Coder Social home page Coder Social logo

sheilta's Introduction

Sheilta שְׁאִילְתָא

A collaborative Torah learning platform

Sheilta (https://sheilta.ml) is a new website with the aim of bringing the benefits of learning in a Beit Midrash to a virtual environment.

👉👉Please read this documentation before using the website

Background

In the past year, I've studied Torah in a Hesder Yeshiva (Maale Adumim), which is an institute that has a Beit Midrash with about two hundred students learning at any given time. It's very impressive, yet I haven't fully realized how fortunate I am to be learning in this atmosphere until March of this year when due to the COVID-19 epidemic, our Yeshiva closed down temporarily for a few months.

During the following months, we continued to learn regularly, over Zoom, or on the phone. However, my general feeling was that something was missing, and our learning wasn't as productive and enjoyable as before. The lack of a Beit Midrash meant that if my Chavruta and I had difficulty understanding a Gemara or a Parshan, we weren't able to ask other students for help, as we used to. Also, if we had a Chiddush (insight) or Kashya (challenging question) on the Sugya (Talmudic paragraph) we didn't have a way to share it with the rest of the students to get feedback.

Therefore, when I saw the announcement about the Sefaria API contest, I decided that my project would focus on bringing the benefits of the Yeshiva learning experience to people who are not able to have that experience themselves. Another goal of the project was to connect between the different Batei Midrash and Yeshivot to make their learning more collaborative so that it would be more productive.

Description of the project

The objective of Sheilta is to create a community of Torah learners that will be able to assist each other with their learning.

Users of the site can view Torah texts such as the Bible, Mishna, or Gemara (retrieved from the Sefaria API). If they have a question regarding the text, or a Kashya or Chiddush, they can post them to the site so other users can help them out or provide feedback.

The website design was inspired by Mi Yodea's UX (and other Stack Exchange websites like StackOverflow), except unlike Mi Yodea, where the questions aren't tied to a specific context, in Sheilta the questions/Kashyas/etc. have to be connected to a specific Torah text so that when other users will use Sheilta to learn that text, will see the entry and be able to respond to it.

For example, let's say I'm learning Gemara Masechet (tractate) Beitza Daf 4a, and struggling to understand the quoted Mishna which deals with the complicated laws of Teruma. Instead of giving up and moving on, I can post a question on Sheilta and explain what I'm finding difficult in the Sugya, and hopefully, someone else learning that Sugya will be able to answer my question.

Another scenario: two Chavrutot are learning a chapter of Yechezkel, and they stumble upon a word they've never seen before. After doing some research, they find a book that gives the word an original interpretation, which seems to explain the meaning of the whole Pasuk (verse). Instead of keeping that knowledge to themselves, they can post a reference to the book, so other people learning that chapter can gain a better understanding.

Of course, there can be many more use cases, and the usefulness of Sheilta will increase eventually, as its community will grow and there will be more content on the site.

Functionality

Clicking https://sheilta.ml will open Bereshit (Genesis) chapter 1 by default. In order to open a different text, click on the search icon in the navbar, and enter the source's reference (as of now, only English works. But later on Hebrew will also work. Additionally, the only types of references guaranteed to work at this point are Bible and Talmud Bavli.) with a space between the source name and the chapter or page - for example: "Shoftim 23", or "Bava Kama 103b". Click enter, and that will bring you to the appropriate page.

The webpage is split into two sections: the Torah text on the top, and the user input on the bottom, split into tabs based on the matching category. The available categories are questions, Kashyas, references, and Chiddushim.

Clicking on the globe icon in the navbar will toggle the language of the text (if the text is available in English).

Hovering over any line in the text will reveal two buttons, one to compose a new post regarding that line, and one to display all of the existing posts written on that line.

Clicking on any post title in the bottom section will reveal the complete thread and an option to reply.

In order to compose a new post or a reply, you will be prompted to enter your name, so that the post can be identified.

This is the functionality that's currently available, but of course, I'm constantly working on extending it and making the whole experience more user friendly.

Pages that already have content for purpose of the demo:

Note: There's a temporary issue with sending too many requests to the server at once, which leads to some posts not to be sent. If that happens, just wait a minute or two. To be fixed in the future...

Technology behind the site

Sheilta is written in Node.JS and React, and uses Javascript libraries such as Axios and Express. The Sefaria API is used in order to fetch the requested texts. The user posts system is powered by a Discourse server, which stores the posts based on the appropriate category and context, and the users who posted them. Sheilta makes requests to the discourse server to fetch the existing posts and to post new ones.

