de7ign / automata

Web Application to play with finite state machines and run algorithms on top of the finite state machines

Automata

Automata playground is a web application built for playing and interacting with state machines with complete hackability and visualization of state machines algorithms.

TOC

• About
• Installation
• Contribute
• Code of Conduct
• License
• Contact

About

Automata playground aims to simulate the creation of finite state machines and interact with the FSM with various algorithms.

It's still in early stage, lot of basic and core functionality is still incomplete, basic UI/UX is complete although. It has some quirks and many parts are not yet available.

However feel free to visit the playground and if you want to start a discussion, report bugs or propose a awesome feature, you're welcome to open a issue

My future view of this project is :

• User can draw finite state machines and import and export in various formats (dot, json, svg, jpg, latex)
• User can use automata algorithms over the finite state model.
• This will help students to understand better through visualization and faculties can use this to avoid wasting time in drawing and going step-by-step explanation. The application will handle most of it.

---

Installation

If you want to take a tour of the web application, application is deployed for you in the playground

if you still want to run this project locally clone this repo on your local machine and run

$ cd cloned-repo/
$ npm install   // It will install all the dependencies
$ npm start     // It will launch the application on `http://localhost:3000`

If you're interested in contributing to this project please read the contribute section

---

Contribute

Please read CONTRIBUTING.md for details on how to contribute, and the process for submitting pull requests to us.

---

Code of Conduct

Please read CODE_OF_CONDUCT.md for details on our code of conduct and all contributors must adhere to code-of-conduct.

---

License

This project is licensed under the MIT License - see the LICENSE.md file for details

---

Contact

created and maintained by @nihalmurmu - feel free to contact me!

automata's Issues

WS-2016-0075 (Medium) detected in moment-2.8.4.min.js

WS-2016-0075 - Medium Severity Vulnerability

Vulnerable Library - moment-2.8.4.min.js

Parse, validate, manipulate, and display dates

Library home page: https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.8.4/moment.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/graph2d/08_performance.html

Path to vulnerable library: /automata/node_modules/vis/examples/graph2d/08_performance.html,/automata/node_modules/vis/examples/timeline/other/stressPerformance.html

Dependency Hierarchy:

• ❌ moment-2.8.4.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

Regular expression denial of service vulnerability in the moment package, by using a specific 40 characters long string in the "format" method.

Publish Date: 2016-10-24

URL: WS-2016-0075

CVSS 2 Score Details (5.8)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: moment/moment@663f33e

Release Date: 2016-10-24

Fix Resolution: Replace or update the following files: month.js, lt.js

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7608 (Medium) detected in yargs-parser-11.1.1.tgz

CVE-2020-7608 - Medium Severity Vulnerability

Vulnerable Library - yargs-parser-11.1.1.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-11.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/webpack-dev-server/node_modules/yargs-parser/package.json

Dependency Hierarchy:

• react-scripts-3.4.1.tgz (Root Library)
  • webpack-dev-server-3.10.3.tgz
    • yargs-12.0.5.tgz
      • ❌ yargs-parser-11.1.1.tgz (Vulnerable Library)

Found in HEAD commit: f2914f83cd996d2b801c1a010b27ca164213c783

Found in base branch: develop

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-16

Fix Resolution (yargs-parser): 13.1.2

Direct dependency fix Resolution (react-scripts): 3.4.2

---

Step up your Open Source Security Game with Mend here

WS-2019-0019 Medium Severity Vulnerability detected by WhiteSource

WS-2019-0019 - Medium Severity Vulnerability

Vulnerable Library - braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.

Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz

Path to dependency file: /Automata/package.json

Path to vulnerable library: /tmp/git/Automata/node_modules/braces/package.json

Dependency Hierarchy:

• react-scripts-2.1.8.tgz (Root Library)
  • jest-23.6.0.tgz
    • jest-cli-23.6.0.tgz
      • micromatch-2.3.11.tgz
        • ❌ braces-1.8.5.tgz (Vulnerable Library)

Vulnerability Details

Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2019-03-25

URL: WS-2019-0019

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/786

Release Date: 2019-02-21

Fix Resolution: 2.3.1

---

Step up your Open Source Security Game with WhiteSource here

WS-2019-0331 (Medium) detected in handlebars-4.0.5.min.js

WS-2019-0331 - Medium Severity Vulnerability

Vulnerable Library - handlebars-4.0.5.min.js

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/4.0.5/handlebars.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/timeline/styling/itemTemplates.html

Path to vulnerable library: /automata/node_modules/vis/examples/timeline/styling/itemTemplates.html

Dependency Hierarchy:

• ❌ handlebars-4.0.5.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

Arbitrary Code Execution vulnerability found in handlebars before 4.5.2. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.

