TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-428f-mh7w-6w2x
Summary: Infecting Module in pandora-doomsday
Aliases: CVE-2017-16127
Severity: MODERATE
CWE: CWE-509
Published: 2020-09-01T18:56:40Z

The `pandora-doomsday` package is a malicious package that adds itself to the package.json of other packages discovered on the victim host and attempts to publish the package. 

It has been removed from the npm registry.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-wmx6-vxcf-c3gr
Summary: Validation Bypass in slp-validate
Aliases: CVE-2019-16761
Severity: CRITICAL
CWE: CWE-20
Published: 2019-11-15T23:10:19Z

Versions of `slp-validate` prior to 1.0.1 are vulnerable to a validation bypass. Bitcoin scripts may cause the validation result from `slp-validate` to differ from the specified SLP consensus. This allows an attacker to create a Bitcoin script that causes a hard-fork from the SLP consensus.


## Recommendation

Upgrade to version 1.0.1 or later.
Vulnerability: GHSA-6cj2-92m5-7mvp
Summary: Improperly Controlled Modification of Object Prototype Attributes
Severity: HIGH
CWE: CWE-1321
Published: 2021-08-03T16:48:46Z

### Impact

The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

### Patches

`think-config@1.1.3` patched it, anyone used `think-config` should upgrade to `>=1.1.3` version.

### References

https://cwe.mitre.org/data/definitions/1321.html

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [thinkjs/thinkjs](https://github.com/thinkjs/thinkjs)
* Email us at [i@imnerd.org](mailto:i@imnerd.org)
Vulnerability: GHSA-9pr3-7449-977r
Summary: Cross-Site Scripting in express-cart
Severity: LOW
CWE: CWE-79
Published: 2020-09-02T18:21:26Z

All versions of `harp` are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other pages.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-77jf-fjjf-xcww
Summary: Invalid Curve Attack in openpgp
Aliases: CVE-2019-9155
Severity: MODERATE
CWE: CWE-327
Published: 2019-08-23T21:42:22Z

Versions of `openpgp` prior to 4.3.0 are vulnerable to an Invalid Curve Attack. The package's implementation of ECDH fails to verify the validity of the communication partner's public key. The package calculates the resulting key secret based on an altered curve instead of the specified elliptic curve. Attackers may exfiltrate the victim's private key by choosing the altered curve. An attack requires the attacker being able to initiate message decryption and record the result. Furthermore the victim's key must offer an ECDH public key.


## Recommendation

Upgrade to version 4.3.0 or later.
If you are upgrading from a version <4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0
Vulnerability: GHSA-v8v8-6859-qxm4
Summary: Arbitrary shell command execution in logkitty
Aliases: CVE-2020-8149
Severity: HIGH
CWE: CWE-94
Published: 2020-06-05T14:47:02Z

Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.
Vulnerability: GHSA-jjhg-qw5v-r8xx
Summary: Malicious Package in anarchy
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:01:20Z

All versions of `anarchy` contain malicious code. The package ran `rm - rf /` as an install script.


## Recommendation

Remove the package from your environment.
Vulnerability: GHSA-74cr-77xc-8g6r
Summary: Prototype Pollution in @apollo/gateway
Severity: HIGH
CWE: CWE-400, CWE-1321
Published: 2019-06-13T20:37:39Z

Versions of `@apollo/gateway` prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge() to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.


## Recommendation

Upgrade to version 0.6.2 or later.
Vulnerability: GHSA-wpfc-3w63-g4hm
Summary: Malicious Package in axois
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T21:09:48Z

All versions of `axois` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.
Vulnerability: GHSA-gf7h-vg5v-cch6
Summary: Directory Traversal in ritp
Aliases: CVE-2017-16198
Severity: HIGH
CWE: CWE-22
Published: 2018-08-06T20:03:21Z

Affected versions of `ritp` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-x2mc-8fgj-3wmr
Summary: Improper Input Validation in tar-fs
Aliases: CVE-2018-20835
Severity: HIGH
CWE: CWE-20
Published: 2019-05-01T18:37:18Z

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.
Vulnerability: GHSA-w46j-8hm6-h8mm
Summary: XSS in apexcharts
Aliases: CVE-2021-23327
Severity: MODERATE
CWE: CWE-79
Published: 2021-02-11T20:47:34Z

The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.
Vulnerability: GHSA-hjcp-j389-59ff
Summary: Regular Expression Denial of Service in marked
Aliases: CVE-2015-8854
Severity: HIGH
Published: 2017-10-24T18:33:36Z

Versions 0.3.3 and earlier of `marked` are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the `em` inline rule.