Name of the website

שאילתא is an Aramaic term which means a speech that the Amoraim and Geonim would give in front of their students. In modern Hebrew though, it is used in programming context as the translation of a query. Therefore I decided that the name is suitable, given that the project is a combination of Torah (especially from the Amoraim era...) and programming, like the term itself, and that its purpose is to answer "שאלות".

Things I want to improve in the future

  • Replace the local storage based identification with proper OAuth2 authentication (with social accounts login and SSO).
  • Develop a better way to navigate the website and let users select wanted texts instead of typing them.
  • Add support for other types of text other than Bavli and Tanach.
  • Add advanced features to the posts section, such as a voting system like Mi Yodea's, and more sorting options. Ultimately port all of Discourse's features directly to Sheilta.
  • Add full Hebrew support.
  • My plan is to eventually start a closed beta of Sheilta that will be used exclusively in my Yeshiva, and once the website will have enough user content I'll release it to the public, G-d willing.

Feedback

I'd love to hear feedback from users who are trying the website and I'm always happy to accept new ideas on how to improve it or extend its functionality. Additionally, if you are a developer and would like to contribute to the project, that would be awesome :)

Please email me at [email protected] or submit a pull request on Github.

sheilta's People

Contributors

akivamprager avatar mend-bolt-for-github[bot] avatar

Stargazers

 avatar

Watchers

 avatar  avatar

sheilta's Issues

CVE-2015-9251 (Medium) detected in jquery-1.7.2.min.js

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery.min.js

Path to dependency file: /tmp/ws-scm/sefaria-interactive-simple/public/fonts/hadasimclm-regular-demo.html

Path to vulnerable library: /sefaria-interactive-simple/public/fonts/hadasimclm-regular-demo.html

Dependency Hierarchy:

  • jquery-1.7.2.min.js (Vulnerable Library)

Found in HEAD commit: 3853f4fd0c7ce2cbd8aedd3e6902b3dff2919a9a

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0


Step up your Open Source Security Game with WhiteSource here

CVE-2020-11022 (Medium) detected in jquery-1.7.2.min.js

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery.min.js

Path to dependency file: /tmp/ws-scm/sefaria-interactive-simple/public/fonts/hadasimclm-regular-demo.html

Path to vulnerable library: /sefaria-interactive-simple/public/fonts/hadasimclm-regular-demo.html

Dependency Hierarchy:

  • jquery-1.7.2.min.js (Vulnerable Library)

Found in HEAD commit: 3853f4fd0c7ce2cbd8aedd3e6902b3dff2919a9a

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2012-6708 (Medium) detected in jquery-1.7.2.min.js

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery.min.js

Path to dependency file: /tmp/ws-scm/sefaria-interactive-simple/public/fonts/hadasimclm-regular-demo.html

Path to vulnerable library: /sefaria-interactive-simple/public/fonts/hadasimclm-regular-demo.html

Dependency Hierarchy:

  • jquery-1.7.2.min.js (Vulnerable Library)

Found in HEAD commit: 3853f4fd0c7ce2cbd8aedd3e6902b3dff2919a9a

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0


Step up your Open Source Security Game with WhiteSource here

CVE-2022-0122 (Medium) detected in node-forge-0.9.0.tgz

CVE-2022-0122 - Medium Severity Vulnerability

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • selfsigned-1.10.7.tgz
        • node-forge-0.9.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

forge is vulnerable to URL Redirection to Untrusted Site
Mend Note: Converted from WS-2022-0007, on 2022-11-07.

Publish Date: 2022-01-06

URL: CVE-2022-0122

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-06

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (react-scripts): 5.0.0


Step up your Open Source Security Game with Mend here

CVE-2022-38900 (High) detected in decode-uri-component-0.2.0.tgz

CVE-2022-38900 - High Severity Vulnerability

Vulnerable Library - decode-uri-component-0.2.0.tgz

A better decodeURIComponent

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decode-uri-component/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • resolve-url-loader-3.1.1.tgz
      • rework-1.0.1.tgz
        • css-2.2.4.tgz
          • source-map-resolve-0.5.3.tgz
            • decode-uri-component-0.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 012fb0f56d41ad53836448ed8ba2ed8aa89308e7

Found in base branch: master

Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w573-4hg7-7wgq

Release Date: 2022-11-28

Fix Resolution (decode-uri-component): 0.2.1

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2022-0536 (Medium) detected in follow-redirects-1.5.10.tgz