Publish Date: 2019-12-05

URL: WS-2019-0331

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1316

Release Date: 2019-12-05

Fix Resolution: handlebars - 4.5.2

---

Step up your Open Source Security Game with WhiteSource here

Double clicking a node or Dragging a node is not enabling the edit label textbox

Double-clicking a node or dragging a node, makes it as a selected node, however, the edit label text box doesn't get activated.

Implement DFA method

Requirements:
Add DFA method. basic UI is done, although there are lots of cosmetic bugs, It doesn't make UI unusable. Those will be taken care parallelly.

WS-2019-0369 (Medium) detected in handlebars-4.0.5.min.js

WS-2019-0369 - Medium Severity Vulnerability

Vulnerable Library - handlebars-4.0.5.min.js

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/4.0.5/handlebars.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/timeline/styling/itemTemplates.html

Path to vulnerable library: /automata/node_modules/vis/examples/timeline/styling/itemTemplates.html

Dependency Hierarchy:

• ❌ handlebars-4.0.5.min.js (Vulnerable Library)

Found in HEAD commit: 9bec9c46c83be2434c4ebe468598d6b115c6c1e5

Vulnerability Details

Prototype Pollution vulnerability found in handlebars.js before 4.5.3. Attacker may use Remote-Code-Execution exploits.

Publish Date: 2020-01-08

URL: WS-2019-0369

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://github.com/wycats/handlebars.js/blob/master/release-notes.md#v453---november-18th-2019

Release Date: 2020-01-08

Fix Resolution: handlebars - 4.5.3

---

Step up your Open Source Security Game with WhiteSource here

DFA is not handling multilength labels

DFA takes one character from the input string and checks which edge has the same label.

but it will fail if the label is of length more than 1.

DFA should consider the case of multilength label

eslint version conflicts

The react-scripts package provided by Create React App requires a dependency:
"eslint": "5.12.0"

but the eslint installed in package.json is of version 5.16.0

temporary it's solved by adding SKIP_PREFLIGHT_CHECK=true in an .env file

CVE-2018-14040 (Medium) detected in bootstrap-3.3.1-3.3.1.min.js

CVE-2018-14040 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.1-3.3.1.min.js

Google-styled theme for Bootstrap.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/todc-bootstrap/3.3.1-3.3.1/js/bootstrap.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/docs/graph3d/index.html

Path to vulnerable library: /automata/node_modules/vis/docs/graph3d/../js/bootstrap.min.js,/automata/node_modules/vis/docs/timeline/../js/bootstrap.min.js,/automata/node_modules/vis/docs/network/../js/bootstrap.min.js,/automata/node_modules/vis/docs/graph2d/../js/bootstrap.min.js,/automata/node_modules/vis/docs/data/../js/bootstrap.min.js

Dependency Hierarchy:

• ❌ bootstrap-3.3.1-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Publish Date: 2018-07-13

URL: CVE-2018-14040

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: twbs/bootstrap#26630

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:4.1.2

---

Step up your Open Source Security Game with WhiteSource here

Selected nodes/edge should get deselected when clicking outside network

nodes and edges are remaining selected even after clicking outside the canvas.

intended behavior:

1. click on node -> nodes get selected.
2. click outside the workspace paper -> nodes get deselected.

however, point 2 is not working as expected

CVE-2015-9251 (Medium) detected in multiple libraries

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.1.min.js, jquery-1.11.1.min.js, jquery-1.7.1.min.js, jquery-1.10.1.min.js

jquery-2.1.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/timeline/dataHandling/loadExternalData.html

Path to vulnerable library: /automata/node_modules/vis/examples/timeline/dataHandling/loadExternalData.html

Dependency Hierarchy:

• ❌ jquery-2.1.1.min.js (Vulnerable Library)

jquery-1.11.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/docs/graph2d/index.html

