aswin1906/github-advisory-2018.csv huggingface dataset:
Cross-Site Scripting in nunjucks (CVE-2016-10547)
Published: 2018-11-06T23:13:37Z

Affected versions of `nunjucks` do not properly escape specially structured user input in template vars when in auto-escape mode, resulting in a cross-site scripting vulnerability.

## Proof of Concept

By using an array for the keys in a template var, escaping is bypassed.
```javascript
name[]=<script>alert(1)</script>
```

A full PoC is available in the references section.


## Recommendation

Update to version 2.4.3 or later.
tkinter is malware (CVE-2017-16061)
Published: 2018-11-01T14:47:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The `tkinter` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
High severity vulnerability that affects org.apache.syncope:syncope-core (CVE-2018-1321)
Published: 2018-11-06T23:17:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
Improper Certificate Validation in proton-j (CVE-2018-17187)
Published: 2018-11-21T22:22:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with options to configure this explicitly or select a certificate verification mode with or without hostname verification being performed. The latter hostname verifying mode was not implemented in Apache Qpid Proton-J versions 0.3 to 0.29.0, with attempts to use it resulting in an exception. This left only the option to verify the certificate is trusted, leaving such a client vulnerable to Man In The Middle (MITM) attack. Uses of the Proton-J protocol engine which do not utilise the optional transport TLS wrapper are not impacted, e.g. usage within Qpid JMS. Uses of Proton-J utilising the optional transport TLS wrapper layer that wish to enable hostname verification must be upgraded to version 0.30.0 or later and utilise the VerifyMode#VERIFY_PEER_NAME configuration, which is now the default for client mode usage unless configured otherwise.
Cross-site Scripting in yapi-vendor (CVE-2018-17574)
Published: 2018-11-21T22:19:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
HTML Injection in shout (CVE-2017-16043)
Published: 2018-11-07T00:28:11Z

Affected versions of `shout` do not escape the `/topic` command in messages, and are therefore vulnerable to cross-site scripting.


## Recommendation

Update to version 0.50.0 or later.
Command Injection in libnmap (CVE-2018-16461)
Published: 2018-11-01T14:51:33Z

Versions of `libnmap` before 0.4.16 are vulnerable to command injection. 

Proof of concept

```js
const nmap = require('libnmap');
const opts = {
    range: [
        'scanme.nmap.org',
        "x.x.$(touch success.txt)"
    ]
};
nmap.scan(opts, function(err, report) {
    if (err) throw new Error(err);

    for (let item in report) {
        console.log(JSON.stringify(report[item]));
    }
});
```


## Recommendation

Update to version 0.4.16 or later
Path Traversal in knightjs (CVE-2018-16475)
Published: 2018-11-06T23:11:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

All versions of `knightjs` are vulnerable to Path Traversal. 

This vulnerability allows an attacker to read content of arbitrary files on the server due to lack of input validation.


## Recommendation

As there is currently no fix for this module we recommend not using this module in production environments.
Path Traversal in takeapeek (CVE-2018-16473)
Published: 2018-11-06T23:12:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

All versions of `takeapeek` are vulnerable to path traversal exposing files and directories.


## Recommendation

As no fix is currently available for this vulnerability is it is our recommendation to use another static file server.
Cross-Site Request Forgery (CSRF) in Auth0 (CVE-2018-6874)
Published: 2018-11-06T23:15:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
Jupyter Notebook XSS via directory name (CVE-2018-19352)
Published: 2018-11-21T22:19:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.
High severity vulnerability that affects python-gnupg (CVE-2013-7323)
Published: 2018-11-06T23:14:22Z

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
High severity vulnerability that affects python-gnupg (CVE-2014-1927)
Published: 2018-11-06T23:14:39Z

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
sqlserver is malware (CVE-2017-16055)
Published: 2018-11-09T17:49:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The `sqlserver` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Moderate severity vulnerability that affects python-gnupg (CVE-2014-1928)
Published: 2018-11-06T23:13:02Z

The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Rack vulnerable to Denial of Service (CVE-2018-16470)
Published: 2018-11-15T15:58:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.
Ckeditor XSS Vulnerability (CVE-2018-17960)
Published: 2018-11-21T22:19:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. It was possible to execute XSS inside the CKEditor source area after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode. Although this is an unlikely scenario, it is recommended to upgrade to the latest editor version.
Forgeable Public/Private Tokens in jwt-simple (CVE-2016-10555)
Published: 2018-11-06T23:12:07Z

Affected versions of the `jwt-simple` package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT, the end result is a complete authentication bypass with minimal effort.



## Recommendation

Update to version 0.3.1 or later.

Additionally, be sure to always specify an algorithm in calls to `.decode()`.
Unrestricted Upload of File with Dangerous Type in mingsoft:ms-mcms (CVE-2018-18830)
Published: 2018-11-01T14:48:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercept the data packet. In the name parameter, change the suffix to jsp. In the response, the server returns the storage path of the file, which can be accessed to execute arbitrary JSP code.
Denial of Service in ethereumjs-vm (CVE-2018-19183)
Published: 2018-11-21T22:22:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ethereumjs-vm 2.4.0 allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a "code: Buffer.from(my_code, 'hex')" attribute.
High severity vulnerability that affects org.apache.syncope:syncope-core (CVE-2018-17186)
Published: 2018-11-06T23:15:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.
Moderate severity vulnerability that affects org.apache.hive:hive-jdbc (CVE-2018-1314)
Published: 2018-11-21T22:24:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics.
Header Forgery in http-signature (CVE-2017-16005)
Published: 2018-11-09T17:49:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected versions of `http-signature` contain a vulnerability which can allow an attacker in a privileged network position to modify header names and change the meaning of the request, without requiring an updated signature. 