CVE-2022-0536 - Medium Severity Vulnerability

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • axios-0.19.2.tgz (Root Library)
    • follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution (follow-redirects): 1.14.8

Direct dependency fix Resolution (axios): 0.20.0-0


Step up your Open Source Security Game with Mend here

CVE-2020-15256 (Critical) detected in object-path-0.11.4.tgz

CVE-2020-15256 - Critical Severity Vulnerability

Vulnerable Library - object-path-0.11.4.tgz

Access deep object properties using a path

Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/object-path/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • resolve-url-loader-3.1.1.tgz
      • adjust-sourcemap-loader-2.0.0.tgz
        • object-path-0.11.4.tgz (Vulnerable Library)

Found in HEAD commit: 012fb0f56d41ad53836448ed8ba2ed8aa89308e7

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability has been found in object-path <= 0.11.4 affecting the set() method. The vulnerability is limited to the includeInheritedProps mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of set() in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the includeInheritedProps: true options or the withInheritedProps instance if using a version >= 0.11.0.

Publish Date: 2020-10-19

URL: CVE-2020-15256

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cwx2-736x-mf6w

Release Date: 2020-10-19

Fix Resolution (object-path): 0.11.5

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2022-0155 (Medium) detected in follow-redirects-1.5.10.tgz

CVE-2022-0155 - Medium Severity Vulnerability

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • axios-0.19.2.tgz (Root Library)
    • follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution (follow-redirects): 1.14.7

Direct dependency fix Resolution (axios): 0.20.0-0


Step up your Open Source Security Game with Mend here

CVE-2022-46175 (High) detected in json5-2.1.3.tgz, json5-1.0.1.tgz

CVE-2022-46175 - High Severity Vulnerability

Vulnerable Libraries - json5-2.1.3.tgz, json5-1.0.1.tgz

json5-2.1.3.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-2.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json5/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • core-7.9.0.tgz
      • json5-2.1.3.tgz (Vulnerable Library)
json5-1.0.1.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-1.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/react-dev-utils/node_modules/json5/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • resolve-url-loader-3.1.1.tgz
      • loader-utils-1.2.3.tgz
        • json5-1.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 012fb0f56d41ad53836448ed8ba2ed8aa89308e7

Found in base branch: master

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution (json5): 2.2.2

Direct dependency fix Resolution (react-scripts): 3.4.4

Fix Resolution (json5): 2.2.2

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2021-23434 (High) detected in object-path-0.11.4.tgz

CVE-2021-23434 - High Severity Vulnerability

Vulnerable Library - object-path-0.11.4.tgz

Access deep object properties using a path

Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/object-path/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • resolve-url-loader-3.1.1.tgz
      • adjust-sourcemap-loader-2.0.0.tgz
        • object-path-0.11.4.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === 'proto' returns false if currentPath is ['proto']. This is because the === operator returns always false when the type of the operands is different.

Publish Date: 2021-08-27

URL: CVE-2021-23434

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23434

Release Date: 2021-08-27

Fix Resolution (object-path): 0.11.6

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2022-37603 (High) detected in loader-utils-1.2.3.tgz, loader-utils-1.4.0.tgz

CVE-2022-37603 - High Severity Vulnerability

Vulnerable Libraries - loader-utils-1.2.3.tgz, loader-utils-1.4.0.tgz

loader-utils-1.2.3.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/react-dev-utils/node_modules/loader-utils/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • resolve-url-loader-3.1.1.tgz
      • loader-utils-1.2.3.tgz (Vulnerable Library)
loader-utils-1.4.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-4.3.3.tgz
      • loader-utils-1.4.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Publish Date: 2022-10-14

URL: CVE-2022-37603

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3rfm-jhwj-7488

Release Date: 2022-10-14

Fix Resolution (loader-utils): 1.4.2

Direct dependency fix Resolution (react-scripts): 4.0.0

Fix Resolution (loader-utils): 1.4.2

Direct dependency fix Resolution (react-scripts): 4.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-3664 (Medium) detected in url-parse-1.4.7.tgz

CVE-2021-3664 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • sockjs-client-1.4.0.tgz
        • url-parse-1.4.7.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

url-parse is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2021-07-26

URL: CVE-2021-3664

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3664

Release Date: 2021-07-26

Fix Resolution (url-parse): 1.5.2

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2021-27515 (Medium) detected in url-parse-1.4.7.tgz

CVE-2021-27515 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • sockjs-client-1.4.0.tgz
        • url-parse-1.4.7.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

url-parse before 1.5.0 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path.