Path to vulnerable library: /automata/node_modules/vis/docs/graph2d/../js/jquery.min.js,/automata/node_modules/vis/docs/graph3d/../js/jquery.min.js,/automata/node_modules/vis/docs/data/../js/jquery.min.js,/automata/node_modules/vis/docs/timeline/../js/jquery.min.js,/automata/node_modules/vis/examples/timeline/groups/../../../docs/js/jquery.min.js,/automata/node_modules/vis/docs/network/../js/jquery.min.js

Dependency Hierarchy:

• ❌ jquery-1.11.1.min.js (Vulnerable Library)

jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/sockjs/examples/echo/index.html

Path to vulnerable library: /automata/node_modules/sockjs/examples/echo/index.html,/automata/node_modules/sockjs/examples/hapi/html/index.html,/automata/node_modules/sockjs/examples/multiplex/index.html,/automata/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

• ❌ jquery-1.7.1.min.js (Vulnerable Library)

jquery-1.10.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.10.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/network/data/dotLanguage/dotEdgeStyles.html

Path to vulnerable library: /automata/node_modules/vis/examples/network/data/dotLanguage/dotEdgeStyles.html,/automata/node_modules/vis/examples/timeline/other/rtl.html

Dependency Hierarchy:

• ❌ jquery-1.10.1.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

---

Step up your Open Source Security Game with WhiteSource here

Implement a small logging util

Height of network canvas increase after adding node/edge

Height of network increase by 4px every time a node/edge dialog box opens and closed

CVE-2019-16769 (Low) detected in serialize-javascript-1.9.1.tgz

CVE-2019-16769 - Low Severity Vulnerability

Vulnerable Library - serialize-javascript-1.9.1.tgz

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.9.1.tgz

Path to dependency file: /tmp/ws-scm/automata/package.json

Path to vulnerable library: /tmp/ws-scm/automata/node_modules/serialize-javascript/package.json

Dependency Hierarchy:

• react-scripts-2.1.8.tgz (Root Library)
  • terser-webpack-plugin-1.2.2.tgz
    • ❌ serialize-javascript-1.9.1.tgz (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

Publish Date: 2019-12-05

URL: CVE-2019-16769

CVSS 2 Score Details (3.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16769

Release Date: 2019-12-05

Fix Resolution: v2.1.1

---

Step up your Open Source Security Game with WhiteSource here

dummy issue

this is just a dummy issue to check projects card

Upgrade react-scripts and vis-utils

Upgrade react-scripts and vis-utils to latest

Rewrite Utils as ToolBar functional component

as workspace is re-written workspace as a functional component, now rewrite Toolbar to a functional component and integrate it

CVE-2018-20677 (Medium) detected in bootstrap-3.3.1-3.3.1.min.js

CVE-2018-20677 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.1-3.3.1.min.js

Google-styled theme for Bootstrap.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/todc-bootstrap/3.3.1-3.3.1/js/bootstrap.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/docs/graph3d/index.html

Path to vulnerable library: /automata/node_modules/vis/docs/graph3d/../js/bootstrap.min.js,/automata/node_modules/vis/docs/timeline/../js/bootstrap.min.js,/automata/node_modules/vis/docs/network/../js/bootstrap.min.js,/automata/node_modules/vis/docs/graph2d/../js/bootstrap.min.js,/automata/node_modules/vis/docs/data/../js/bootstrap.min.js

Dependency Hierarchy:

• ❌ bootstrap-3.3.1-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

Publish Date: 2019-01-09

URL: CVE-2018-20677

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20677

Release Date: 2019-01-09

Fix Resolution: Bootstrap - v3.4.0;NorDroN.AngularTemplate - 0.1.6;Dynamic.NET.Express.ProjectTemplates - 0.8.0;dotnetng.template - 1.0.0.4;ZNxtApp.Core.Module.Theme - 1.0.9-Beta;JMeter - 5.0.0

---

Step up your Open Source Security Game with WhiteSource here

Accept nodes overlapping the accept circle when node label is too big

Details

node size increases as node label length increase, but the size of the outer ring which decides a node is an accept node or not is fixed. As a result, the node and the outer ring overlap and the user can't see if its an accept state or not.

How to reproduce the issue?

1. Create a node.
2. Make it an accept node
3. Change the node label with a long string.
4. The node size will increase wrt to the length of the label and ultimately overlap the outer ring.

Possible solution

1. Limit the length of the label
2. Dynamically increase the outer ring size wrt to increase in node size
3. Dynamically increase the size of all nodes and outer ring wrt to increase in size of any node.
4. Show the trimmed label w/ ellipsis, and when mouse hover above the node the tooltip will show the full string.

