aswin1906/github-advisory-2020.csv huggingface dataset:
Cross site scripting vulnerability in ActionView
Advisory: GHSA-65cv-r6x7-79hv (CVE-2020-5267)
Published: 2020-03-19T17:30:29Z

There is a possible cross site scripting (XSS) vulnerability in ActionView's JavaScript literal escape helpers.  Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks.

### Impact

There is a possible XSS vulnerability in the `j` and `escape_javascript` methods in ActionView.  These methods are used for escaping JavaScript string literals.  Impacted code will look something like this:

```erb
<script>let a = `<%= j unknown_input %>`</script>
```

or

```erb
<script>let a = `<%= escape_javascript unknown_input %>`</script>
```

### Releases

The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.

### Workarounds

For those that can't upgrade, the following monkey patch may be used:

```ruby
ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
  {
    "`" => "\\`",
    "$" => "\\$"
  }
)

module ActionView::Helpers::JavaScriptHelper
  alias :old_ej :escape_javascript
  alias :old_j :j

  def escape_javascript(javascript)
    javascript = javascript.to_s
    if javascript.empty?
      result = ""
    else
      result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
    end
    javascript.html_safe? ? result.html_safe : result
  end

  alias :j :escape_javascript
end
```

### Patches

To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* [5-2-js-helper-xss.patch](https://gist.github.com/tenderlove/c042ff49f0347c37e99183a6502accc6#file-5-2-js-helper-xss-patch) - Patch for 5.2 series
* [6-0-js-helper-xss.patch](https://gist.github.com/tenderlove/c042ff49f0347c37e99183a6502accc6#file-6-0-js-helper-xss-patch) - Patch for 6.0 series

Please note that only the 5.2 and 6.0 series are supported at present. Users
of earlier unsupported releases are advised to upgrade as soon as possible as we
cannot guarantee the continued availability of security fixes for unsupported
releases.

### Credits

Thanks to Jesse Campos from Chef Secure

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: RubyGems, name: actionview, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.2.4.2, database_specific: last_known_affected_version_range: <= 5.2.4.1
package: ecosystem: RubyGems, name: actionview, ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.0.2.2, database_specific: last_known_affected_version_range: <= 6.0.2.1
Read permissions not enforced for client provided filter expressions in Elide.
Advisory: GHSA-2mxr-89gf-rc4v (CVE-2020-5289)
Published: 2020-03-30T20:09:58Z

### Impact
It is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model.  The adversary can construct filter expressions for an inaccessible field to filter a collection.  The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field.

For example, a User model has two fields: _name_ and _role_.  The adversary has read permissions to see the _name_ field of the User collection but not the _role_.  By constructing a filter like the one below, the adversary can determine which users have admin role by presence or absence in the returned collection:
`filter=role=="Admin"`

### Patches
Resolved in Elide 4.5.14 and greater.

### Workarounds
The adversary can only access the fields if a model includes fields with different read permission levels (some less secure and some more secure).  Model security can be adjusted by restricting read permissions on existing models.

### References
Fixed in https://github.com/yahoo/elide/pull/1236

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [elide](https://github.com/yahoo/elide)
* Contact us at [spectrum](https://spectrum.chat/elide?tab=posts)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: com.yahoo.elide:elide-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.5.14
Prototype pollution in dojo
Advisory: GHSA-jxfh-8wgv-vfr2 (CVE-2020-5258)
Published: 2020-03-10T18:03:14Z

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution.

Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects.
An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. 