Publish Date: 2021-02-22

URL: CVE-2021-27515

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27515

Release Date: 2021-02-22

Fix Resolution (url-parse): 1.5.0

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2023-2251 (High) detected in yaml-1.10.0.tgz - autoclosed

CVE-2023-2251 - High Severity Vulnerability

Vulnerable Library - yaml-1.10.0.tgz

JavaScript parser and stringifier for YAML

Library home page: https://registry.npmjs.org/yaml/-/yaml-1.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/yaml/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • babel-preset-react-app-9.1.2.tgz
      • babel-plugin-macros-2.8.0.tgz
        • cosmiconfig-6.0.0.tgz
          • yaml-1.10.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Uncaught Exception in GitHub repository eemeli/yaml prior to 2.2.2.

Publish Date: 2023-04-24

URL: CVE-2023-2251

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f9xv-q969-pqx4

Release Date: 2023-04-24

Fix Resolution: yaml - 2.2.2


Step up your Open Source Security Game with Mend here

WS-2020-0042 (High) detected in acorn-5.7.4.tgz - autoclosed

WS-2020-0042 - High Severity Vulnerability

Vulnerable Library - acorn-5.7.4.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-5.7.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsdom/node_modules/acorn/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • jest-24.9.0.tgz
      • jest-cli-24.9.0.tgz
        • jest-config-24.9.0.tgz
          • jest-environment-jsdom-24.9.0.tgz
            • jsdom-11.12.0.tgz
              • acorn-5.7.4.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

acorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.

Publish Date: 2020-03-01

URL: WS-2020-0042

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1488

Release Date: 2020-03-01

Fix Resolution (acorn): 6.4.1

Direct dependency fix Resolution (react-scripts): 4.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-7789 (Medium) detected in node-notifier-5.4.3.tgz

CVE-2020-7789 - Medium Severity Vulnerability

Vulnerable Library - node-notifier-5.4.3.tgz

A Node.js module for sending notifications on native Mac, Windows (post and pre 8) and Linux (or Growl as fallback)

Library home page: https://registry.npmjs.org/node-notifier/-/node-notifier-5.4.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-notifier/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • jest-24.9.0.tgz
      • jest-cli-24.9.0.tgz
        • core-24.9.0.tgz
          • reporters-24.9.0.tgz
            • node-notifier-5.4.3.tgz (Vulnerable Library)

Found in HEAD commit: 012fb0f56d41ad53836448ed8ba2ed8aa89308e7

Found in base branch: master

Vulnerability Details

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Publish Date: 2020-12-11

URL: CVE-2020-7789

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1906853

Release Date: 2020-12-11

Fix Resolution (node-notifier): 5.4.4

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2021-24033 (Medium) detected in react-dev-utils-10.2.1.tgz

CVE-2021-24033 - Medium Severity Vulnerability

Vulnerable Library - react-dev-utils-10.2.1.tgz

webpack utilities used by Create React App

Library home page: https://registry.npmjs.org/react-dev-utils/-/react-dev-utils-10.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/react-dev-utils/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • react-dev-utils-10.2.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.

Publish Date: 2021-03-09

URL: CVE-2021-24033

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.facebook.com/security/advisories/cve-2021-24033

Release Date: 2021-03-09

Fix Resolution (react-dev-utils): 11.0.4

Direct dependency fix Resolution (react-scripts): 4.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-7788 (Critical) detected in ini-1.3.5.tgz

CVE-2020-7788 - Critical Severity Vulnerability

Vulnerable Library - ini-1.3.5.tgz

An ini encoder/decoder for node

Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ini/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • react-dev-utils-10.2.1.tgz
      • global-modules-2.0.0.tgz
        • global-prefix-3.0.0.tgz
          • ini-1.3.5.tgz (Vulnerable Library)

Found in HEAD commit: 012fb0f56d41ad53836448ed8ba2ed8aa89308e7

Found in base branch: master

Vulnerability Details

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Publish Date: 2020-12-11

URL: CVE-2020-7788

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788

Release Date: 2020-12-11

Fix Resolution (ini): 1.3.6

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2021-43138 (High) detected in async-2.6.3.tgz

CVE-2021-43138 - High Severity Vulnerability

Vulnerable Library - async-2.6.3.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/package.json

Dependency Hierarchy:

  • gh-pages-3.1.0.tgz (Root Library)
    • async-2.6.3.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (gh-pages): 3.2.0


Step up your Open Source Security Game with Mend here

CVE-2022-24773 (Medium) detected in node-forge-0.9.0.tgz

CVE-2022-24773 - Medium Severity Vulnerability

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • selfsigned-1.10.7.tgz
        • node-forge-0.9.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24773

