aswin1906/github-advisory-2020.csv huggingface dataset:
Cross-Site Scripting in harp
Advisory: GHSA-cx7r-634m-2q2h ()
Published: 2020-09-02T18:20:21Z
Withdrawn: 2021-06-01T22:21:08Z

# Withdrawn

This advisory has been withdrawn per request from the maintainer.  Given harp is a static webserver, a XSS type of vulnerability is not appropriate.

### Original advisory description

All versions of `harp` are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, `harp` does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious files.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: harp, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in axioss
Advisory: GHSA-8w9j-6wg6-qv4f ()
Published: 2020-09-03T19:41:17Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: axioss, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in froever
Advisory: GHSA-2r8f-2665-3gxq ()
Published: 2020-09-02T21:36:36Z

All versions of `froever` contain malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: froever, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in sparkies
Advisory: GHSA-c4fm-46gm-4469 ()
Published: 2020-09-03T20:00:05Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: sparkies, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in destroyer-of-worlds
Advisory: GHSA-w3f3-4j22-2v3p ()
Published: 2020-09-02T21:27:02Z

The package `destroyer-of-worlds` contained malicious code. The package contained a bash script that was run as a postinstall script. The script deleted system files and attempted to exhaust resources by creating a large file, a fork bomb and an endless loop. The script targeted UNIX systems.


## Recommendation

Remove the package from your environment and perform additional incident response on your system's files and processes.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: destroyer-of-worlds, ranges: type: ECOSYSTEM, events: introduced: 0
NoSQL Injection in loopback-connector-mongodb
Advisory: GHSA-hxwc-5vw9-2w4w ()
Published: 2020-09-02T15:52:39Z

Versions of `loopback-connector-mongodb` prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak.


## Recommendation

Upgrade to version 3.6.0 or later.

Affected packages:
package: ecosystem: npm, name: loopback-connector-mongodb, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.6.0, database_specific: last_known_affected_version_range: <= 3.5.0
Malicious Package in bp66
Advisory: GHSA-8gc6-65mm-xr6r ()
Published: 2020-09-04T16:46:28Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bp66, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in earlybird
Advisory: GHSA-qpwf-4fx5-crqq (CVE-2017-16154)
Published: 2020-09-01T17:19:36Z

Affected versions of `earlybird` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: earlybird, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Remote Code Execution in pi_video_recording
Advisory: GHSA-9wjh-jr2j-6r4x ()
Published: 2020-09-02T15:55:58Z

All versions of `pi_video_recording` are vulnerable to Remote Code Execution. Due to insufficient input validation the server executes arbitrary code through the /api/record/start endpoint.  After running the server, `curl -POST -H "Content-Type: application/json" -d '{"filename": " || touch /tmp/worked;"}' http://localhost:5000/api/record/start`creates a file in the /tmp/ directory


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: pi_video_recording, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in asnc
Advisory: GHSA-2p99-6f47-8x9j ()
Published: 2020-09-02T18:38:39Z

All versions of `asnc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: asnc, ranges: type: ECOSYSTEM, events: introduced: 0
Directory Traversal in cypserver
Advisory: GHSA-m69q-pmxg-vqch (CVE-2017-16191)
Published: 2020-09-01T18:26:00Z

Affected versions of `cypserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: cypserver, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in sj-tw-abc
Advisory: GHSA-4hfc-fv33-ph9p ()
Published: 2020-09-03T23:26:33Z

All versions of `sj-tw-abc` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: sj-tw-abc, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Sandbox Breakout / Arbitrary Code Execution in static-eval
Advisory: GHSA-x9hc-rw35-f44h ()
Published: 2020-09-02T15:46:03Z

Versions of `static-eval`prior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.

