and infinite loop.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-qqgx-2p2h-9c37
Summary: Prototype Pollution
Aliases: CVE-2020-7788
Severity: HIGH
CWE: CWE-1321
Published: 2020-12-10T16:53:45Z

### Overview
The `ini` npm package before version 1.3.6 has a Prototype Pollution vulnerability.

If an attacker submits a malicious INI file to an application that parses it with `ini.parse`, they will pollute the prototype on the application. This can be exploited further depending on the context.

### Patches

This has been patched in 1.3.6

### Steps to reproduce

payload.ini
```
[__proto__]
polluted = "polluted"
```

poc.js:
```
var fs = require('fs')
var ini = require('ini')

var parsed = ini.parse(fs.readFileSync('./payload.ini', 'utf-8'))
console.log(parsed)
console.log(parsed.__proto__)
console.log(polluted)
```

```
> node poc.js
{}
{ polluted: 'polluted' }
{ polluted: 'polluted' }
polluted
```
Vulnerability: GHSA-9xww-fwh9-95c5
Summary: Malicious Package in uglyfi-js
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:43:59Z

Version 3.4.6 of `uglyfi-js` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-5854-jvxx-2cg9
Summary: Denial of Service in subtext
Severity: HIGH
Published: 2020-09-03T15:46:57Z

Versions of `subtext` >=4.1.0 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

This package is deprecated and is now maintained as `@hapi/subtext`. Please update your dependencies to use `@hapi/subtext`.
Vulnerability: GHSA-79p8-4cwq-rhqh
Summary: Directory Traversal in jn_jj_server
Aliases: CVE-2017-16210
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:40:07Z

Affected versions of `jn_jj_server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-ff5x-w9wg-h275
Summary: Holder can generate proof of ownership for credentials it does not control in vp-toolkit
Severity: HIGH
Published: 2020-03-06T01:15:46Z

### Impact
The [`verifyVerifiablePresentation()`](https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-presentation-signer.ts#L97) method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the [`credentialSubject.id`](https://github.com/rabobank-blockchain/vp-toolkit-models/blob/develop/src/model/verifiable-credential.ts#L150) DID matches the signer of the VP proof.

The **verifier** is impacted by this vulnerability.

### Patches
Patch will be available in version 0.2.2.

### Workarounds
- Compute the address out of the `verifiablePresentation.proof.n.verificationMethod` using `getAddressFromPubKey()` from `crypt-util@0.1.5` and match it with the `credentialSubject.id` address from the credential.

### References
[Github issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/14)

### For more information
If you have any questions or comments about this advisory:
* Discuss in the existing [issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/14)
* [Contact me](https://github.com/rabomarnix)
Vulnerability: GHSA-f9cv-665r-275h
Summary: Prototype Pollution in merge-change
Aliases: CVE-2021-23421
Severity: CRITICAL
CWE: CWE-915
Published: 2021-09-01T18:36:01Z

All current versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.
Vulnerability: GHSA-gvff-25cc-4f66
Summary: Path Traversal in restify-swagger-jsdoc
Severity: HIGH
CWE: CWE-22
Published: 2020-09-03T17:15:56Z

Versions of `restify-swagger-jsdoc` prior to 3.2.1 are vulnerable to Path Traversal.  The package fails to properly sanitize URLs, which may allow attackers to access server files outside the `swagger-ui` folder by using relative paths.  



## Recommendation

Upgrade to version 3.2.1 or later.
Vulnerability: GHSA-gm8g-xhh8-rmwr
Summary: Prototype Pollution in doc-path
Aliases: CVE-2020-7772
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-10T19:17:25Z

This affects the package doc-path before 2.1.2.
Vulnerability: GHSA-h9jc-284h-533g
Summary: Context isolation bypass via contextBridge in Electron
Aliases: CVE-2020-4077
Severity: HIGH
CWE: CWE-501
Published: 2020-07-07T00:01:10Z

### Impact
Apps using both `contextIsolation` and `contextBridge` are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

### Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.

### Fixed Versions
* `9.0.0-beta.21`
* `8.2.4`
* `7.2.4`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)
Vulnerability: GHSA-qfxv-qqvg-24pg
Summary: OS Command Injection in im-metadata
Aliases: CVE-2019-10788
Severity: HIGH
CWE: CWE-78
Published: 2021-04-13T15:17:36Z

im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the "exec" function.
Vulnerability: GHSA-2p99-6f47-8x9j
Summary: Malicious Package in asnc
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T18:38:39Z

All versions of `asnc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-wq7q-7vfh-2x3h
Summary: Downloads Resources over HTTP in install-nw
Aliases: CVE-2016-10566
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:54:09Z

Affected versions of `install-nw` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `install-nw`.