This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: dojo, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.11.10
package: ecosystem: npm, name: dojo, ranges: type: ECOSYSTEM, events: introduced: 1.12.0
fixed: 1.12.8
package: ecosystem: npm, name: dojo, ranges: type: ECOSYSTEM, events: introduced: 1.13.0
fixed: 1.13.7
package: ecosystem: npm, name: dojo, ranges: type: ECOSYSTEM, events: introduced: 1.14.0
fixed: 1.14.6
package: ecosystem: npm, name: dojo, ranges: type: ECOSYSTEM, events: introduced: 1.15.0
fixed: 1.15.3
package: ecosystem: npm, name: dojo, ranges: type: ECOSYSTEM, events: introduced: 1.16.0
fixed: 1.16.2
python-gnupg allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended
Advisory: GHSA-qh62-ch95-63wh ()
Published: 2020-03-13T20:05:10Z
Withdrawn: 2020-06-16T20:25:44Z

**Withdrawn:** Duplicate of GHSA-2fch-jvg5-crf6

Affected packages:
package: ecosystem: PyPI, name: python-gnupg, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.4.4
Remote code execution in PHPMailer
Advisory: GHSA-4pc3-96mx-wwc8 (CVE-2016-10045)
Published: 2020-03-05T22:09:14Z

### Impact
The `isMail` transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the `mail` command and consequently execute arbitrary code by leveraging improper interaction between the `escapeshellarg` function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

This issue really emphasises that it&#39;s worth avoiding the built-in PHP `mail()` function entirely.

### Patches
Fixed in 5.2.20

### Workarounds
Send via SMTP to localhost instead of calling the `mail()` function.

### References
https://nvd.nist.gov/vuln/detail/CVE-2016-10045
See also https://nvd.nist.gov/vuln/detail/CVE-2016-10033

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: phpmailer/phpmailer, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.2.20
Local file disclosure in PHPMailer
Advisory: GHSA-4x5h-cr29-fhp6 (CVE-2017-5223)
Published: 2020-03-05T22:09:10Z

An issue was discovered in PHPMailer before 5.2.22. PHPMailer&#39;s `msgHTML` method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to `/`, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.

### Impact
Arbitrary local files can be attached to email messages.

### Patches
Fixed in 5.2.22

### Workarounds
Validate input before using user-supplied file paths.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-5223

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Packagist, name: phpmailer/phpmailer, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.2.22
Denial of Service in uap-core when processing crafted User-Agent strings
Advisory: GHSA-pcqq-5962-hvcw ()
Published: 2020-03-10T18:02:49Z

### Impact
Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

### Patches
Please update `uap-ruby` to &gt;= v2.6.0

### For more information
https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p

Reported in `uap-core` by Ben Caller @bcaller

Affected packages:
package: ecosystem: RubyGems, name: user_agent_parser, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.6.0
mutation XSS via whitelisted math or svg and raw tag in Bleach
Advisory: GHSA-m6xf-fq7q-8743 (CVE-2020-6816)
Published: 2020-03-24T15:06:32Z

### Impact

A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:

* the `svg` or `math` in the allowed/whitelisted tags
* an RCDATA tag (see below) in the allowed/whitelisted tags
* the keyword argument `strip=False`

### Patches

Users are encouraged to upgrade to bleach v3.1.2 or greater.

### Workarounds

* modify `bleach.clean` calls to use `strip=True`, or not whitelist `math` or `svg` tags and one or more of the following tags:

```
script
noscript
style
noframes
xmp
noembed
iframe
```

* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1621692
* https://cure53.de/fp170.pdf
* https://nvd.nist.gov/vuln/detail/CVE-2020-6816
* https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach

### Credits

* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)
* Email us at [security@mozilla.org](mailto:security@mozilla.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: bleach, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.2
Double Free in psutil
Advisory: GHSA-qfc5-mcwq-26q8 (CVE-2019-18874)
Published: 2020-03-12T17:02:50Z

psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: psutil, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.6.6, database_specific: last_known_affected_version_range: <= 5.6.5
HTTP Response Splitting (Early Hints) in Puma
Advisory: GHSA-33vf-4xgg-9r58 (CVE-2020-5249)
Published: 2020-03-03T23:33:16Z

### Impact
If an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as [HTTP Response Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting).