## Proof of concept
```
var evaluate = require('static-eval');
var parse = require('esprima').parse;

var src = process.argv[2];
var payload = '(function({x}){return x.constructor})({x:"".sub})("console.log(process.env)")()'
var ast = parse(payload).body[0].expression;
console.log(evaluate(ast, {x:1}));
```


## Recommendation

Upgrade to version 2.0.2 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: npm, name: static-eval, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.2, database_specific: last_known_affected_version_range: <= 2.0.1
Cross-Site Scripting in wangeditor
Advisory: GHSA-g7mw-5cq6-fv82 ()
Published: 2020-09-02T21:20:40Z

All versions of `wangeditor` are vulnerable to Cross-Site Scripting. The package fails to properly encode output, allowing arbitrary JavaScript to be inserted in links and executed by browsers.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: wangeditor, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in rpc-websocket
Advisory: GHSA-x87g-rgrh-r6g3 ()
Published: 2020-09-03T17:07:15Z

Versions of `rpc-websocket` >= 0.7.6 contained malicious code. The package opens a backdoor to a remote server and executes arbitrary commands, effectively acting as a backdoor.


## Recommendation

Any computer that has these versions of the package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: rpc-websocket, ranges: type: ECOSYSTEM, events: introduced: 0.7.7
Cross-Site Scripting in ngx-md
Advisory: GHSA-xr53-m937-jr9c ()
Published: 2020-09-03T15:49:14Z

Versions of `ngx-md` prior to 6.0.3 are vulnerable to Cross-Site Scripting.  Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as `[Click Me](javascript:alert('Injected!'%29)` is rendered as a `Click Me` link that executes JavaScript.


## Recommendation

Upgrade to version 6.0.3 or later.

Affected packages:
package: ecosystem: npm, name: ngx-md, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.0.3
Directory Traversal in serve46
Advisory: GHSA-qw9c-8p76-3q2x (CVE-2017-16148)
Published: 2020-09-01T18:49:11Z

Affected versions of `serve46` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: serve46, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
The `size` option isn't honored after following a redirect in node-fetch
Advisory: GHSA-w7rc-rwvf-8q5r (CVE-2020-15168)
Published: 2020-09-10T17:46:21Z

### Impact
Node Fetch did not honor the `size` option after following a redirect, which means that when a content size was over the limit, a `FetchError` would never get thrown and the process would end without failure.

For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after `fetch()` has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

### Patches
We released patched versions for both stable and beta channels:

- For `v2`: 2.6.1
- For `v3`: 3.0.0-beta.9

### Workarounds
None, it is strongly recommended to update as soon as possible.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [node-fetch](https://github.com/node-fetch/node-fetch/issues/new?assignees=&labels=question&template=support-or-usage.md&title=Question%3A+)
* Contact one of the core maintainers.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Affected packages:
package: ecosystem: npm, name: node-fetch, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.6.1
package: ecosystem: npm, name: node-fetch, ranges: type: ECOSYSTEM, events: introduced: 3.0.0-beta.1
fixed: 3.0.0-beta.9, database_specific: last_known_affected_version_range: <= 3.0.0-beta.8
Cross-Site Scripting in buefy
Advisory: GHSA-xwqw-rf2q-xmhf ()
Published: 2020-09-01T21:23:38Z

Versions of buefy prior to 0.7.2 are vulnerable to Cross-Site Scripting, allowing attackers to manipulate the DOM and execute remote code. The autocomplete list renders user input as HTML without encoding.


## Recommendation

Upgrade to version 0.7.2 or later.

Affected packages:
package: ecosystem: npm, name: buefy, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.7.2
Malicious Package in chak
Advisory: GHSA-9q9m-m2f6-jr5q ()
Published: 2020-09-02T20:22:34Z

All versions of `chak` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: chak, ranges: type: ECOSYSTEM, events: introduced: 0
Heap buffer overflow in Tensorflow
Advisory: GHSA-pg59-2f92-5cph (CVE-2020-15196)
Published: 2020-09-25T18:28:21Z

### Impact
The `SparseCountSparseOutput` and `RaggedCountSparseOutput` implementations don't validate that the `weights` tensor has the same shape as the data. The check exists for `DenseCountSparseOutput`, where both tensors are fully specified:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L110-L117

In the sparse and ragged count weights are still accessed in parallel with the data:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L199-L201

But, since there is no validation, a user passing fewer weights than the values for the tensors can generate a read from outside the bounds of the heap buffer allocated for the weights.