Refactor snackbar

unnecessary snackbar and notification are written, let's remove the notification method and use snackbar directly

CVE-2012-6708 (Medium) detected in jquery-1.7.1.min.js

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/sockjs/examples/echo/index.html

Path to vulnerable library: /automata/node_modules/sockjs/examples/echo/index.html,/automata/node_modules/sockjs/examples/hapi/html/index.html,/automata/node_modules/sockjs/examples/multiplex/index.html,/automata/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

• ❌ jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

---

Step up your Open Source Security Game with WhiteSource here

adding node giving error item with id already exists

adding a node after deleting a non-last node is giving an error in console:

Uncaught Error: Cannot add item: item with id 5 already exists

How to reproduce

once the application started,

• delete any node except the node 5
• add a new node

WS-2019-0064 (High) detected in handlebars-4.0.5.min.js

WS-2019-0064 - High Severity Vulnerability

Vulnerable Library - handlebars-4.0.5.min.js

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/4.0.5/handlebars.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/timeline/styling/itemTemplates.html

Path to vulnerable library: /automata/node_modules/vis/examples/timeline/styling/itemTemplates.html

Dependency Hierarchy:

• ❌ handlebars-4.0.5.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.

Publish Date: 2019-04-30

URL: WS-2019-0064

CVSS 2 Score Details (8.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/755/versions

Release Date: 2019-04-30

Fix Resolution: 1.0.6-2,4.0.14,4.1.2

---

Step up your Open Source Security Game with WhiteSource here

enable editMode when a node/edge is dragged

currently by design, when an element is selected, the user should be able to edit its label and upon dragging elements, the elements are selected but are not prompted for edit mode.

Error message persists in add node/edge dialogbox

in dialog box we get an error message if incorrect input is supplied. However, the error message is not cleared and is shown next time dialog box is visible.

Edit label is not getting disabled properly

edit label is not getting disabled when a node is selected and then deselected.

Steps to Reproduce

1. click on a node, edit label should get enabled with the node label as text.
2. click on network blank space, node will get deselected but edit label is still enabled.

although changing it is not affecting anything, so It's just a cosmetic issue.

CVE-2019-11358 (Medium) detected in multiple libraries

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.1.min.js, jquery-1.11.1.min.js, jquery-1.10.1.min.js

jquery-2.1.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/timeline/dataHandling/loadExternalData.html

Path to vulnerable library: /automata/node_modules/vis/examples/timeline/dataHandling/loadExternalData.html

Dependency Hierarchy:

• ❌ jquery-2.1.1.min.js (Vulnerable Library)

jquery-1.11.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/docs/graph2d/index.html

Path to vulnerable library: /automata/node_modules/vis/docs/graph2d/../js/jquery.min.js,/automata/node_modules/vis/docs/graph3d/../js/jquery.min.js,/automata/node_modules/vis/docs/data/../js/jquery.min.js,/automata/node_modules/vis/docs/timeline/../js/jquery.min.js,/automata/node_modules/vis/examples/timeline/groups/../../../docs/js/jquery.min.js,/automata/node_modules/vis/docs/network/../js/jquery.min.js

Dependency Hierarchy:

• ❌ jquery-1.11.1.min.js (Vulnerable Library)

jquery-1.10.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.10.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/network/data/dotLanguage/dotEdgeStyles.html

Path to vulnerable library: /automata/node_modules/vis/examples/network/data/dotLanguage/dotEdgeStyles.html,/automata/node_modules/vis/examples/timeline/other/rtl.html

Dependency Hierarchy:

• ❌ jquery-1.10.1.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: 3.4.0

---

Step up your Open Source Security Game with WhiteSource here

canvas getting cleared while double clicking 2 times

How to reproduce:

1. double click, it will prompt to create a node and ask to enter a label for the node.
2. again double click in the workspace region, the entire nodes and edges will get cleared including the starting node.

probably it's an issue in how keys events are handled.