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

This is related to [CVE-2020-5247](https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v), which fixed this vulnerability but only for regular responses.

### Patches
This has been fixed in 4.3.3 and 3.12.4.

### Workarounds
Users can not allow untrusted/user input in the Early Hints response header.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [puma](https://github.com/puma/puma)
* Email us a project maintainer. [Email addresses are listed in our Code of Conduct](https://github.com/puma/puma/blob/master/CODE_OF_CONDUCT.md#enforcement).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected packages:
package: ecosystem: RubyGems, name: puma, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.12.4
package: ecosystem: RubyGems, name: puma, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.3.3
Missing Token Replay Detection in Saml2 Authentication services for ASP.NET
Advisory: GHSA-g6j2-ch25-5mmv (CVE-2020-5261)
Published: 2020-03-25T16:52:49Z

### Impact
Token Replay Detection is an important defence in depth measure for Single Sign On solutions. In all previous 2.X versions, the Token Replay Detection is not properly implemented. 

Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use.

### Patches
The 2.5.0 version is patched.

### Workarounds
There are no workarounds with existing versions. Fixing the issue requires code updates.

### References
https://en.wikipedia.org/wiki/Replay_attack

### For more information
If you have any questions or comments about this advisory:
* Comment on #711.
* Email us at [security@sustainsys.com](mailto:security@susatinsys.com) if you think that there are further security issues.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: NuGet, name: Sustainsys.Saml2, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.5.0
SMTP Injection in PHPMailer
Advisory: GHSA-738m-f33v-qc2r (CVE-2015-8476)
Published: 2020-03-05T22:09:19Z

### Impact
Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.

### Patches
Fixed in 5.2.14 in [this commit](https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0).

### Workarounds
Manually strip line breaks from email addresses before passing them to PHPMailer.

### References
https://nvd.nist.gov/vuln/detail/CVE-2015-8476

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

Affected packages:
package: ecosystem: Packagist, name: phpmailer/phpmailer, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.2.14
Incorrect Account Used for Signing
Advisory: GHSA-vg44-fw64-cpjx ()
Published: 2020-03-24T15:08:59Z

### Impact

Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index `0`), or with the legacy MEW/MyCrypto HD path, they are not affected.

The vulnerability impacts cases where the user signs a personal message or transaction without first adding the account. This includes cases where the user has already added the account in a previous session (i.e. they added the account, reset the application, then signed something). The serialization/deserialization process does restore a previously added account, but it doesn&#39;t restore the index instructing the keyring to use that account for signing. As a result, after serializing then deserializing the keyring state, the account at index `0` is always used for signing even if it isn&#39;t the current account.

### Patches

This has been patched ([#14](https://github.com/MetaMask/eth-ledger-bridge-keyring/pull/14)) in version &gt;=0.2.1 of [`eth-ledger-bridge-keyring`](https://www.npmjs.com/package/eth-ledger-bridge-keyring), and in version &gt;=0.2.2 of [`@metamask/eth-ledger-bridge-keyring`](https://www.npmjs.com/package/@metamask/eth-ledger-bridge-keyring). Users are encouraged to migrate to the new package name.

### Workarounds

To work around this problem without updating, you should remove then re-add the account before use. As long as the account was added during the lifetime of that process, signing with that account should work correctly.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [MetaMask/eth-ledger-bridge-keyring on GitHub](https://github.com/MetaMask/eth-ledger-bridge-keyring)
* Email the MetaMask team at [hello@metamask.io](mailto:hello@metamask.io)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: eth-ledger-bridge-keyring, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.1
package: ecosystem: npm, name: @metamask/eth-ledger-bridge-keyring, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.2
Sort order SQL injection in Administrate
Advisory: GHSA-2p5p-m353-833w (CVE-2020-5257)
Published: 2020-03-13T21:05:44Z

In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard,
the direction parameter was not validated before being interpolated into the SQL query.
This could present a SQL injection if the attacker were able to modify the `direction` parameter and bypass ActiveRecord SQL protections.