## Recommendation

Update to version 0.3.4 or later.
Vulnerability: GHSA-38fc-wpqx-33j7
Summary: Uncontrolled Resource Consumption in trim-off-newlines
Aliases: CVE-2021-23425
Severity: MODERATE
CWE: CWE-400
Published: 2021-09-02T17:15:42Z

All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.
Vulnerability: GHSA-gqgv-6jq5-jjj9
Summary: Prototype Pollution Protection Bypass in qs
Aliases: CVE-2017-1000048
Severity: HIGH
CWE: CWE-20
Published: 2020-04-30T17:16:47Z

Affected version of `qs` are vulnerable to Prototype Pollution because it is possible to bypass the protection. The `qs.parse` function fails to properly prevent an object's prototype to be altered when parsing arbitrary input. Input containing `[` or `]` may bypass the prototype pollution protection and alter the Object prototype. This allows attackers to override properties that will exist in all objects, which may lead to Denial of Service or Remote Code Execution in specific circumstances.


## Recommendation

Upgrade to 6.0.4, 6.1.2, 6.2.3, 6.3.2 or later.
Vulnerability: GHSA-7wgh-5q4q-6wx5
Summary: Malicious Package in 1337qq-js
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T17:30:39Z

All versions of `1337qq-js` contain malicious code. The package exfiltrates sensitive information through install scripts. It targets UNIX systems. The information exfiltrated includes:
- Environment variables
- Running processes
- /etc/hosts
- uname -a
- npmrc file


## Recommendation

Remove the package from your system and rotate any compromised credentials.
Vulnerability: GHSA-66ww-999q-mffq
Summary: Arbitrary code execution in post-loader
Aliases: CVE-2022-0748
Severity: CRITICAL
CWE: CWE-94
Published: 2022-03-18T00:01:11Z

post-loader is webpack loader for blog posts written in Markdown. The package post-loader from 0.0.0 is vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed. At this time, there is no known workaround or patch available.
Vulnerability: GHSA-hf55-c445-2w97
Summary: Cross-site Scripting in @rocket.chat/livechat
Aliases: CVE-2022-21830
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-03T00:01:00Z

A blind self XSS vulnerability exists in RocketChat LiveChat versions lower than 1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance.
Vulnerability: GHSA-v39p-96qg-c8rf
Summary: Prototype Pollution in object-path
Aliases: CVE-2021-23434
Severity: MODERATE
CWE: CWE-843, CWE-1321
Published: 2021-09-01T18:37:11Z

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.
Vulnerability: GHSA-gg6m-fhqv-hg56
Summary: Denial of Service in yar
Aliases: CVE-2014-4179
Severity: HIGH
CWE: CWE-400
Published: 2020-09-01T15:15:36Z

Versions of `yar` prior to 2.2.0 are affected by a denial of service vulnerability related to an invalid encrypted session cookie value.

When an invalid encryped session cookie value is provided, the process will crash.


## Recommendation

Update to version 2.2.0 or later.
Vulnerability: GHSA-8h8v-6qqm-fwpq
Summary: Path Traversal in express-cart
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T21:06:38Z

Versions of `express-cart` before 1.1.7 are vulnerable to Path Traversal.


## Recommendation

Update to version 1.1.7 or later.
Vulnerability: GHSA-jp46-fw6c-3pm9
Summary: Directory Traversal in scott-blanch-weather-app
Aliases: CVE-2017-16184
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:46:58Z

Affected versions of `scott-blanch-weather-app` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-76wf-2xcf-6wmx
Summary: Malicious Package in ngx-pica
Severity: CRITICAL
Published: 2020-09-03T00:31:28Z

Version 1.1.5 of `ngx-pica` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-rvcw-f68w-8h8h
Summary: Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime
Aliases: CVE-2021-29446
Severity: MODERATE
CWE: CWE-696, CWE-203, CWE-208
Published: 2021-04-19T15:00:05Z

### Impact

[AES_CBC_HMAC_SHA2 Algorithm](https://tools.ietf.org/html/rfc7518#section-5.2) (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).

