CVE-2019-13506 (JSON, published 2019-07-11T14:15Z)
Description: value: @nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nuxt/nuxt.js
Files changed:
package.json
packages/builder/package.json
packages/core/package.json
packages/vue-renderer/package.json
packages/webpack/package.json
yarn.lock
Commit message: chore(deps): update all non-major dependencies (#5529)



Vulnerable code:
    "eslint-plugin-import": "^2.17.0",
    "@nuxt/devalue": "^1.2.2",
    "ignore": "^5.0.6",
    "@nuxt/devalue": "^1.2.2",
    "@nuxt/devalue": "^1.2.2",
    "extract-css-chunks-webpack-plugin": "^4.3.0",
"@nuxt/devalue@^1.2.2":
  version "1.2.2"
  resolved "https://registry.npmjs.org/@nuxt/devalue/-/devalue-1.2.2.tgz#1d7993f9a6029df07f597a20246b16282302b156"
  integrity sha512-T3S20YKOG0bzhvFRuGWqXLjqnwTczvRns5BgzHKRosijWHjl6tOpWCIr+2PFC5YQ3gTE4c5ZOLG5wOEcMLvn1w==
eslint-module-utils@^2.3.0:
  version "2.3.0"
  resolved "https://registry.npmjs.org/eslint-module-utils/-/eslint-module-utils-2.3.0.tgz#546178dab5e046c8b562bbb50705e2456d7bda49"
  integrity sha512-lmDJgeOOjk8hObTysjqH7wyMi+nsHwwvfBykwfhjR1LNdd7C2uFJBvx4OpWYpXOw4df1yE1cDEVd1yLHitk34w==
eslint-plugin-import@^2.17.0:
  version "2.17.0"
  resolved "https://registry.npmjs.org/eslint-plugin-import/-/eslint-plugin-import-2.17.0.tgz#bdf6598aded839a27454d824b0758fd46f80eb72"
  integrity sha512-JCsOtNwPYUoeZPlSr8t0+uCU5OVlHh+dIBn8Rw7FiOPjCECG+QzDIKDqshbyJE6CYoj9wpcstEl8vUY7rXkqVA==
    eslint-module-utils "^2.3.0"
extract-css-chunks-webpack-plugin@^4.3.0:
  version "4.3.0"
  resolved "https://registry.npmjs.org/extract-css-chunks-webpack-plugin/-/extract-css-chunks-webpack-plugin-4.3.0.tgz#01fb5ea225a78d5bd51e29b191dc1248ab320957"
  integrity sha512-U2mCuqF9JKmyQydQQUy+tsCVCeuysgIZNZHd0eeTgIgq6gSqCnS9eaCpknyLVl3aRr8y2gkvRPzpuHS7AdvK0Q==
ignore@^5.0.2, ignore@^5.0.6:

Fixed code:
    "eslint-plugin-import": "^2.17.1",
    "@nuxt/devalue": "^1.2.3",
    "ignore": "^5.1.0",
    "@nuxt/devalue": "^1.2.3",
    "@nuxt/devalue": "^1.2.3",
    "extract-css-chunks-webpack-plugin": "^4.3.1",
"@nuxt/devalue@^1.2.3":
  version "1.2.3"
  resolved "https://registry.npmjs.org/@nuxt/devalue/-/devalue-1.2.3.tgz#0a814d7e10519ffcb1a2a9930add831f91783092"
  integrity sha512-iA25xn409pguKhJwfNKQNCzWDZS44yhLcuVPpfy2CQ4xMqrJRpBxePTpkdCRxf7/m66M3rmCgkDZlvex4ygc6w==
eslint-module-utils@^2.4.0:
  version "2.4.0"
  resolved "https://registry.npmjs.org/eslint-module-utils/-/eslint-module-utils-2.4.0.tgz#8b93499e9b00eab80ccb6614e69f03678e84e09a"
  integrity sha512-14tltLm38Eu3zS+mt0KvILC3q8jyIAH518MlG+HO0p+yK885Lb1UHTY/UgR91eOyGdmxAPb+OLoW4znqIT6Ndw==
eslint-plugin-import@^2.17.1:
  version "2.17.1"
  resolved "https://registry.npmjs.org/eslint-plugin-import/-/eslint-plugin-import-2.17.1.tgz#b888feb4d9b3ee155113c8dccdd4bec5db33bdf4"
  integrity sha512-lzD9uvRvW4MsHzIOMJEDSb5MOV9LzgxRPBaovvOhJqzgxRHYfGy9QOrMuwHIh5ehKFJ7Z3DcrcGKDQ0IbP0EdQ==
    eslint-module-utils "^2.4.0"
extract-css-chunks-webpack-plugin@^4.3.1:
  version "4.3.1"
  resolved "https://registry.npmjs.org/extract-css-chunks-webpack-plugin/-/extract-css-chunks-webpack-plugin-4.3.1.tgz#da947a26062f985aa47aafffce1d3f56f923f9f2"
  integrity sha512-dSzNLh4UueMcJAA/L2CX+7l3ntpOnpvoDxD2gfHVsf8e1ZwOXI+r4QoFFNwCSblAR1MmK485VMqswpEtzW6wYQ==
ignore@^5.0.2:
ignore@^5.1.0:
  version "5.1.0"
  resolved "https://registry.npmjs.org/ignore/-/ignore-5.1.0.tgz#a949efb645e5d67fd78e46f470bee6b8c5d862f9"
  integrity sha512-dJEmMwloo0gq40chdtDmE4tMp67ZGwN7MFTgjNqWi2VHEi5Ya6JkuvPWasjcAIm7lg+2if8xxn5R199wspcplg==