Whilst this does have a high-impact, to exploit this you need access to the Administrate dashboards, which we would expect to be behind authentication.

This is patched in wersion 0.13.0.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: RubyGems, name: administrate, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.13.0
Improper Access Control in novajoin
Advisory: GHSA-xf8c-3cgx-fcwm (CVE-2019-10138)
Published: 2020-03-12T16:54:06Z

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: novajoin, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.1, database_specific: last_known_affected_version_range: <= 1.1.0
Improper Authentication in requests-kerberos
Advisory: GHSA-wh37-37xw-54hr (CVE-2014-8650)
Published: 2020-03-10T18:02:31Z

python-requests-Kerberos through 0.5 does not handle mutual authentication

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: requests-kerberos, ecosystem_specific: affected_functions: requests_kerberos.HTTPKerberosAuth.handle_response, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.6
Malicious package may avoid detection in python auditing
Advisory: GHSA-7q25-qrjw-6fg2 (CVE-2020-5252)
Published: 2020-03-24T15:07:56Z

# Python Auditing Vulnerability

Demonstrates how a malicious package can insert a load-time poison pill to avoid detection by tools like Safety.

Tools that are designed to find vulnerable packages can not ever run in the same python environment that they are trying to protect.

## Usage

Install `safety`, `insecure-package`, and this package with pip in the same python environment. Order doesn&amp;#39;t matter.

1. pip install safety
2. pip install insecure-package
3. pip install dist/malicious-0.1-py3-none-any.whl

Run the check

4. `safety check`

You should see both `Running my modified safety.check` and that `insecure-package` is not listed in the results!


## How it Works

Everything in Python is mutable. The trick is getting some code to run at interpreter load time in order to do some patching.

1. When you install this package, the `setup.py` settings installs a `malicious.pth` file to your `site-packages` directory.
2. The `malicious.pth` file gets loaded anytime Python starts, which in turn imports our `malicious` package.
3. The `malicious/__init__.py` patches the safety library with a custom function to avoid detection.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: safety, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.0
Deserialization of Untrusted Data in jackson-databind
Advisory: GHSA-4w82-r329-3q67 (CVE-2020-8840)
Published: 2020-03-04T20:52:14Z

FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.6.7.4, database_specific: last_known_affected_version_range: <= 2.6.7.3
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.7.0
fixed: 2.7.9.7, database_specific: last_known_affected_version_range: <= 2.7.9.6
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.11.5, database_specific: last_known_affected_version_range: <= 2.8.11.4
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.3, database_specific: last_known_affected_version_range: <= 2.9.10.2
Remote Code Execution Through Image Uploads in BookStack
Advisory: GHSA-g9rq-x4fj-f5hx (CVE-2020-5256)
Published: 2020-03-13T20:21:27Z

### Impact

A user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process.

This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. 

### Patches

The issue was addressed in a series of patches: v0.25.3, v0.25.4 and v0.25.5.
Users should upgrade to at least v0.25.5 to avoid this patch but ideally the latest BookStack version as previous versions are un-supported.

### Workarounds

Depending on BookStack version, you could use the [local_secure](https://www.bookstackapp.com/docs/admin/upload-config/#local-secure) image storage option, or use s3 or a similar compatible service.

Preventing direct execution of any `php` files, apart from the `public/index.php` file, though web-server configuration would also prevent this.