### Patches

A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`.

Users should upgrade to `^3.11.4`.

### Credits
Thanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
Vulnerability: GHSA-qv2v-m59f-v5fw
Summary: Insecure randomness in socket.io
Aliases: CVE-2017-16031
Severity: HIGH
CWE: CWE-330
Published: 2018-11-07T00:29:37Z

Affected versions of `socket.io` depend on `Math.random()` to create socket IDs, and therefore the IDs are predictable. With enough information on prior IDs, an attacker may be able to guess the socket ID and gain access to socket.io servers without authorization.


## Recommendation

Update to v0.9.7 or later.
Vulnerability: GHSA-pr49-5hhf-6mm6
Summary: Directory Traversal in serverabc
Aliases: CVE-2017-16180
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:44:34Z

Affected versions of `serverabc` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-9mr8-6prp-gwjv
Summary: SQL Injection in query-mysql
Aliases: CVE-2018-3754
Severity: HIGH
CWE: CWE-89
Published: 2018-09-10T15:20:30Z

All versions of `query-mysql` are vulnerable to SQL injection due to lack of user input sanitization allows to run arbitrary SQL queries when fetching data from database.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is passed into this module.
Vulnerability: GHSA-6fvw-7vch-x489
Summary: Downloads Resources over HTTP in selenium-portal
Aliases: CVE-2016-10667
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:44:36Z

Affected versions of `selenium-portal` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-portal`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-73qr-pfmq-6rp8
Summary: Embedded malware in coa
Severity: CRITICAL
CWE: CWE-506
Published: 2021-11-04T16:22:28Z

The npm package `coa` had versions published with malicious code. Users of affected versions (2.0.3 and above) should downgrade to 2.0.2 as soon as possible and check their systems for suspicious activity. See [this issue](https://github.com/veged/coa/issues/99) for details as they unfold.
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-r4r9-mgjc-g6q3
Summary: Path Traversal in 626
Aliases: CVE-2018-3727
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T19:06:15Z

All versions of `626` are vulnerable to path traversal. This enables a remote attacker to read arbitrary files from the remote server using this module.


## Recommendation

No fix is currently available for this vulnerability.
It is our recommendation to not install or use this module at this time.
Vulnerability: GHSA-g9wf-393q-4w38
Summary: Malicious Package in only-test-not-install
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:28:26Z

All versions of `only-test-not-install` contain malicious code. The package deletes the folder `~/test` from the system as a postinstall script.


## Recommendation

Remove the package from your environment. There are no further signs of compromise.
Vulnerability: GHSA-vc9j-fhvv-8vrf
Summary: Remote Code Execution in scratch-vm
Aliases: CVE-2020-14000
Severity: CRITICAL
CWE: CWE-502
Published: 2020-07-27T19:55:52Z

MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code is getExtensionIdForOpcode in serialization/sb3.js. The use of _ is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented. 
NOTE: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.
Vulnerability: GHSA-fj59-f6c3-3vw4
Summary: Command Injection in systeminformation
Aliases: CVE-2020-26300
Severity: MODERATE
CWE: CWE-78
Published: 2020-10-27T20:40:00Z

### Impact
command injection vulnerability

### Patches
Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.26.2

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to `is.services()`, `is.inetChecksite()`, `si.inetLatency()`, `si.networkStats()`, `is.services()` and `si.processLoad()`

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation)
Vulnerability: GHSA-m8fw-534v-xm85
Summary: Cross-Site Scripting (XSS) in cloudcmd
Severity: HIGH
CWE: CWE-79
Published: 2019-06-04T15:43:29Z

Versions of `cloudcmd` before 9.1.6 are vulnerable to cross-site scripting (XSS) when listing files in a directory. The attacker must control the name of a file for this vulnerability to be exploitable.