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (react-scripts): 5.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-33502 (High) detected in normalize-url-1.9.1.tgz, normalize-url-3.3.0.tgz

CVE-2021-33502 - High Severity Vulnerability

Vulnerable Libraries - normalize-url-1.9.1.tgz, normalize-url-3.3.0.tgz

normalize-url-1.9.1.tgz

Normalize a URL

Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-1.9.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/normalize-url/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • mini-css-extract-plugin-0.9.0.tgz
      • normalize-url-1.9.1.tgz (Vulnerable Library)
normalize-url-3.3.0.tgz

Normalize a URL

Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-3.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/postcss-normalize-url/node_modules/normalize-url/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • optimize-css-assets-webpack-plugin-5.0.3.tgz
      • cssnano-4.1.10.tgz
        • cssnano-preset-default-4.0.7.tgz
          • postcss-normalize-url-4.0.1.tgz
            • normalize-url-3.3.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Publish Date: 2021-05-24

URL: CVE-2021-33502

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502

Release Date: 2021-05-24

Fix Resolution: normalize-url - 4.5.1,5.3.1,6.0.1


Step up your Open Source Security Game with Mend here

CVE-2022-24772 (High) detected in node-forge-0.9.0.tgz

CVE-2022-24772 - High Severity Vulnerability

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • selfsigned-1.10.7.tgz
        • node-forge-0.9.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24772

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (react-scripts): 5.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-3805 (High) detected in object-path-0.11.4.tgz

CVE-2021-3805 - High Severity Vulnerability

Vulnerable Library - object-path-0.11.4.tgz

Access deep object properties using a path

Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/object-path/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • resolve-url-loader-3.1.1.tgz
      • adjust-sourcemap-loader-2.0.0.tgz
        • object-path-0.11.4.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-09-17

URL: CVE-2021-3805

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/571e3baf-7c46-46e3-9003-ba7e4e623053/

Release Date: 2021-09-17

Fix Resolution (object-path): 0.11.8

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2022-1650 (Critical) detected in eventsource-1.0.7.tgz

CVE-2022-1650 - Critical Severity Vulnerability

Vulnerable Library - eventsource-1.0.7.tgz

W3C compliant EventSource client for Node.js and browser (polyfill)

Library home page: https://registry.npmjs.org/eventsource/-/eventsource-1.0.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/eventsource/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • sockjs-client-1.4.0.tgz
        • eventsource-1.0.7.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.

Publish Date: 2022-05-12

URL: CVE-2022-1650

CVSS 3 Score Details (9.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-05-12

Fix Resolution (eventsource): 1.1.1

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2020-7720 (High) detected in node-forge-0.9.0.tgz

CVE-2020-7720 - High Severity Vulnerability

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • selfsigned-1.10.7.tgz
        • node-forge-0.9.0.tgz (Vulnerable Library)

Found in HEAD commit: 012fb0f56d41ad53836448ed8ba2ed8aa89308e7

Found in base branch: master

Vulnerability Details

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

Publish Date: 2020-09-01

URL: CVE-2020-7720

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-09-01

Fix Resolution (node-forge): 0.10.0

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2020-28168 (Medium) detected in axios-0.19.2.tgz

CVE-2020-28168 - Medium Severity Vulnerability

Vulnerable Library - axios-0.19.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

  • axios-0.19.2.tgz (Vulnerable Library)

Found in HEAD commit: 012fb0f56d41ad53836448ed8ba2ed8aa89308e7

Found in base branch: master

Vulnerability Details

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Publish Date: 2020-11-06

URL: CVE-2020-28168

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-11-06

Fix Resolution: 0.21.1


Step up your Open Source Security Game with Mend here

CVE-2021-23440 (High) detected in set-value-2.0.1.tgz - autoclosed

CVE-2021-23440 - High Severity Vulnerability

Vulnerable Library - set-value-2.0.1.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/set-value/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-4.42.0.tgz
      • micromatch-3.1.10.tgz
        • snapdragon-0.8.2.tgz
          • base-0.11.2.tgz
            • cache-base-1.0.1.tgz
              • set-value-2.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 012fb0f56d41ad53836448ed8ba2ed8aa89308e7

Found in base branch: master

Vulnerability Details

This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
Mend Note: After conducting further research, Mend has determined that all versions of set-value up to version 4.0.0 are vulnerable to CVE-2021-23440.