### References

[BookStack Beta v0.25.3](https://github.com/BookStackApp/BookStack/releases/tag/v0.25.3)
[BookStack Beta v0.25.4](https://github.com/BookStackApp/BookStack/releases/tag/v0.25.4)
[BookStack Beta v0.25.5](https://github.com/BookStackApp/BookStack/releases/tag/v0.25.5)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [the BookStack GitHub repository](BookStackApp/BookStack/issues).
* Ask on the [BookStack Discord chat](https://discord.gg/ztkBqR2).
* Follow the [BookStack Security advise](https://github.com/BookStackApp/BookStack#-security) to contact someone privately.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
Affected packages:
package: ecosystem: Packagist, name: ssddanbrown/bookstack, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.25.5, database_specific: last_known_affected_version_range: < 0.25.3
Firewall configured with unanimous strategy was not actually unanimous in Symfony
Advisory: GHSA-g4m9-5hpf-hx72 (CVE-2020-5275)
Published: 2020-03-30T20:09:44Z

Description
-----------

On Symfony before 4.4.0, when a `Firewall` checks an access control rule (using the unanimous strategy), it iterates over all rule attributes and grant access only if *all* calls to the `accessDecisionManager` decide to grant access.

As of Symfony 4.4.0, a bug was introduced that prevents the check of attributes as soon as `accessDecisionManager` decide to grant access on one attribute.

Resolution
----------

The `accessDecisionManager` is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. 

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/c935e4a3fba6cc2ab463a6ca382858068d63cebf) for the 4.4 branch.

Credits
-------

I would like to thank Antonio J. García Lagar for reporting & Robin Chalas for fixing the issue.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: symfony/security, ranges: type: ECOSYSTEM, events: introduced: 4.4.0
fixed: 4.4.7
package: ecosystem: Packagist, name: symfony/security, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.0.7
package: ecosystem: Packagist, name: symfony/security-http, ranges: type: ECOSYSTEM, events: introduced: 4.4.0
fixed: 4.4.7
package: ecosystem: Packagist, name: symfony/security-http, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.0.7
Cross-Site Scripting in react
Advisory: GHSA-hg79-j56m-fxgv ()
Published: 2020-09-04T15:26:04Z

Versions of `react` prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's `createElement` function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 0.14.0 or later.

Affected packages:
package: ecosystem: npm, name: react, ranges: type: ECOSYSTEM, events: introduced: 0.0.1
fixed: 0.14.0
Malicious Package in buffer-xnr
Advisory: GHSA-c4hh-fg8x-6h9p ()
Published: 2020-09-03T21:57:29Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-xnr, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in js-sja3
Advisory: GHSA-6343-m2qr-66gf ()
Published: 2020-09-03T23:10:41Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-sja3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in asycn
Advisory: GHSA-h26f-j4mv-84g7 ()
Published: 2020-09-02T18:39:43Z

All versions of `asycn` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: asycn, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in 8.9.4
Advisory: GHSA-725f-3pw7-rq6x ()
Published: 2020-09-03T21:09:47Z

Versions 1.0.2, 1.0.3, 1.0.4 and 1.0.5 of `8.9.4` contain malicious code as a preinstall script. The package reads the system's SSH keys but does not upload it to a remote server.


## Recommendation

Remove the package from your environment. There is no evidence of further compromise at the moment.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: 8.9.4, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in iie-viz
Advisory: GHSA-jf55-rgpx-p6rx ()
Published: 2020-09-03T19:12:22Z

Version 1.0.4 of `iie-viz` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.0.3

Affected packages:
package: ecosystem: npm, name: iie-viz, versions: 1.0.4
Information Disclosure in TYPO3 extension sf_event_mgt
Advisory: GHSA-g8rg-7rpr-cwr2 (CVE-2020-25026)
Published: 2020-09-02T18:03:26Z

A missing access check in the backend module allows an authenticated backend user to export participant data for events which the user does not have access to, resulting in Information Disclosure. 

Another missing access check in the backend module allows an authenticated backend user to send emails to event participants for events which the user does not have access to, resulting in Broken Access Control.