This problem occurs because vulnerable versions of `http-signature` sign the contents of headers, but not the header names.

## Proof of Concept

Consider this to be the initial, untampered request:
```http
POST /pay HTTP/1.1
Host: example.com
Date: Thu, 05 Jan 2012 21:31:40 GMT
X-Payment-Source: src@money.com
X-Payment-Destination: dst@money.com
Authorization: Signature keyId="Test",algorithm="rsa-sha256",headers="x-payment-source x-payment-destination" MDyO5tSvin5...
```

And the request is intercepted and tampered as follows:
```http
X-Payment-Source: dst@money.com // Emails switched
X-Payment-Destination: src@money.com
Authorization: Signature keyId="Test",algorithm="rsa-sha256",headers="x-payment-destination x-payment-source" MDyO5tSvin5...
```

In the resulting responses, both requests would pass signature verification without issue.
```
src@money.com\n
dst@money.com\n
```



## Recommendation

Update to version 0.10.0 or higher.
Tmp files readable by other users in sync-exec (CVE-2017-16024)
Published: 2018-11-09T17:45:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected versions of `sync-exec` use files located in `/tmp/` to buffer command results before returning values. As `/tmp/` is almost always set with world readable permissions, this may allow low privilege users on the system to read the results of commands run via `sync-exec` under a higher privilege user.


## Recommendation

There is currently no direct patch for `sync-exec`, as the `child_process.execSync` function provided in Node.js v0.12.0 and later provides the same functionality natively. 

The best mitigation currently is to update to Node.js v0.12.0 or later, and migrate all uses of `sync-exec` to `child_process.execSync()`.
Exposure of Sensitive Information to an Unauthorized Actor in Apache hive (CVE-2018-1284)
Published: 2018-11-21T22:24:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_float/xpath_long/xpath_int/xpath_short) to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user (usually hive) if hive.server2.enable.doAs=false.
Session Fixation in Tryton (CVE-2018-19443)
Published: 2018-11-29T21:30:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.
nodemssql is malware (CVE-2017-16057)
Published: 2018-11-09T17:42:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The `nodemssql` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Pandao editor.md vulnerable to DOM XSS (CVE-2018-19056)
Published: 2018-11-09T17:41:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

pandao Editor.md 1.5.0 has DOM XSS via input starting with a `<<` substring, which is mishandled during construction of an `A` element.
Loofah Cross-site Scripting vulnerability (CVE-2018-16468)
Published: 2018-11-01T14:46:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In the Loofah gem for Ruby, through version 2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Users are advised to upgrade to version 2.2.3.

See https://github.com/flavorjones/loofah/issues/154 for more details.
python-gnupg vulnerable to shell injection (CVE-2014-1929)
Published: 2018-11-06T23:12:48Z

python-gnupg 0.3.5 and 0.3.6 allow for shell injection via a failure to escape backslashes in the `shell_quote()` function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
SQL Injection in hive-jdbc (CVE-2018-1282)
Published: 2018-11-21T22:24:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation.
SimpleMDE XSS Vulnerability (CVE-2018-19057)
Published: 2018-11-21T22:21:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with `[` and `(` characters, which is mishandled during construction of an `A` element.
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Pivotal CredHub Service Broker (CVE-2018-15795)
Published: 2018-11-29T21:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub Service.
Remote Code Execution in spark-core (CVE-2018-17190)
Published: 2018-11-21T22:19:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.

# Mitigation
Enable authentication on any Spark standalone cluster that is not otherwise secured from unwanted access, for example by network-level restrictions. Use spark.authenticate and related security properties described at https://spark.apache.org/docs/latest/security.html
Directory Traversal in hostr (CVE-2017-16029)
Published: 2018-11-09T17:44:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions of `hostr` are vulnerable to directory traversal which allows attackers to read files outside the current directory by sending `../` in the url path for GET requests.


## Recommendation

Upgrade to version 2.3.6 or later.
Critical severity vulnerability that affects org.apache.directory.api:apache-ldap-api (CVE-2018-1337)
Published: 2018-11-09T17:49:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Apache LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
High severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 (CVE-2017-12612)
Published: 2018-11-09T17:43:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.1.2, 2.2.0 or later.
Stored Cross-Site Scripting in tianma-static (CVE-2018-16474)
Published: 2018-11-06T23:12:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

All versions of `tianma-static` are vulnerable to stored cross-site scripting (XSS). The vulnerability is exploitable if a user can control the name of a file that is served by `tianma-static`


## Recommendation

As no fix is available for this vulnerability at this time it is our recommendation to use another static file server.
Improper Input Validation in kdcproxy (CVE-2015-5159)
Published: 2018-11-01T14:49:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request.
Valine HTML Injection (CVE-2018-19289)
Published: 2018-11-21T22:19:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability (CVE-2018-11770)
Published: 2018-11-09T17:41:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future 2.4.x versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.
Insufficient Error Handling in http-proxy (CVE-2017-16014)
Published: 2018-11-09T17:47:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions of `http-proxy` are vulnerable to a denial of service attack, wherein an attacker can force an error which will cause the server to crash.


## Recommendation

Update to version 0.7.0 or later.
Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope (CVE-2018-1322)
Published: 2018-11-06T23:17:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can recover sensitive security values using the fiql and orderby parameters.
Cross-Site Scripting in sanitize-html (CVE-2017-16017)
Published: 2018-11-09T17:45:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions of `sanitize-html` are vulnerable to cross-site scripting.

## Proof of Concept:

`<IMG SRC= onmouseover="alert('XSS');">`
produces the following:

`<img src="onmouseover="alert('XSS');"" />`
This is definitely invalid HTML, but would suggest that it's being interpreted incorrectly by the parser.


## Recommendation

Update to version 1.2.3 or later.