CVE-2019-19919 (High) detected in handlebars-4.0.5.min.js

CVE-2019-19919 - High Severity Vulnerability

Vulnerable Library - handlebars-4.0.5.min.js

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/4.0.5/handlebars.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/timeline/styling/itemTemplates.html

Path to vulnerable library: /automata/node_modules/vis/examples/timeline/styling/itemTemplates.html

Dependency Hierarchy:

• ❌ handlebars-4.0.5.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Publish Date: 2019-12-20

URL: CVE-2019-19919

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1164

Release Date: 2019-12-20

Fix Resolution: 4.3.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2018-14042 (Medium) detected in bootstrap-3.3.1-3.3.1.min.js

CVE-2018-14042 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.1-3.3.1.min.js

Google-styled theme for Bootstrap.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/todc-bootstrap/3.3.1-3.3.1/js/bootstrap.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/docs/graph3d/index.html

Path to vulnerable library: /automata/node_modules/vis/docs/graph3d/../js/bootstrap.min.js,/automata/node_modules/vis/docs/timeline/../js/bootstrap.min.js,/automata/node_modules/vis/docs/network/../js/bootstrap.min.js,/automata/node_modules/vis/docs/graph2d/../js/bootstrap.min.js,/automata/node_modules/vis/docs/data/../js/bootstrap.min.js

Dependency Hierarchy:

• ❌ bootstrap-3.3.1-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

Publish Date: 2018-07-13

URL: CVE-2018-14042

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: twbs/bootstrap#26630

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:4.1.2

---

Step up your Open Source Security Game with WhiteSource here

WS-2019-0047 Medium Severity Vulnerability detected by WhiteSource

WS-2019-0047 - Medium Severity Vulnerability

Vulnerable Library - tar-4.4.1.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.1.tgz

Dependency Hierarchy:

• react-scripts-2.1.8.tgz (Root Library)
  • fsevents-1.2.4.tgz
    • node-pre-gyp-0.10.0.tgz
      • ❌ tar-4.4.1.tgz (Vulnerable Library)

Vulnerability Details

Versions of node-tar prior to 4.4.2 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.

Publish Date: 2019-04-05

URL: WS-2019-0047

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/803

Release Date: 2019-04-05

Fix Resolution: 4.4.2

---

Step up your Open Source Security Game with WhiteSource here

Add a notice bar that says mobile and touch devices are not supported

Add a notice bar that says mobile and touch devices are not supported

Enhance Utility Paper

Instead of fixed utility paper on the right side.

we can make a small arrow button on the right side that will reveal/hide the utility paper.
how utility paper should be on mobile screens. need more brainstorming.

CVE-2016-4055 (Medium) detected in moment-2.8.4.min.js, moment-with-locales-2.8.1.min.js

CVE-2016-4055 - Medium Severity Vulnerability

Vulnerable Libraries - moment-2.8.4.min.js, moment-with-locales-2.8.1.min.js

moment-2.8.4.min.js

Parse, validate, manipulate, and display dates

Library home page: https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.8.4/moment.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/graph2d/08_performance.html

Path to vulnerable library: /automata/node_modules/vis/examples/graph2d/08_performance.html,/automata/node_modules/vis/examples/timeline/other/stressPerformance.html

Dependency Hierarchy:

• ❌ moment-2.8.4.min.js (Vulnerable Library)

moment-with-locales-2.8.1.min.js

Parse, validate, manipulate, and display dates

Library home page: https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.8.1/moment-with-locales.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/timeline/other/localization.html

Path to vulnerable library: /automata/node_modules/vis/examples/timeline/other/localization.html,/automata/node_modules/vis/examples/graph2d/13_localization.html

Dependency Hierarchy:

• ❌ moment-with-locales-2.8.1.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

Publish Date: 2017-01-23

URL: CVE-2016-4055

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4055

Release Date: 2017-01-23

Fix Resolution: 2.11.2

---

Step up your Open Source Security Game with WhiteSource here

Update workspace after vis-network is breaking

We're getting
TypeError: vis_network__WEBPACK_IMPORTED_MODULE_3__.DataSet is not a constructor

Import not working properly

Steps to reproduce.

1.export the automaton to JSON.
2.clear
3.import the automaton to JSON
4.clear again
5.import the automaton to JSON again.

datasets are not getting updated.

disable editMode when user clicks out of vis canvas

Is it a bug?

yes

explain briefly the behavior and intended behavior

current behavior

currently pressing and holding enables the add edge mode and the user can draw edges from nodes if the user releases the shift key the edit mode is disabled.
However if user press and hold down shift and click anywhere instead of canvas the canvas go out of focus and releasing shift is not triggering the disable edit mode.
This goes for switching tabs too.

intended behavior

releasing the shift key should disable the edit mode. even if canvas goes out of focus, clicked out of canvas and switched tab

Feedback form

github user can create a issue in the github itself,.
but with user and non-github user they should be able to report bugs and give feedback via a feedback form.

