Program: CWE-22
Project: CVE-2021-41151
Buggy source:
{
  "name": "@backstage/plugin-scaffolder-backend",
  "description": "The Backstage backend plugin that helps you create new things",
  "version": "0.15.8",
  "main": "src/index.ts",
  "types": "src/index.ts",
  "license": "Apache-2.0",
  "private": false,
  "publishConfig": {
    "access": "public",
    "main": "dist/index.cjs.js",
    "types": "dist/index.d.ts"
  },
  "homepage": "https://backstage.io",
  "repository": {
    "type": "git",
    "url": "https://github.com/backstage/backstage",
    "directory": "plugins/scaffolder-backend"
  },
  "keywords": [
    "backstage"
  ],
  "scripts": {
    "start": "backstage-cli backend:dev",
    "build": "backstage-cli backend:build",
    "lint": "backstage-cli lint",
    "test": "backstage-cli test",
    "prepack": "backstage-cli prepack",
    "postpack": "backstage-cli postpack",
    "clean": "backstage-cli clean"
  },
  "dependencies": {
    "@backstage/backend-common": "^0.9.6",
    "@backstage/catalog-client": "^0.5.0",
    "@backstage/catalog-model": "^0.9.4",
    "@backstage/config": "^0.1.10",
    "@backstage/errors": "^0.1.2",
    "@backstage/integration": "^0.6.8",
    "@backstage/plugin-catalog-backend": "^0.17.0",
    "@backstage/plugin-scaffolder-common": "^0.1.0",
    "@backstage/plugin-scaffolder-backend-module-cookiecutter": "^0.1.2",
    "@gitbeaker/core": "^30.2.0",
    "@gitbeaker/node": "^30.2.0",
    "@octokit/rest": "^18.5.3",
    "@octokit/webhooks": "^9.14.1",
    "@types/express": "^4.17.6",
    "azure-devops-node-api": "^11.0.1",
    "command-exists": "^1.2.9",
    "compression": "^1.7.4",
    "cors": "^2.8.5",
    "cross-fetch": "^3.0.6",
    "express": "^4.17.1",
    "express-promise-router": "^4.1.0",
    "fs-extra": "10.0.0",
    "git-url-parse": "^11.6.0",
    "globby": "^11.0.0",
    "handlebars": "^4.7.6",
    "helmet": "^4.0.0",
    "isbinaryfile": "^4.0.8",
    "isomorphic-git": "^1.8.0",
    "jsonschema": "^1.2.6",
    "knex": "^0.95.1",
    "lodash": "^4.17.21",
    "luxon": "^2.0.2",
    "morgan": "^1.10.0",
    "nunjucks": "^3.2.3",
    "octokit-plugin-create-pull-request": "^3.9.3",
    "uuid": "^8.2.0",
    "winston": "^3.2.1",
    "yaml": "^1.10.0"
  },
  "devDependencies": {
    "@backstage/cli": "^0.7.16",
    "@backstage/test-utils": "^0.1.19",
    "@types/command-exists": "^1.2.0",
    "@types/fs-extra": "^9.0.1",
    "@types/git-url-parse": "^9.0.0",
    "@types/mock-fs": "^4.13.0",
    "@types/nunjucks": "^3.1.4",
    "@types/supertest": "^2.0.8",
    "jest-when": "^3.1.0",
    "mock-fs": "^5.1.0",
    "msw": "^0.29.0",
    "supertest": "^6.1.3",
    "yaml": "^1.10.0"
  },
  "files": [
    "dist",
    "migrations",
    "config.d.ts"
  ],
  "configSchema": "config.d.ts"
}


Fixed version (ground truth):
{
  "name": "@backstage/plugin-scaffolder-backend",
  "description": "The Backstage backend plugin that helps you create new things",
  "version": "0.15.9",
  "main": "src/index.ts",
  "types": "src/index.ts",
  "license": "Apache-2.0",
  "private": false,
  "publishConfig": {
    "access": "public",
    "main": "dist/index.cjs.js",
    "types": "dist/index.d.ts"
  },
  "homepage": "https://backstage.io",
  "repository": {
    "type": "git",
    "url": "https://github.com/backstage/backstage",
    "directory": "plugins/scaffolder-backend"
  },
  "keywords": [
    "backstage"
  ],
  "scripts": {
    "start": "backstage-cli backend:dev",
    "build": "backstage-cli backend:build",
    "lint": "backstage-cli lint",
    "test": "backstage-cli test",
    "prepack": "backstage-cli prepack",
    "postpack": "backstage-cli postpack",
    "clean": "backstage-cli clean"
  },
  "dependencies": {
    "@backstage/backend-common": "^0.9.6",
    "@backstage/catalog-client": "^0.5.0",
    "@backstage/catalog-model": "^0.9.4",
    "@backstage/config": "^0.1.10",
    "@backstage/errors": "^0.1.2",
    "@backstage/integration": "^0.6.8",
    "@backstage/plugin-catalog-backend": "^0.17.0",
    "@backstage/plugin-scaffolder-common": "^0.1.0",
    "@backstage/plugin-scaffolder-backend-module-cookiecutter": "^0.1.2",
    "@gitbeaker/core": "^30.2.0",
    "@gitbeaker/node": "^30.2.0",
    "@octokit/rest": "^18.5.3",
    "@octokit/webhooks": "^9.14.1",
    "@types/express": "^4.17.6",
    "azure-devops-node-api": "^11.0.1",
    "command-exists": "^1.2.9",
    "compression": "^1.7.4",
    "cors": "^2.8.5",
    "cross-fetch": "^3.0.6",
    "express": "^4.17.1",
    "express-promise-router": "^4.1.0",
    "fs-extra": "10.0.0",
    "git-url-parse": "^11.6.0",
    "globby": "^11.0.0",
    "handlebars": "^4.7.6",
    "helmet": "^4.0.0",
    "isbinaryfile": "^4.0.8",
    "isomorphic-git": "^1.8.0",
    "jsonschema": "^1.2.6",
    "knex": "^0.95.1",
    "lodash": "^4.17.21",
    "luxon": "^2.0.2",
    "morgan": "^1.10.0",
    "nunjucks": "^3.2.3",
    "octokit-plugin-create-pull-request": "^3.9.3",
    "uuid": "^8.2.0",
    "winston": "^3.2.1",
    "yaml": "^1.10.0"
  },
  "devDependencies": {
    "@backstage/cli": "^0.7.16",
    "@backstage/test-utils": "^0.1.19",
    "@types/command-exists": "^1.2.0",
    "@types/fs-extra": "^9.0.1",
    "@types/git-url-parse": "^9.0.0",
    "@types/mock-fs": "^4.13.0",
    "@types/nunjucks": "^3.1.4",
    "@types/supertest": "^2.0.8",
    "jest-when": "^3.1.0",
    "mock-fs": "^5.1.0",
    "msw": "^0.29.0",
    "supertest": "^6.1.3",
    "yaml": "^1.10.0"
  },
  "files": [
    "dist",
    "migrations",
    "config.d.ts"
  ],
  "configSchema": "config.d.ts"
}