Publish Date: 2021-09-12

URL: CVE-2021-23440

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-12

Fix Resolution (set-value): 4.0.1

Direct dependency fix Resolution (react-scripts): 5.0.0


Step up your Open Source Security Game with Mend here

CVE-2022-21680 (High) detected in marked-1.1.1.tgz

CVE-2022-21680 - High Severity Vulnerability

Vulnerable Library - marked-1.1.1.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-1.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/marked/package.json

Dependency Hierarchy:

  • marked-1.1.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression block.def may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

Publish Date: 2022-01-14

URL: CVE-2022-21680

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rrrm-qjm4-v8hf

Release Date: 2022-01-14

Fix Resolution: 4.0.10


Step up your Open Source Security Game with Mend here

WS-2022-0008 (Medium) detected in node-forge-0.9.0.tgz

WS-2022-0008 - Medium Severity Vulnerability

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • selfsigned-1.10.7.tgz
        • node-forge-0.9.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Publish Date: 2022-01-08

URL: WS-2022-0008

CVSS 3 Score Details (6.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5rrq-pxf6-6jx5

Release Date: 2022-01-08

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (react-scripts): 5.0.0


Step up your Open Source Security Game with Mend here

CVE-2022-24771 (High) detected in node-forge-0.9.0.tgz

CVE-2022-24771 - High Severity Vulnerability

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • selfsigned-1.10.7.tgz
        • node-forge-0.9.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24771

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (react-scripts): 5.0.0


Step up your Open Source Security Game with Mend here

CVE-2022-37601 (Critical) detected in loader-utils-1.2.3.tgz, loader-utils-1.4.0.tgz

CVE-2022-37601 - Critical Severity Vulnerability

Vulnerable Libraries - loader-utils-1.2.3.tgz, loader-utils-1.4.0.tgz

loader-utils-1.2.3.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/react-dev-utils/node_modules/loader-utils/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • resolve-url-loader-3.1.1.tgz
      • loader-utils-1.2.3.tgz (Vulnerable Library)
loader-utils-1.4.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-4.3.3.tgz
      • loader-utils-1.4.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

Publish Date: 2022-10-12

URL: CVE-2022-37601

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-76p3-8jx3-jpfq

Release Date: 2022-10-12

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (react-scripts): 4.0.0

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (react-scripts): 4.0.0


Step up your Open Source Security Game with Mend here

CVE-2022-21681 (High) detected in marked-1.1.1.tgz

CVE-2022-21681 - High Severity Vulnerability

Vulnerable Library - marked-1.1.1.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-1.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/marked/package.json

Dependency Hierarchy:

  • marked-1.1.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

Publish Date: 2022-01-14

URL: CVE-2022-21681

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5v2h-r2cx-5xgj

Release Date: 2022-01-14

Fix Resolution: 4.0.10


Step up your Open Source Security Game with Mend here

CVE-2022-25858 (High) detected in terser-4.8.0.tgz

CVE-2022-25858 - High Severity Vulnerability

Vulnerable Library - terser-4.8.0.tgz

JavaScript parser, mangler/compressor and beautifier toolkit for ES6+

Library home page: https://registry.npmjs.org/terser/-/terser-4.8.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/terser/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • terser-webpack-plugin-2.3.8.tgz
      • terser-4.8.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

Publish Date: 2022-07-15

URL: CVE-2022-25858

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25858

Release Date: 2022-07-15

Fix Resolution (terser): 4.8.1

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2021-42740 (Critical) detected in shell-quote-1.7.2.tgz

CVE-2021-42740 - Critical Severity Vulnerability

Vulnerable Library - shell-quote-1.7.2.tgz

quote and parse shell commands

Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.7.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/shell-quote/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • react-dev-utils-10.2.1.tgz
      • shell-quote-1.7.2.tgz (Vulnerable Library)

Found in HEAD commit: 012fb0f56d41ad53836448ed8ba2ed8aa89308e7

Found in base branch: master

Vulnerability Details

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

Publish Date: 2021-10-21

URL: CVE-2021-42740

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740

Release Date: 2021-10-21

Fix Resolution (shell-quote): 1.7.3

Direct dependency fix Resolution (react-scripts): 5.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-7774 (Critical) detected in y18n-4.0.0.tgz

CVE-2020-7774 - Critical Severity Vulnerability

Vulnerable Library - y18n-4.0.0.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/y18n/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • yargs-13.3.2.tgz
        • y18n-4.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 012fb0f56d41ad53836448ed8ba2ed8aa89308e7