External reference: [https://typo3.org/security/advisory/typo3-ext-sa-2020-017](https://typo3.org/security/advisory/typo3-ext-sa-2020-017)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: Packagist, name: derhansen/sf_event_mgt, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.3.1
package: ecosystem: Packagist, name: derhansen/sf_event_mgt, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.1.1
Directory Traversal in serverzyy
Advisory: GHSA-pxq7-4ppw-qp7f (CVE-2017-16135)
Published: 2020-09-01T18:19:36Z

Affected versions of `serverzyy` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Affected packages:
package: ecosystem: npm, name: serverzyy, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bitcoimd-rpc
Advisory: GHSA-rwmv-c7v8-v9vf ()
Published: 2020-09-04T16:36:45Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bitcoimd-rpc, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in express-cart
Advisory: GHSA-9pr3-7449-977r ()
Published: 2020-09-02T18:21:26Z

All versions of `harp` are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other pages.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.


Affected packages:
package: ecosystem: npm, name: express-cart, ranges: type: ECOSYSTEM, events: introduced: 0
Directory Traversal in wenluhong1
Advisory: GHSA-224h-p7p5-rh85 ()
Published: 2020-09-01T17:32:26Z

Affected versions of `wenluhong1` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: wenluhong1, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in cicada-render
Advisory: GHSA-6m6m-j2hm-pxrg ()
Published: 2020-09-03T17:37:05Z

All versions of `cicada-render` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: cicada-render, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Segmentation fault in tensorflow-lite
Advisory: GHSA-x9j7-x98r-r4w2 (CVE-2020-15210)
Published: 2020-09-25T18:28:51Z

### Impact
If a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption.

### Patches
We have patched the issue in d58c96946b and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### Workarounds
A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that no operator reuses tensors as both inputs and outputs. Care should be taken to check all types of inputs (i.e., constant or variable tensors as well as optional tensors).

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been discovered from a variant analysis of [GHSA-cvpc-8phh-8f45](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cvpc-8phh-8f45).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Cross-Site Scripting in emojione
Advisory: GHSA-46m8-42hm-wvvw (CVE-2016-1000231)
Published: 2020-09-01T15:34:16Z

Affected versions of `emojione` are vulnerable to cross-site scripting when user input is passed into the `toShort()`, `shortnameToImage()`, `unicodeToImage()`, and `toImage()` functions.



## Recommendation

Update to version 1.3.1 or later.

Affected packages:
package: ecosystem: npm, name: emojione, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.1, database_specific: last_known_affected_version_range: <= 1.3.0
Malicious Package in simple-alipay
Advisory: GHSA-3wh2-2pp3-2823 ()
Published: 2020-09-01T20:35:18Z

Version 1.0.1 of `simple-alipay` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.1 of this module is found installed you will want to replace it with a version before or after 1.0.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.0.0

Affected packages:
package: ecosystem: npm, name: simple-alipay, versions: 1.0.1
Security Constraint Bypass in Spring Security
Advisory: GHSA-v35c-49j6-q8hq (CVE-2016-9879)
Published: 2020-09-15T20:30:34Z

Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification (see below). Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed.

Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath() and getPathInfo() [1].

Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified.

Users of IBM WebSphere Application Server 8.5.x are known to be affected.

Users of other containers that implement the Servlet specification may be affected.

[1] https://issues.apache.org/bugzilla/show_bug.cgi?id=25015

## Affected Pivotal Products and Versions
Severity is high unless otherwise noted.
- Spring Security 3.2.0 - 3.2.9
- Spring Security 4.0.x - 4.1.3
- Spring Security 4.2.0
- Older unsupported versions are also affected

## Mitigation
Adopting one of the following mitigations will protect against this vulnerability.

- Use a Servlet container known not to include path parameters in the return values for getServletPath() and getPathInfo()
- Upgrading to Spring Security 3.2.10, 4.1.4 or 4.2.1 will reject the request with a RequestRejectedException if the presence of an encoded "/" is detected. Note: If you wish to disable this feature it can be disabled by setting the DefaultHttpFirewall.allowUrlEncodedSlash = true. However, disabling this feature will mean applications are vulnerable (in containers that return path parameters in getServletPath() or getPathInfo()).