## Recommendation

Update to version 9.1.6 or later.
Vulnerability: GHSA-mf7c-58q5-7v65
Summary: Downloads Resources over HTTP in npm-test-sqlite3-trunk
Aliases: CVE-2016-10695
Severity: HIGH
CWE: CWE-311
Published: 2020-09-01T16:15:28Z

Affected versions of `npm-test-sqlite3-trunk` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `npm-test-sqlite3-trunk`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-pw54-mh39-w3hc
Summary: Regular expression denial of service in npm-user-validate
Aliases: CVE-2020-7754
Severity: HIGH
CWE: CWE-400
Published: 2021-05-10T19:08:15Z

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
Vulnerability: GHSA-h97g-4mx7-5p2p
Summary: Open Redirect in apostrophe
Severity: MODERATE
CWE: CWE-601
Published: 2020-09-03T17:11:36Z

Versions of `apostrophe` prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing `/` were appended at the end.



## Recommendation

Update to version 2.92.0 or later.
Vulnerability: GHSA-5w4p-h4gm-3w26
Summary: Downloads Resources over HTTP in jser-stat
Aliases: CVE-2016-10592
Severity: MODERATE
CWE: CWE-311
Published: 2019-02-18T23:50:53Z

Affected versions of `jser-stat` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rwv8-jvff-jq28
Summary: Path Traversal in public
Aliases: CVE-2018-3731
Severity: HIGH
CWE: CWE-22
Published: 2018-07-18T21:20:30Z

Versions of `public` before 0.1.3 are vulnerable to path traversal. This is due to lack of file path sanitization which could lead to any file the parent process has access to on the server to be read by malicious user.


## Recommendation

Update to version 0.1.3 or later.
Vulnerability: GHSA-rgq8-25qc-h54q
Summary: Directory Traversal in myserver.alexcthomas18
Aliases: CVE-2017-16144
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:48:05Z

Affected versions of `myserver.alexcthomas18` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-52rh-5rpj-c3w6
Summary: Improper handling of multiline messages in node-irc
Severity: HIGH
Published: 2022-05-05T16:00:50Z

node-irc is a socket wrapper for the IRC protocol that extends Node.js' EventEmitter. The vulnerability allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. Incorrect handling of a CR character allowed for making part of the message be sent to the IRC server verbatim rather than as a message to the channel.
The vulnerability has been patched in node-irc version 1.2.1.
Vulnerability: GHSA-7r5f-7qr4-pf6q
Summary: Sandbox Breakout / Arbitrary Code Execution in notevil
Severity: HIGH
Published: 2020-09-03T19:03:33Z

Versions of `notevil` prior to 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to prevent access to the `Function` constructor by not checking the return values of function calls. This allows attackers to access the Function prototype's constructor leading to the Sandbox Escape. An example payload is:  
```
var safeEval = require('notevil')
var input = "" + 
"function fn() {};" + 
"var constructorProperty = Object.getOwnPropertyDescriptors(fn.__proto__).constructor;" + 
"var properties = Object.values(constructorProperty);" + 
"properties.pop();" + 
"properties.pop();" + 
"properties.pop();" + 
"var Function = properties.pop();" + 
"(Function('return this'))()"; 
safeEval(input)```


## Recommendation

Upgrade to version 1.3.2 or later.
Vulnerability: GHSA-7g2w-6r25-2j7p
Summary: Command Injection in libnmap
Aliases: CVE-2018-16461
Severity: MODERATE
CWE: CWE-77
Published: 2018-11-01T14:51:33Z

Versions of `libnmap` before 0.4.16 are vulnerable to command injection. 

Proof of concept

```
const nmap = require('libnmap');
const opts = {
    range: [
        'scanme.nmap.org',
        "x.x.$(touch success.txt)"
    ]
};
nmap.scan(opts, function(err, report) {
    if (err) throw new Error(err);