Found in base branch: master

Vulnerability Details

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1654

Release Date: 2020-11-17

Fix Resolution (y18n): 4.0.1

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2022-0691 (Critical) detected in url-parse-1.4.7.tgz

CVE-2022-0691 - Critical Severity Vulnerability

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • sockjs-client-1.4.0.tgz
        • url-parse-1.4.7.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

Publish Date: 2022-02-21

URL: CVE-2022-0691

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691

Release Date: 2022-02-21

Fix Resolution (url-parse): 1.5.9

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2022-37611 (Critical) detected in gh-pages-3.1.0.tgz

CVE-2022-37611 - Critical Severity Vulnerability

Vulnerable Library - gh-pages-3.1.0.tgz

Publish to a gh-pages branch on GitHub (or any other branch on any other remote)

Library home page: https://registry.npmjs.org/gh-pages/-/gh-pages-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/gh-pages/package.json

Dependency Hierarchy:

  • gh-pages-3.1.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js.

Publish Date: 2022-10-12

URL: CVE-2022-37611

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-12

Fix Resolution: 5.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-28469 (High) detected in glob-parent-3.1.0.tgz, glob-parent-5.1.1.tgz

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Libraries - glob-parent-3.1.0.tgz, glob-parent-5.1.1.tgz

glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/watchpack-chokidar2/node_modules/glob-parent/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • chokidar-2.1.8.tgz
        • glob-parent-3.1.0.tgz (Vulnerable Library)
glob-parent-5.1.1.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • eslint-6.8.0.tgz
      • glob-parent-5.1.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution (glob-parent): 5.1.2

Direct dependency fix Resolution (react-scripts): 5.0.0

Fix Resolution (glob-parent): 5.1.2

Direct dependency fix Resolution (react-scripts): 5.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-3749 (High) detected in axios-0.19.2.tgz

CVE-2021-3749 - High Severity Vulnerability

Vulnerable Library - axios-0.19.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

  • axios-0.19.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

axios is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-08-31

URL: CVE-2021-3749

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31/

Release Date: 2021-08-31

Fix Resolution: 0.20.0


Step up your Open Source Security Game with Mend here

CVE-2021-35065 (High) detected in glob-parent-3.1.0.tgz, glob-parent-5.1.1.tgz - autoclosed

CVE-2021-35065 - High Severity Vulnerability

Vulnerable Libraries - glob-parent-3.1.0.tgz, glob-parent-5.1.1.tgz

glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/watchpack-chokidar2/node_modules/glob-parent/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • chokidar-2.1.8.tgz
        • glob-parent-3.1.0.tgz (Vulnerable Library)
glob-parent-5.1.1.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • eslint-6.8.0.tgz
      • glob-parent-5.1.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package glob-parent before 6.0.1 are vulnerable to Regular Expression Denial of Service (ReDoS)

Publish Date: 2021-06-22

URL: CVE-2021-35065

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cj88-88mr-972w

Release Date: 2021-06-22

Fix Resolution (glob-parent): 6.0.1

Direct dependency fix Resolution (react-scripts): 5.0.1

Fix Resolution (glob-parent): 6.0.1

Direct dependency fix Resolution (react-scripts): 5.0.1


Step up your Open Source Security Game with Mend here

CVE-2020-11023 (Medium) detected in jquery-1.7.2.min.js

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery.min.js

Path to dependency file: /tmp/ws-scm/sefaria-interactive-simple/public/fonts/hadasimclm-regular-demo.html

Path to vulnerable library: /sefaria-interactive-simple/public/fonts/hadasimclm-regular-demo.html

Dependency Hierarchy:

  • jquery-1.7.2.min.js (Vulnerable Library)

Found in HEAD commit: 3853f4fd0c7ce2cbd8aedd3e6902b3dff2919a9a

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2022-0512 (Medium) detected in url-parse-1.4.7.tgz

CVE-2022-0512 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • sockjs-client-1.4.0.tgz
        • url-parse-1.4.7.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

Publish Date: 2022-02-14

URL: CVE-2022-0512

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0512

Release Date: 2022-02-14

Fix Resolution (url-parse): 1.5.6

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2021-23364 (Medium) detected in browserslist-4.14.0.tgz, browserslist-4.10.0.tgz

CVE-2021-23364 - Medium Severity Vulnerability

Vulnerable Libraries - browserslist-4.14.0.tgz, browserslist-4.10.0.tgz

browserslist-4.14.0.tgz

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.14.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/browserslist/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • postcss-normalize-8.0.1.tgz
      • browserslist-4.14.0.tgz (Vulnerable Library)
browserslist-4.10.0.tgz

