Program: CWE-79
Project: CVE-2022-2932
Buggy source:
{
  "name": "mobiledoc-kit",
  "version": "0.14.1",
  "description": "A toolkit for building WYSIWYG editors with Mobiledoc",
  "repository": "https://github.com/bustle/mobiledoc-kit",
  "module": "dist/mobiledoc.js",
  "main": "dist/mobiledoc.cjs",
  "exports": {
    "import": "./dist/mobiledoc.js",
    "require": "./dist/mobiledoc.cjs"
  },
  "scripts": {
    "start": "rollup -c --watch",
    "test:ci": "npm run build:docs && npm run build && testem ci -f testem-ci.js",
    "test": "npm run format && npm run build && testem ci -f testem.js",
    "lint": "prettier src/**/*.{js,ts} --check && eslint src/**/*.{js,ts}",
    "format": "prettier src --write",
    "build": "rollup -c",
    "build:docs": "jsdoc -c ./.jsdoc",
    "build:website": "npm run build:docs && npm run build && ./bin/build-website.sh",
    "deploy:website": "./bin/deploy-website.sh",
    "update-changelog": "conventional-changelog -i CHANGELOG.md -r 0 -s",
    "version": "npm run update-changelog && git add CHANGELOG.md",
    "prepublishOnly": "npm run build"
  },
  "keywords": [
    "html",
    "json",
    "wysiwyg",
    "editor",
    "contenteditable"
  ],
  "files": [
    "dist/mobiledoc.js",
    "dist/mobiledoc.cjs",
    "dist/mobiledoc.css"
  ],
  "author": "Garth Poitras <garth22@gmail.com> (http://garthpoitras.com/)",
  "contributors": [
    "Zahra Jabini <zahra.arch@gmail.com> (http://zahraism.com/)",
    "Tom Dale <tom@tomdale.net> (https://tomdale.net)",
    "Cory Forsyth <cory.forsyth@gmail.com> (http://coryforsyth.com/)",
    "Matthew Beale <matt.beale@madhatted.com> (http://madhatted.com/)"
  ],
  "license": "MIT",
  "dependencies": {
    "mobiledoc-dom-renderer": "0.7.1",
    "mobiledoc-text-renderer": "0.4.1"
  },
  "devDependencies": {
    "@rollup/plugin-alias": "^3.1.9",
    "@rollup/plugin-commonjs": "^15.0.0",
    "@rollup/plugin-node-resolve": "^9.0.0",
    "@rollup/plugin-typescript": "^5.0.2",
    "@types/jquery": "^3.5.14",
    "@types/qunit": "^2.19.2",
    "@typescript-eslint/eslint-plugin": "^3.6.1",
    "@typescript-eslint/parser": "^3.6.1",
    "conventional-changelog-cli": "^2.2.2",
    "eslint": "^7.4.0",
    "eslint-config-prettier": "^6.11.0",
    "jquery": "^3.6.0",
    "jsdoc": "^3.6.5",
    "prettier": "^2.7.1",
    "qunit": "^2.19.1",
    "rollup": "^2.77.3",
    "rollup-plugin-copy": "^3.4.0",
    "rollup-plugin-glob-import": "^0.4.5",
    "rollup-plugin-serve": "^1.0.4",
    "saucie": "^3.3.3",
    "testem": "^3.2.0",
    "tslib": "^2.4.0",
    "typescript": "^3.9.3"
  },
  "prettier": {
    "arrowParens": "avoid",
    "printWidth": 120,
    "semi": false,
    "singleQuote": true
  },
  "volta": {
    "node": "12.14.1",
    "yarn": "1.22.4"
  }
}


Fixed version (ground truth):
{
  "name": "mobiledoc-kit",
  "version": "0.14.1",
  "description": "A toolkit for building WYSIWYG editors with Mobiledoc",
  "repository": "https://github.com/bustle/mobiledoc-kit",
  "module": "dist/mobiledoc.js",
  "main": "dist/mobiledoc.cjs",
  "exports": {
    "import": "./dist/mobiledoc.js",
    "require": "./dist/mobiledoc.cjs"
  },
  "scripts": {
    "start": "rollup -c --watch",
    "test:ci": "npm run build:docs && npm run build && testem ci -f testem-ci.js",
    "test": "npm run format && npm run build && testem ci -f testem.js",
    "lint": "prettier src/**/*.{js,ts} --check && eslint src/**/*.{js,ts}",
    "format": "prettier src --write",
    "build": "rollup -c",
    "build:docs": "jsdoc -c ./.jsdoc",
    "build:website": "npm run build:docs && npm run build && ./bin/build-website.sh",
    "deploy:website": "./bin/deploy-website.sh",
    "update-changelog": "conventional-changelog -i CHANGELOG.md -r 0 -s",
    "version": "npm run update-changelog && git add CHANGELOG.md",
    "prepublishOnly": "npm run build"
  },
  "keywords": [
    "html",
    "json",
    "wysiwyg",
    "editor",
    "contenteditable"
  ],
  "files": [
    "dist/mobiledoc.js",
    "dist/mobiledoc.cjs",
    "dist/mobiledoc.css"
  ],
  "author": "Garth Poitras <garth22@gmail.com> (https://www.garthpoitras.com)",
  "contributors": [
    "Zahra Jabini <zahra.arch@gmail.com> (http://zahraism.com/)",
    "Tom Dale <tom@tomdale.net> (https://tomdale.net)",
    "Cory Forsyth <cory.forsyth@gmail.com> (http://coryforsyth.com/)",
    "Matthew Beale <matt.beale@madhatted.com> (http://madhatted.com/)"
  ],
  "license": "MIT",
  "dependencies": {
    "mobiledoc-dom-renderer": "0.7.2",
    "mobiledoc-text-renderer": "0.4.1"
  },
  "devDependencies": {
    "@rollup/plugin-alias": "^3.1.9",
    "@rollup/plugin-commonjs": "^22.0.2",
    "@rollup/plugin-node-resolve": "^13.3.0",
    "@rollup/plugin-typescript": "^8.3.4",
    "@types/jquery": "^3.5.14",
    "@types/qunit": "^2.19.2",
    "@typescript-eslint/eslint-plugin": "^5.33.1",
    "@typescript-eslint/parser": "^5.33.1",
    "conventional-changelog-cli": "^2.2.2",
    "eslint": "^8.22.0",
    "eslint-config-prettier": "^8.5.0",
    "jquery": "^3.6.0",
    "jsdoc": "^3.6.5",
    "prettier": "^2.7.1",
    "qunit": "^2.19.1",
    "rollup": "^2.78.0",
    "rollup-plugin-copy": "^3.4.0",
    "rollup-plugin-glob-import": "^0.5.0",
    "rollup-plugin-serve": "^2.0.1",
    "saucie": "^3.3.3",
    "testem": "^3.2.0",
    "tslib": "^2.4.0",
    "typescript": "^3.9.3"
  },
  "prettier": {
    "arrowParens": "avoid",
    "printWidth": 120,
    "semi": false,
    "singleQuote": true
  },
  "volta": {
    "node": "12.14.1",
    "yarn": "1.22.4"
  }
}