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-p5f8-gfw5-33w4](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p5f8-gfw5-33w4)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Malicious Package in bwffer-xor
Advisory: GHSA-7qg7-6g3g-8vxg ()
Published: 2020-09-03T22:46:25Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bwffer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in baes-x
Advisory: GHSA-2jm5-2cqf-6vw9 ()
Published: 2020-09-04T15:30:32Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: baes-x, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Machine-In-The-Middle in airtable
Advisory: GHSA-jrj9-5qp6-2v8q ()
Published: 2020-09-03T23:22:19Z

Affected versions of `airtable` are vulnerable to Machine-In-The-Middle. The package has SSL certificate validation disabled by default unintentionally. This may allow attackers in a privileged network position to decrypt intercepted traffic.


## Recommendation

Upgrade to version 0.7.2 or later.

Affected packages:
package: ecosystem: npm, name: airtable, ranges: type: ECOSYSTEM, events: introduced: 0.1.19
fixed: 0.7.2
Denial of Service in uws
Advisory: GHSA-hf5h-hh56-3vrg (CVE-2016-10544)
Published: 2020-09-01T16:02:29Z

Affected versions of `uws` do not properly handle large websocket messages when `permessage-deflate` is enabled, which may result in a denial of service condition.

If `uws` recieves a 256Mb websocket message when `permessage-deflate` is enabled, the server will compress the message prior to executing the length check, and subsequently extract the message prior to processing. This can result in a situation where an excessively large websocket message passes the length checks, yet still gets cast from a Buffer to a string, which will exceed v8's maximum string size and crash the process.


## Recommendation

Update to version 0.10.9 or later.

Alternatively, disable `permessage-deflate`.

Affected packages:
package: ecosystem: npm, name: uws, ranges: type: ECOSYSTEM, events: introduced: 0.10.0
fixed: 0.10.9, database_specific: last_known_affected_version_range: <= 0.10.8
Malicious Package in reuest
Advisory: GHSA-r863-p739-275c ()
Published: 2020-09-11T21:09:24Z

All versions of `reuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: reuest, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in node-spdy
Advisory: GHSA-wfjh-3hq2-r276 ()
Published: 2020-09-03T19:56:48Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: node-spdy, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in dcserver
Advisory: GHSA-fg6m-q92x-vv38 (CVE-2017-16158)
Published: 2020-09-01T17:26:00Z

Affected versions of `dcserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: dcserver, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in colour-string
Advisory: GHSA-8mmf-qp7j-2w24 ()
Published: 2020-09-02T21:35:33Z

Version 1.5.3 of `colour-string` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: colour-string, ranges: type: ECOSYSTEM, events: introduced: 0
Cross-Site Scripting in gitbook
Advisory: GHSA-5h5r-23r4-m87h (CVE-2017-16019)
Published: 2020-09-01T16:04:39Z

Affected versions of `gitbook` do not properly sanitize user input outside of backticks, which may result in cross-site scripting in the online reader.


## Recommendation

Update to version 3.2.2 or later.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: gitbook, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.2
Malicious Package in b5ffer-xor
Advisory: GHSA-jvfv-jhw9-jmpp ()
Published: 2020-09-03T21:23:09Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: b5ffer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bs58chcek
Advisory: GHSA-97mp-9g5c-6c93 ()
Published: 2020-09-04T16:50:48Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bs58chcek, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Execution in windows-cpu
Advisory: GHSA-63m4-fhf2-cmf7 (CVE-2017-1000219)
Published: 2020-09-01T16:43:55Z

Version of `windows-cpu` before 0.1.5 will execute arbitrary code passed into the first argument of the `findLoad` method, resulting in remote code execution.