## Recommendation

Update to version 1.1.5 or later.
Vulnerability: GHSA-wpg7-2c88-r8xv
Summary: Exposure of Sensitive Information in simple-get
Aliases: CVE-2022-0355
Severity: HIGH
CWE: CWE-200
Published: 2022-01-28T22:54:16Z

In versions of simple-get prior to 4.0.1, 3.1.1, and 2.8.2, when fetching a remote url with a cookie location response, headers will be followed, potentially resulting in an exposure of the session cookie to a third party.
Vulnerability: GHSA-39qv-prmh-x37f
Summary: Prototype Pollution in @strikeentco/set
Aliases: CVE-2021-23497
Severity: HIGH
CWE: CWE-1321
Published: 2022-02-05T00:00:26Z

This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821
Vulnerability: GHSA-wwrj-35w6-77ff
Summary: CSRF vulnerability in save-server
Aliases: CVE-2020-15135
Severity: MODERATE
CWE: CWE-352
Published: 2020-08-04T14:54:08Z

### Impact
Versions prior to version v1.05 are affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version v1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version.

This is patched by implementing [Double submit](https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f).

The CSRF attack would require you to navigate to a malicious site while you have an active session with Save-Server (Session key stored in cookies). The malicious user would then be able to perform some actions, including:
- Upload file
- Delete file
- Add redirect


#### If you are logged in as root, this attack is significantly more severe. They can (in addition to the above):
- Create users
- Delete users
- Update users (change password)

If they updated the password of a user, that user's files would then be available. If the root password is updated, all files would be visible if they logged in with the new password.

Note that due to the same origin policy malicious actors cannot view the gallery or the response of any of the methods, nor be sure they succeeded. 
### Patches
This issue has been patched. Update to version v1.0.7 or above to benefit from this fix.

### Workarounds
None. You should upgrade.

### References
What is CSRF: https://owasp.org/www-community/attacks/csrf
Fix type: https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Save-server](https://github.com/Neztore/save-server/)
* Email us at [hi@nezto.re](mailto:hi@nezto.re)
* Join our discord (preferred): [Invite](https://discord.gg/QevWabU)
Vulnerability: GHSA-qr32-j4j6-3m7r
Summary: Command Injection in fs-git
Aliases: CVE-2017-16087
Severity: HIGH
CWE: CWE-77
Published: 2019-05-29T20:23:00Z

Affected versions of `fs-git` do not sanitize strings passed into the `buildCommand` method, resulting in arbitrary code execution.


## Recommendation

Update to version 1.0.2 or later.
Vulnerability: GHSA-pvv8-8fx9-h673
Summary: Path Traversal in @backstage/plugin-scaffolder-backend 
Aliases: CVE-2021-41151
Severity: MODERATE
CWE: CWE-22
Published: 2021-10-19T15:28:03Z

### Impact

A malicious actor could read sensitive files from the environment where Scaffolder tasks are run. The attack is executed by crafting a custom Scaffolder template with a `publish:github:pull-request` action using a particular source path. When the template is executed the sensitive files would be included in the published pull request.

This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request.

### Patches

The vulnerability is patched in the `0.15.9` release of `@backstage/plugin-scaffolder-backend`.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-353r-3v84-9pjj
Summary: Malicious Package in nothing-js
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T20:40:36Z

`nothing-js` contained a malicious script that attempted to delete all files when `npm test` was run.


## Recommendation

This module has been unpublished from the npm Registry. If you find this module in your environment remove it.
Vulnerability: GHSA-wfw3-rgfr-6g67
Summary: XSS via Angular Expression in ag-grid
Aliases: CVE-2017-16009
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-01T16:40:42Z

Affected versions of `ag-grid` are vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if used in combination with AngularJS.


## Recommendation

Avoid using `ag-grid` in combination with AngularJS until a fix is available.
Vulnerability: GHSA-8mgg-5x65-m4m4
Summary: Command Injection in soletta-dev-app
Severity: HIGH
CWE: CWE-77
Published: 2020-09-11T21:08:19Z

All versions of `soletta-dev-app` are vulnerable to Command Injection. The package does not validate user input on the `/api/service/status` API endpoint, passing contents of the `service` query parameter to an exec call. This may allow attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.