## Credit
The issue was identified by Shumpei Asahara & Yuji Ito from NTT DATA Corporation and responsibly reported to Pivotal.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.springframework.security:spring-security-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.10
package: ecosystem: Maven, name: org.springframework.security:spring-security-core, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.1.4
package: ecosystem: Maven, name: org.springframework.security:spring-security-core, ranges: type: ECOSYSTEM, events: introduced: 4.2.0
fixed: 4.2.1
Malicious Package in font-scrubber
Advisory: GHSA-65j7-66p7-9xgf ()
Published: 2020-09-02T21:51:55Z

Version 1.2.2 of `font-scrubber` contains malicious code as a postinstall script. The package attempts to upload sensitive files from the system to a remote server. The files include configuration files, command history logs, SSH keys and /etc/passwd.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: font-scrubber, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in bitcoin-osp
Advisory: GHSA-v8g7-9qv2-j865 ()
Published: 2020-09-04T16:38:55Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bitcoin-osp, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in alipayjsapi
Advisory: GHSA-rjhc-w3fj-j6x9 ()
Published: 2020-09-03T17:32:45Z

All versions of `alipayjsapi` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: alipayjsapi, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in ascii-art
Advisory: GHSA-9hqj-38j2-5jgm ()
Published: 2020-09-01T21:19:23Z

Versions of `ascii-art` before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the `ascii-art preview` command. 


Example Proof of concept:
`ascii-art preview 'doom"; touch /tmp/malicious; echo "'`

Given that the input is passed on the command line and none of the api methods are vulnerable to this,  the likely exploitation vector is when the ascii-art comment is being called programmatically using something like `execFile`.


## Recommendation

Update to version 1.4.4 or later.

Affected packages:
package: ecosystem: npm, name: ascii-art, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.4.4, database_specific: last_known_affected_version_range: <= 1.4.2
Outdated Static Dependency in vue-moment
Advisory: GHSA-hrpp-f84w-xhfg ()
Published: 2020-09-04T16:55:06Z

Versions of `vue-moment` prior to 4.1.0 contain an Outdated Static Dependency. The package depends on `moment` and has it loaded statically instead of as a dependency that can be updated. It has `moment@2.19.1` that contains a Regular Expression Denial of Service vulnerability.


## Recommendation

Upgrade to version 4.1.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected packages:
package: ecosystem: npm, name: vue-moment, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.1.0
Authentication Bypass in saml2-js
Advisory: GHSA-mfcp-34xw-p57x ()
Published: 2020-09-03T21:20:52Z

Versions of `saml2-js` prior to 2.0.5 are vulnerable to an Authentication Bypass. The package fails to enforce the assertion conditions for encrypted assertions, which may allow an attacker to reuse encrypted assertion tokens indefinitely.


## Recommendation

Upgrade to version 2.0.5 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: saml2-js, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.5
Malicious Package in mogobd
Advisory: GHSA-jchg-g94r-64qg ()
Published: 2020-09-03T19:50:10Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: mogobd, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in riped160
Advisory: GHSA-rwcq-qpm6-7867 ()
Published: 2020-09-03T17:04:32Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: riped160, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
fuelux vulnerable to Cross-Site Scripting in Pillbox feature
Advisory: GHSA-fwcw-5qw2-87mp (CVE-2016-1000235)
Published: 2020-09-01T15:55:56Z

Affected versions of `fuelux` contain a cross-site scripting vulnerability in the Pillbox feature. By supplying a script as a value for a new pillbox, it is possible to cause arbitrary script execution.

## Recommendation

Update to version 3.15.7 or later.

Affected packages:
package: ecosystem: npm, name: fuelux, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.15.7
Directory Traversal in serveryztyzt
Advisory: GHSA-q4cq-539c-3mmm (CVE-2017-16103)
Published: 2020-09-01T16:48:14Z

Affected versions of `serveryztyzt` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: serveryztyzt, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0