Rewrite Workspace.jsx as functional component

After upgrading react and visjs, workspace.jsx is broken, not working as expected.
And workspace.jsx is such a mess.
rewrite the workspace.jsx as a functional component. Later we will decouple the workspace.jsx network and utilities part.

WS-2016-0090 (Medium) detected in multiple libraries

WS-2016-0090 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.1.min.js, jquery-1.11.1.min.js, jquery-1.7.1.min.js, jquery-1.10.1.min.js

jquery-2.1.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/timeline/dataHandling/loadExternalData.html

Path to vulnerable library: /automata/node_modules/vis/examples/timeline/dataHandling/loadExternalData.html

Dependency Hierarchy:

• ❌ jquery-2.1.1.min.js (Vulnerable Library)

jquery-1.11.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/docs/graph2d/index.html

Path to vulnerable library: /automata/node_modules/vis/docs/graph2d/../js/jquery.min.js,/automata/node_modules/vis/docs/graph3d/../js/jquery.min.js,/automata/node_modules/vis/docs/data/../js/jquery.min.js,/automata/node_modules/vis/docs/timeline/../js/jquery.min.js,/automata/node_modules/vis/examples/timeline/groups/../../../docs/js/jquery.min.js,/automata/node_modules/vis/docs/network/../js/jquery.min.js

Dependency Hierarchy:

• ❌ jquery-1.11.1.min.js (Vulnerable Library)

jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/sockjs/examples/echo/index.html

Path to vulnerable library: /automata/node_modules/sockjs/examples/echo/index.html,/automata/node_modules/sockjs/examples/hapi/html/index.html,/automata/node_modules/sockjs/examples/multiplex/index.html,/automata/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

• ❌ jquery-1.7.1.min.js (Vulnerable Library)

jquery-1.10.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.10.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/network/data/dotLanguage/dotEdgeStyles.html

Path to vulnerable library: /automata/node_modules/vis/examples/network/data/dotLanguage/dotEdgeStyles.html,/automata/node_modules/vis/examples/timeline/other/rtl.html

Dependency Hierarchy:

• ❌ jquery-1.10.1.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

JQuery, before 2.2.0, is vulnerable to Cross-site Scripting (XSS) attacks via text/javascript response with arbitrary code execution.

Publish Date: 2016-11-27

URL: WS-2016-0090

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: jquery/jquery@b078a62

Release Date: 2019-04-08

Fix Resolution: 2.2.0

---

Step up your Open Source Security Game with WhiteSource here

WS-2019-0332 (Medium) detected in handlebars-4.0.5.min.js

WS-2019-0332 - Medium Severity Vulnerability

Vulnerable Library - handlebars-4.0.5.min.js

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/4.0.5/handlebars.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/timeline/styling/itemTemplates.html

Path to vulnerable library: /automata/node_modules/vis/examples/timeline/styling/itemTemplates.html

Dependency Hierarchy:

• ❌ handlebars-4.0.5.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

Arbitrary Code Execution vulnerability found in handlebars before 4.5.3. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.It is due to an incomplete fix for a WS-2019-0331.

Publish Date: 2019-12-05

URL: WS-2019-0332

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1324

Release Date: 2019-12-05

Fix Resolution: handlebars - 4.5.3

---

Step up your Open Source Security Game with WhiteSource here

edge creation is not straight

while dragging an edge from one node to another node it's not straight.
rather it's using an edge smooth property with horizontalCW (my guess), it would be better while creating an edge w/ dragging, the edge should be straight

WS-2020-0042 (High) detected in acorn-5.7.3.tgz

WS-2020-0042 - High Severity Vulnerability

Vulnerable Library - acorn-5.7.3.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-5.7.3.tgz

Path to dependency file: /tmp/ws-scm/automata/package.json

Path to vulnerable library: /tmp/ws-scm/automata/node_modules/jsdom/node_modules/acorn/package.json

Dependency Hierarchy:

• react-scripts-3.3.1.tgz (Root Library)
  • jest-24.9.0.tgz
    • jest-cli-24.9.0.tgz
      • jest-config-24.9.0.tgz
        • jest-environment-jsdom-24.9.0.tgz
          • jsdom-11.12.0.tgz
            • ❌ acorn-5.7.3.tgz (Vulnerable Library)

Found in HEAD commit: b15c52b7a424a4cf2f969334b7dd3148bce227ef

Vulnerability Details

acorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.