## Proof of Concept

```js
var win = require('windows-cpu');
wind.findLoad('foo & calc.exe');
```


## Recommendation

Update to version 0.1.5 or later.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: windows-cpu, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.1.5
Malicious Package in pensi-scheduler
Advisory: GHSA-j4ch-mw66-xmqv ()
Published: 2020-09-03T19:16:44Z

Version 1.1.3 of `pensi-scheduler` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.1.2

Affected packages:
package: ecosystem: npm, name: pensi-scheduler, versions: 1.1.3
Cross-Site Scripting in takeapeek
Advisory: GHSA-4q2f-8g74-qm56 ()
Published: 2020-09-03T17:18:05Z

All versions of `takeapeek` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: takeapeek, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Memory leak in Tensorflow
Advisory: GHSA-8fxw-76px-3rxv (CVE-2020-15192)
Published: 2020-09-25T18:28:17Z

### Impact
If a user passes a list of strings to `dlpack.to_dlpack` there is a memory leak following an expected validation failure:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L100-L104

The allocated memory is from
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L256

The issue occurs because the `status` argument during validation failures is not properly checked:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L265-L267

Since each of the above methods can return an error status, the `status` value must be checked before continuing.

### Patches
We have patched the issue in 22e07fb204386768e5bcbea563641ea11f96ceb8 and will release a patch release for all affected versions.

We recommend users to upgrade to TensorFlow 2.2.1 or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been discovered during variant analysis of [GHSA-rjjg-hgv6-h69v](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rjjg-hgv6-h69v).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
npm-script-demo is malware
Advisory: GHSA-322m-p39j-r5m2 (CVE-2017-16128)
Published: 2020-09-01T18:55:37Z

The `npm-script-demo` package is a piece of malware that opens a connection to a command and control server and executed the instructions it is given.

It has been removed from the npm registry.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer has been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: npm-script-demo, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
Path Traversal in ponse
Advisory: GHSA-wfhx-6pcm-7m55 ()
Published: 2020-09-03T16:46:22Z

Versions of `ponse` prior to 2.0.2 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

Upgrade to version 2.0.2 or later.

Affected packages:
package: ecosystem: npm, name: ponse, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.2
Unsafe eval() in summit allows arbitrary code execution
Advisory: GHSA-cwcp-6c48-fm7m (CVE-2017-16020)
Published: 2020-09-01T16:39:38Z

Affected versions of `summit` allow attackers to execute arbitrary commands via collection names when using the `PouchDB` driver.



## Recommendation

No direct patch is available at this time.

Currently, the best option to mitigate the issue is to avoid using the `PouchDB` driver, as the package author has abandoned this feature entirely.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: summit, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.1.0
Cross-Site Scripting in c3
Advisory: GHSA-gvg7-pp82-cff3 (CVE-2016-1000240)
Published: 2020-09-01T15:59:11Z

Affected versions of `c3` are vulnerable to cross-site scripting via improper sanitization of HTML in rendered tooltips. 



## Recommendation

Update to 0.4.11 or later.

Affected packages:
package: ecosystem: npm, name: c3, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.4.11, database_specific: last_known_affected_version_range: <= 0.4.10
Reverse Tabnabbing in quill
Advisory: GHSA-588m-9qg5-35pq ()
Published: 2020-09-03T17:19:09Z

Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: quill, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.7
Denial of Service in serialize-to-js
Advisory: GHSA-w5q7-3pr9-x44w ()
Published: 2020-09-02T15:59:19Z

Versions of `serialize-to-js` prior to 2.0.0 are vulnerable to Denial of Service. User input is not properly validated, allowing attackers to provide inputs that lead the execution to loop indefinitely.


## Recommendation

Upgrade to version 2.0.0 or later.