    for (let item in report) {
        console.log(JSON.stringify(report[item]));
    }
});
```


## Recommendation

Update to version 0.4.16 or later
Vulnerability: GHSA-j4ch-mw66-xmqv
Summary: Malicious Package in pensi-scheduler
Severity: CRITICAL
Published: 2020-09-03T19:16:44Z

Version 1.1.3 of `pensi-scheduler` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-p493-635q-r6gr
Summary: Remote code execution via the `pretty` option.
Aliases: CVE-2021-21353
Severity: HIGH
CWE: CWE-74
Published: 2021-03-03T02:03:52Z

### Impact

If a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend.

### Patches

Upgrade to `pug@3.0.1` or `pug-code-gen@3.0.2` or `pug-code-gen@2.0.3`, which correctly sanitise the parameter.

### Workarounds

If there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.

### References


Original report: https://github.com/pugjs/pug/issues/3312

### For more information

If you believe you have found other vulnerabilities, please **DO NOT** open an issue. Instead, you can follow the instructions in our [Security Policy](https://github.com/pugjs/pug/blob/master/SECURITY.md)
Vulnerability: GHSA-7jh9-6cpf-h4m7
Summary: XSS in hello.js
Aliases: CVE-2020-7741
Severity: CRITICAL
CWE: CWE-79
Published: 2021-01-13T19:07:01Z

This affects the package hello.js before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).
Vulnerability: GHSA-4j46-mp85-mv8c
Summary: Path traversal in rollup-plugin-serve
Aliases: CVE-2020-7684
Severity: CRITICAL
CWE: CWE-22
Published: 2021-05-18T01:52:24Z

Path traversal in npm package `rollup-plugin-serve` before version 1.0.2. There is no path sanitization in `readFile` operation.
Vulnerability: GHSA-xxvw-45rp-3mj2
Summary: Deserialization Code Execution in js-yaml
Aliases: CVE-2013-4660
Severity: CRITICAL
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

Versions 2.0.4 and earlier of `js-yaml` are affected by a code execution vulnerability in the YAML deserializer.

## Proof of Concept
```
const yaml = require('js-yaml');