Publish Date: 2020-03-08

URL: WS-2020-0042

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1488

Release Date: 2020-03-08

Fix Resolution: 7.1.1

---

Step up your Open Source Security Game with WhiteSource here

Edit label textbox not getting update

The edit label textbox is not getting updated.

Steps to reproduce.

1. click on one node. EL textbox should be populated,
2. now don't just click, click and then drag/move the node, the node gets selected but EL textbox doesn't get updated

CVE-2018-20834 (High) detected in tar-4.4.1.tgz

CVE-2018-20834 - High Severity Vulnerability

Vulnerable Library - tar-4.4.1.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.1.tgz

Dependency Hierarchy:

• react-scripts-2.1.8.tgz (Root Library)
  • fsevents-1.2.4.tgz
    • node-pre-gyp-0.10.0.tgz
      • ❌ tar-4.4.1.tgz (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).

Publish Date: 2019-04-30

URL: CVE-2018-20834

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/344595

Release Date: 2019-04-30

Fix Resolution: v4.4.2

---

Step up your Open Source Security Game with WhiteSource here

Add a validator for DFA

As only DFA is supported, add one DFA validator, that will determine if the network is valid DFA or not

CVE-2017-18214 (High) detected in multiple libraries

CVE-2017-18214 - High Severity Vulnerability

Vulnerable Libraries - moment-with-locales-2.18.1.min.js, moment-2.8.4.min.js, moment-with-locales-2.8.1.min.js

moment-with-locales-2.18.1.min.js

Parse, validate, manipulate, and display dates

Library home page: https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.18.1/moment-with-locales.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/timeline/styling/weekStyling.html

Path to vulnerable library: /automata/node_modules/vis/examples/timeline/styling/weekStyling.html

Dependency Hierarchy:

• ❌ moment-with-locales-2.18.1.min.js (Vulnerable Library)

moment-2.8.4.min.js

Parse, validate, manipulate, and display dates

Library home page: https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.8.4/moment.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/graph2d/08_performance.html

Path to vulnerable library: /automata/node_modules/vis/examples/graph2d/08_performance.html,/automata/node_modules/vis/examples/timeline/other/stressPerformance.html

Dependency Hierarchy:

• ❌ moment-2.8.4.min.js (Vulnerable Library)

moment-with-locales-2.8.1.min.js

Parse, validate, manipulate, and display dates

Library home page: https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.8.1/moment-with-locales.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/timeline/other/localization.html

Path to vulnerable library: /automata/node_modules/vis/examples/timeline/other/localization.html,/automata/node_modules/vis/examples/graph2d/13_localization.html

Dependency Hierarchy:

• ❌ moment-with-locales-2.8.1.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.

Publish Date: 2018-03-04

URL: CVE-2017-18214

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18214

Release Date: 2018-03-04

Fix Resolution: 2.19.3

---

Step up your Open Source Security Game with WhiteSource here

Add new option for exporting in DOT language.

Currently app supports Export as JSON and PNG only.

• new option Export as DOT.
• It will convert the graph to DOT language and prompt to dowonload

WS-2019-0103 (Medium) detected in handlebars-4.0.5.min.js

WS-2019-0103 - Medium Severity Vulnerability

Vulnerable Library - handlebars-4.0.5.min.js

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/4.0.5/handlebars.min.js

Path to dependency file: /tmp/ws-scm/automata/node_modules/vis/examples/timeline/styling/itemTemplates.html

Path to vulnerable library: /automata/node_modules/vis/examples/timeline/styling/itemTemplates.html

Dependency Hierarchy:

• ❌ handlebars-4.0.5.min.js (Vulnerable Library)

Found in HEAD commit: 9c21bcf8921fe44ec20fe8844090100903ceec5d

Vulnerability Details

Handlebars.js before 4.1.0 has Remote Code Execution (RCE)

Publish Date: 2019-05-30

URL: WS-2019-0103

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: handlebars-lang/handlebars.js@edc6220

Release Date: 2019-05-30

Fix Resolution: 4.1.0

---

Step up your Open Source Security Game with WhiteSource here