Affected packages:
package: ecosystem: npm, name: serialize-to-js, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.0
Directory Traversal in wffserve
Advisory: GHSA-wqr3-24xm-fxhq (CVE-2017-16168)
Published: 2020-09-01T17:31:22Z

Affected versions of `wffserve` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: wffserve, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in liuyaserver
Advisory: GHSA-xj6q-9hx8-mm7f (CVE-2017-16170)
Published: 2020-09-01T17:34:34Z

Affected versions of `liuyaserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Affected packages:
package: ecosystem: npm, name: liuyaserver, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Segfault in Tensorflow
Advisory: GHSA-q8gv-q7wr-9jf8 (CVE-2020-15204)
Published: 2020-09-25T18:28:41Z

### Impact
In eager mode, TensorFlow does not set the session state. Hence, calling `tf.raw_ops.GetSessionHandle` or `tf.raw_ops.GetSessionHandleV2` results in a null pointer dereference:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/session_ops.cc#L45

In the above snippet, in eager mode, `ctx->session_state()` returns `nullptr`. Since code immediately dereferences this, we get a segmentation fault.

### Patches
We have patched the issue in 9a133d73ae4b4664d22bd1aa6d654fec13c52ee1 and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Denial of Service in @commercial/ammo
Advisory: GHSA-rhc3-76jw-4f2x ()
Published: 2020-09-04T17:58:46Z

Versions of `@commercial/ammo` prior to 2.1.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 2.1.1 or later.

Affected packages:
package: ecosystem: npm, name: @commercial/ammo, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.1.1
Malicious Package in bufder-xor
Advisory: GHSA-w9q5-mvc6-5cw3 ()
Published: 2020-09-03T21:45:13Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bufder-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in whiteproject
Advisory: GHSA-8j7x-pr59-m5h8 ()
Published: 2020-09-02T21:31:18Z

All versions of `whiteproject` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: whiteproject, ranges: type: ECOSYSTEM, events: introduced: 0
Directory Traversal in serverliujiayi1
Advisory: GHSA-vhx6-cp8w-295m (CVE-2017-16095)
Published: 2020-09-01T16:55:45Z

Affected versions of `serverliujiayi1` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: serverliujiayi1, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in eco
Advisory: GHSA-r32x-jhw5-g48p ()
Published: 2020-09-03T17:08:20Z

All versions of  `eco` are vulnerable to Cross-Site Scripting (XSS). The package's default `__escape` implementation fails to escape single quotes, which may allow attackers to execute arbitrary JavaScript on the victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: eco, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Segfault and data corruption in tensorflow-lite
Advisory: GHSA-q4qf-3fc6-8x34 (CVE-2020-15207)
Published: 2020-09-25T18:28:43Z

### Impact
To mimic Python's indexing with negative values, TFLite uses `ResolveAxis` to convert negative values to positive indices. However, the only check that the converted index is now valid is only present in debug builds:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/reference/reduce.h#L68-L72

If the `DCHECK` does not trigger, then code execution moves ahead with a negative index. This, in turn, results in accessing data out of bounds which results in segfaults and/or data corruption.
### Patches
We have patched the issue in 2d88f470dea2671b430884260f3626b1fe99830a and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Directory Traversal in nodeload-nmickuli
Advisory: GHSA-wmcq-3wfx-qjx5 ()
Published: 2020-09-01T17:33:30Z

Affected versions of `nodeload-nmickuli` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Affected packages:
package: ecosystem: npm, name: nodeload-nmickuli, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in luna-mock
Advisory: GHSA-qm4q-f956-fg64 ()
Published: 2020-09-03T17:39:13Z

All versions of `luna-mock` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: luna-mock, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Sandbox Breakout / Arbitrary Code Execution in localeval
Advisory: GHSA-mmqv-m45h-q2hp ()
Published: 2020-09-04T15:22:40Z

All versions of `localeval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `constructor.constructor`. This may allow attackers to execute arbitrary code in the system.  Evaluating the payload 
```
constructor.constructor("return process.env")()
``` 

returns the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: localeval, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
fixed: 15.3.0
Malicious Package in getcookies
Advisory: GHSA-3cjv-4phw-gvvv ()
Published: 2020-09-01T20:39:33Z

The `getcookies` module contained a backdoor that would allow for a remote attacker to execute arbitrary commands on the system running the malicious module.


## Recommendation

This module should be uninstalled if found used within an application. In addition to removing the installed module, you will also want to evaluate your application to determine whether or not user data or systems were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: getcookies, ranges: type: ECOSYSTEM, events: introduced: 0