const x = `test: !!js/function >
function f() { 
console.log(1); 
}();`

yaml.load(x);
```


## Recommendation

Update js-yaml to version 2.0.5 or later, and ensure that all instances where the `.load()` method is called are updated to use `.safeLoad()` instead.
Vulnerability: GHSA-qc65-cgvr-93p6
Summary: Code injection in kill-process-by-name
Aliases: CVE-2021-23356
Severity: HIGH
CWE: CWE-77
Published: 2021-03-19T21:19:18Z

This affects all versions of package kill-process-by-name. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the index.js file.
Vulnerability: GHSA-7qmm-q394-fmch
Summary: Command Injection in ps-kill
Aliases: CVE-2021-23355
Severity: CRITICAL
CWE: CWE-77
Published: 2021-03-19T21:19:29Z

This affects all versions of package ps-kill. If (attacker-controlled) user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the index.js file. PoC (provided by reporter): var ps_kill = require('ps-kill'); ps_kill.kill('$(touch success)',function(){});
Vulnerability: GHSA-2mp5-m968-gwr2
Summary: Path Traversal in http-file-server
Aliases: CVE-2019-5447
Severity: HIGH
CWE: CWE-22
Published: 2019-07-16T00:41:34Z

All versions of `http-file-server` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-2m96-9w4j-wgv7
Summary: Prototype Pollution in lodash.merge
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-03T18:06:00Z

Versions of `lodash.merge` before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.1 or later.
Vulnerability: GHSA-2fwq-wx47-hm6x
Summary: Malicious Package in bcion
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:31:39Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-wch2-46wj-6x5j
Summary: Malicious Package in bip30
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:37:15Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-3cgg-gh9j-w8vm
Summary: Directory Traversal in iter-http
Aliases: CVE-2017-16094
Severity: HIGH
CWE: CWE-22
Published: 2018-07-24T13:58:10Z

Affected versions of `iter-http` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-hjhr-r3gq-qvp6
Summary: Timing Attack in csrf-lite
Aliases: CVE-2016-10535
Severity: HIGH
CWE: CWE-208
Published: 2019-02-18T23:39:44Z

Affected versions of `csrf-lite` are vulnerable to timing attacks as a result of testing CSRF tokens via a fail-early comparison instead of a constant-time comparison. 

Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback on the correctness of a guess via miniscule timing differences.

Under favorable network conditions, an attacker can exploit this to guess the secret in no more than (16*18)288 guesses, instead of the 16^18 guesses required were the timing attack not present. 


## Recommendation

Update to version 0.1.2 or later.
Vulnerability: GHSA-2j2j-8rrv-264g
Summary: Cross-Site Scripting in exceljs
Aliases: CVE-2018-16459
Severity: MODERATE
CWE: CWE-79
Published: 2018-09-11T18:58:40Z

Versions of `exceljs` before 1.6.0 are vulnerable to cross-site scripting. 

This vulnerability is due to `exceljs` does not  validate data from parsed XLSX file and allows to embed HTML tags, like `<script>`, directly in the sheet cells. Because of this it's possible to inject malicious JavaScript code and execute it when data from the sheet were displayed in the browser.




## Recommendation

Update to version 1.6.0 or later.
Vulnerability: GHSA-3pxp-6963-46r9
Summary: Command Injection in pdfinfojs
Aliases: CVE-2018-3746
Severity: HIGH
CWE: CWE-77
Published: 2018-06-07T19:43:00Z

Versions of `pdfinfojs` before 0.4.1 are vulnerable to command injection. This is exploitable if an attacker can control the filename parameter that is passed into the `pdfinfojs` constructor.


## Recommendation

Update to version 0.4.1 or later.
Vulnerability: GHSA-vrc7-6g8w-jh56
Summary: Improper Input Validation in xdLocalStorage
Aliases: CVE-2015-9544
Severity: HIGH
CWE: CWE-20
Published: 2021-12-09T19:29:36Z

An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
Vulnerability: GHSA-6866-x7cf-rmh5
Summary: Directory Traversal in sencisho
Aliases: CVE-2017-16092
Severity: HIGH
CWE: CWE-22
Published: 2018-07-24T13:50:01Z

Affected versions of `sencisho` are vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-rch9-xh7r-mqgw
Summary: Cross-Site Scripting in simple-server
Aliases: CVE-2018-3717
Severity: HIGH
CWE: CWE-79
Published: 2018-07-26T15:08:05Z

Versions of `simple-server` before 1.1.0 are vulnerable to stored cross-site scripting (XSS). This is exploitable if an attacker can control a filename on the server.


## Recommendation

Update to version 1.1.0 or later.
Vulnerability: GHSA-jfcc-rm7f-xgf8
Summary: Cross-Site Scripting in mavon-editor
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-03T20:36:35Z

All versions of `mavon-editor` are vulnerable to Cross-Site Scripting. The package fails to sanitize entered input, allowing attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-9chw-xrwx-f86j
Summary: Downloads Resources over HTTP in frames-compiler
Aliases: CVE-2016-10649
Severity: HIGH
CWE: CWE-311
Published: 2020-09-01T16:07:53Z

Affected versions of `frames-compiler` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `frames-compiler`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-hj5w-xgw9-w4rj
Summary: Malicious Package in coinstrng
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:41:44Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-7fw7-gh23-f832
Summary: Vulnerability in singleCrunch function leads to arbitrary code execution via filePath parameters
Aliases: CVE-2020-36381
Severity: CRITICAL
CWE: CWE-77, CWE-78
Published: 2021-11-01T19:19:29Z