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/react-dev-utils/node_modules/browserslist/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • react-dev-utils-10.2.1.tgz
      • browserslist-4.10.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Publish Date: 2021-04-28

URL: CVE-2021-23364

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364

Release Date: 2021-04-28

Fix Resolution (browserslist): 4.16.5

Direct dependency fix Resolution (react-scripts): 5.0.0

Fix Resolution (browserslist): 4.16.5

Direct dependency fix Resolution (react-scripts): 5.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-7656 (Medium) detected in jquery-1.7.2.min.js

CVE-2020-7656 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery.min.js

Path to dependency file: /tmp/ws-scm/sefaria-interactive-simple/public/fonts/hadasimclm-regular-demo.html

Path to vulnerable library: /sefaria-interactive-simple/public/fonts/hadasimclm-regular-demo.html

Dependency Hierarchy:

  • jquery-1.7.2.min.js (Vulnerable Library)

Found in HEAD commit: 3853f4fd0c7ce2cbd8aedd3e6902b3dff2919a9a

Vulnerability Details

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Publish Date: 2020-05-19

URL: CVE-2020-7656

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: rails/jquery-rails@8f601cb

Release Date: 2020-05-19

Fix Resolution: jquery-rails - 2.2.0


Step up your Open Source Security Game with WhiteSource here

CVE-2021-26707 (Critical) detected in merge-deep-3.0.2.tgz

CVE-2021-26707 - Critical Severity Vulnerability

Vulnerable Library - merge-deep-3.0.2.tgz

Recursively merge values in a javascript object.

Library home page: https://registry.npmjs.org/merge-deep/-/merge-deep-3.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/merge-deep/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-4.3.3.tgz
      • plugin-svgo-4.3.1.tgz
        • merge-deep-3.0.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.

Publish Date: 2021-06-02

URL: CVE-2021-26707

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1922259

Release Date: 2021-06-02

Fix Resolution (merge-deep): 3.0.3

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2022-0639 (Medium) detected in url-parse-1.4.7.tgz

CVE-2022-0639 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • sockjs-client-1.4.0.tgz
        • url-parse-1.4.7.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.

Publish Date: 2022-02-17

URL: CVE-2022-0639

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0639

Release Date: 2022-02-17

Fix Resolution (url-parse): 1.5.7

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2022-37599 (Medium) detected in loader-utils-1.2.3.tgz, loader-utils-1.4.0.tgz - autoclosed

CVE-2022-37599 - Medium Severity Vulnerability

Vulnerable Libraries - loader-utils-1.2.3.tgz, loader-utils-1.4.0.tgz

loader-utils-1.2.3.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/react-dev-utils/node_modules/loader-utils/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • resolve-url-loader-3.1.1.tgz
      • loader-utils-1.2.3.tgz (Vulnerable Library)
loader-utils-1.4.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-4.3.3.tgz
      • loader-utils-1.4.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.

Publish Date: 2022-10-11

URL: CVE-2022-37599

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with Mend here

CVE-2022-0686 (Critical) detected in url-parse-1.4.7.tgz

CVE-2022-0686 - Critical Severity Vulnerability

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • webpack-dev-server-3.11.0.tgz
      • sockjs-client-1.4.0.tgz
        • url-parse-1.4.7.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

Publish Date: 2022-02-20

URL: CVE-2022-0686

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686

Release Date: 2022-02-20

Fix Resolution (url-parse): 1.5.8

Direct dependency fix Resolution (react-scripts): 3.4.4


Step up your Open Source Security Game with Mend here

CVE-2023-28155 (Medium) detected in request-2.88.2.tgz

CVE-2023-28155 - Medium Severity Vulnerability

Vulnerable Library - request-2.88.2.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • jest-environment-jsdom-fourteen-1.0.1.tgz
      • jsdom-14.1.0.tgz
        • request-2.88.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).NOTE: The request package is no longer supported by the maintainer.

Publish Date: 2023-03-16

URL: CVE-2023-28155

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p8p7-x288-28g6

Release Date: 2023-03-16

Fix Resolution: @cypress/request - 3.0.0


Step up your Open Source Security Game with Mend here

CVE-2022-3517 (High) detected in minimatch-3.0.4.tgz

CVE-2022-3517 - High Severity Vulnerability

Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimatch/package.json

Dependency Hierarchy:

  • react-scripts-3.4.3.tgz (Root Library)
    • eslint-6.8.0.tgz
      • minimatch-3.0.4.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5


Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.