aaptjs is a node wraper for aapt. An issue was discovered in the singleCrunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
Vulnerability: GHSA-cxcf-78mr-wpg7
Summary: Malicious Package in oauth-validator
Severity: CRITICAL
Published: 2020-09-01T20:29:59Z

Version 1.0.2 of `oauth-validator` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.2 of this module is found installed you will want to replace it with a version before or after 1.0.2. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-hx5x-49mm-vmhw
Summary: SQL Injection in sails-mysql
Severity: HIGH
CWE: CWE-89
Published: 2020-09-03T02:36:43Z

Versions of `sails-mysql` prior to 0.10.8 are vulnerable to SQL Injection. The `sort` keyword is not properly sanitized and may allow attackers to inject SQL statements and execute arbitrary SQL queries


## Recommendation

Upgrade to version 0.10.8 or later.
Vulnerability: GHSA-8j49-49jq-vwcq
Summary: Prototype Pollution in getsetdeep
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-04T15:15:34Z

All versions of `getsetdeep` are vulnerable to prototype pollution. The `setDeep()` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-6f34-pq9f-36vf
Summary: Hijacked Environment Variables in sqlite.js
Aliases: CVE-2017-16050
Severity: MODERATE
CWE: CWE-506
Published: 2018-07-23T20:50:29Z

The `sqlite.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation




As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-3fjq-93xj-3f3f
Summary: Cross-Site Scripting in serialize-to-js
Aliases: CVE-2019-16772
Severity: MODERATE
CWE: CWE-79
Published: 2019-12-06T23:20:26Z

Versions of `serialize-to-js` prior to 3.0.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.


## Recommendation

Upgrade to version 3.0.1 or later.
Vulnerability: GHSA-r863-p739-275c
Summary: Malicious Package in reuest
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-11T21:09:24Z

All versions of `reuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-5w4r-wwc3-6qcp
Summary: Malicious Package in precode.js
Severity: CRITICAL
Published: 2020-09-11T21:23:29Z

Version 1.1.1 of `precode.js` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-wm77-q74p-5763
Summary: Path Traversal in superstatic
Severity: HIGH
CWE: CWE-177
Published: 2018-07-27T17:06:03Z

Affected of `superstatic` are vulnerable to path traversal when used on Windows. 

Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\` to `/` in paths on all platforms (a known example being Node.js v9.9.0).


## Recommendation

Update to version 5.0.2 or later.
Vulnerability: GHSA-753c-phhg-cj29
Summary: Improper Neutralization of Special Elements used in a Command
Aliases: CVE-2021-23352
Severity: HIGH
CWE: CWE-77, CWE-89
Published: 2021-03-12T23:01:49Z

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.
Vulnerability: GHSA-f522-ffg8-j8r6
Summary: Regular Expression Denial of Service in is-my-json-valid
Aliases: CVE-2016-2537
Severity: HIGH
CWE: CWE-20
Published: 2017-10-24T18:33:35Z

Version of `is-my-json-valid` before 1.4.1 or 2.17.2 are vulnerable to regular expression denial of service (ReDoS) via the email validation function.


## Recommendation

Update to version 1.4.1, 2.17.2 or later.
Vulnerability: GHSA-v8w9-2789-6hhr
Summary: Deserialization of Untrusted Data in bson
Aliases: CVE-2020-7610
Severity: HIGH
CWE: CWE-502
Published: 2021-05-07T16:04:54Z

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
Vulnerability: GHSA-qr28-7j6p-9hmv
Summary: Content Injection via TileJSON attribute in mapbox.js
Aliases: CVE-2017-1000042
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-09T17:47:45Z

Versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 of `mapbox.js` are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.

If `L.mapbox.map` or `L.mapbox.tileLayer` are used to load untrusted TileJSON content from a non-Mapbox URL, it is possible for a malicious user with control over the TileJSON content to inject script content into the "attribution" value of the TileJSON which will be executed in the context of the page using Mapbox.js.



## Recommendation

Version 2.x: Update to version 2.1.7 or later.
Version 1.x: Update to version 1.6.5 or later.
Vulnerability: GHSA-q43c-g2g7-6gxj
Summary: Cross-Site Request Forgery (CSRF) in keystone
Aliases: CVE-2017-16570
Severity: HIGH
CWE: CWE-352
Published: 2017-11-30T23:14:47Z

Versions of `keystone` prior to 4.0.0 are vulnerable to Cross-Site Request Forgery (CSRF). The package fails to validate the presence of the `X-CSRF-Token` header, which may allow attackers to carry actions on behalf of other users on all endpoints.


## Recommendation

Update to version 4.0.0 or later.
Vulnerability: GHSA-pch5-whg9-qr2r
Summary: netmask npm package vulnerable to octal input data
Aliases: CVE-2021-29418
Severity: MODERATE
CWE: CWE-20
Published: 2021-03-29T21:32:05Z

The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.
Vulnerability: GHSA-6w83-22gj-5pv9
Summary: Directory Traversal in cyber-js
Aliases: CVE-2017-16093
Severity: HIGH
CWE: CWE-22
Published: 2018-07-27T14:06:00Z

Affected versions of `cyber-js` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-h73q-5wmj-q8pj
Summary: Cross site scripting in datatables.net 
Aliases: CVE-2021-23445
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-29T17:11:28Z

This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
Vulnerability: GHSA-mhp6-pxh8-r675
Summary: Cross site scripting in Angular
Aliases: CVE-2020-7676
Severity: MODERATE
CWE: CWE-79
Published: 2020-06-18T14:19:58Z

angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.