mcaj-git / 2percentsilk-haikus-for-codespaces

• 👋 Hi, I’m @mcaj-git
• 👀 I’m interested in ...
• 🌱 I’m currently learning ...
• 💞️ I’m looking to collaborate on ...
• 📫 How to reach me ...

2percentsilk-haikus-for-codespaces's Issues

CVE-2021-32803 (High) detected in tar-4.4.13.tgz

CVE-2021-32803 - High Severity Vulnerability

Vulnerable Library - tar-4.4.13.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • glob-watcher-5.0.3.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.12.tgz
        • node-pre-gyp-0.14.0.tgz
          • ❌ tar-4.4.13.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

Publish Date: 2021-08-03

URL: CVE-2021-32803

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r628-mhmh-qjhw

Release Date: 2021-08-03

Fix Resolution: tar - 3.2.3, 4.4.15, 5.0.7, 6.1.2

---

Step up your Open Source Security Game with Mend here

CVE-2021-32804 (High) detected in tar-4.4.13.tgz

CVE-2021-32804 - High Severity Vulnerability

Vulnerable Library - tar-4.4.13.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • glob-watcher-5.0.3.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.12.tgz
        • node-pre-gyp-0.14.0.tgz
          • ❌ tar-4.4.13.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Publish Date: 2021-08-03

URL: CVE-2021-32804

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3jfq-g458-7qm9

Release Date: 2021-08-03

Fix Resolution: tar - 3.2.2, 4.4.14, 5.0.6, 6.1.1

---

Step up your Open Source Security Game with Mend here

CVE-2021-44906 (Critical) detected in minimist-1.2.5.tgz

CVE-2021-44906 - Critical Severity Vulnerability

Vulnerable Library - minimist-1.2.5.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json,/node_modules/minimist/package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • glob-watcher-5.0.3.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.12.tgz
        • node-pre-gyp-0.14.0.tgz
          • rc-1.2.8.tgz
            • ❌ minimist-1.2.5.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvch-5gv4-984h

Release Date: 2022-03-17

Fix Resolution: minimist - 0.2.4,1.2.6

---

Step up your Open Source Security Game with Mend here

WS-2021-0153 (Critical) detected in ejs-3.0.1.tgz

WS-2021-0153 - Critical Severity Vulnerability

Vulnerable Library - ejs-3.0.1.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-3.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy:

• ❌ ejs-3.0.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

Arbitrary Code Injection vulnerability was found in ejs before 3.1.6. Caused by filename which isn't sanitized for display.

Publish Date: 2021-01-22

URL: WS-2021-0153

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-22

Fix Resolution: 3.1.6

---

Step up your Open Source Security Game with Mend here

CVE-2020-7608 (Medium) detected in yargs-parser-5.0.0.tgz

CVE-2020-7608 - Medium Severity Vulnerability

Vulnerable Library - yargs-parser-5.0.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-5.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/yargs-parser/package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • gulp-cli-2.2.0.tgz
    • yargs-7.1.0.tgz
      • ❌ yargs-parser-5.0.0.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-16

Fix Resolution: 5.0.1;13.1.2;15.0.1;18.1.1

---

Step up your Open Source Security Game with Mend here

CVE-2022-25881 (High) detected in http-cache-semantics-3.8.1.tgz

CVE-2022-25881 - High Severity Vulnerability

Vulnerable Library - http-cache-semantics-3.8.1.tgz

Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies

Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-3.8.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/http-cache-semantics/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-gifsicle-7.0.0.tgz
    • gifsicle-5.0.0.tgz
      • bin-wrapper-4.1.0.tgz
        • download-7.1.0.tgz
          • got-8.3.2.tgz
            • cacheable-request-2.1.4.tgz
              • ❌ http-cache-semantics-3.8.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Publish Date: 2023-01-31

URL: CVE-2022-25881

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rc47-6667-2j5j

Release Date: 2023-01-31

Fix Resolution: http-cache-semantics - 4.1.1;org.webjars.npm:http-cache-semantics:4.1.1

---

Step up your Open Source Security Game with Mend here

CVE-2017-16137 (Low) detected in debug-3.2.6.tgz

CVE-2017-16137 - Low Severity Vulnerability

Vulnerable Library - debug-3.2.6.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-3.2.6.tgz

Dependency Hierarchy:

• nodemon-2.0.2.tgz (Root Library)
  • ❌ debug-3.2.6.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-06-07

URL: CVE-2017-16137

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gxpj-cx7g-858c

Release Date: 2018-04-26

Fix Resolution (debug): 3.2.7

Direct dependency fix Resolution (nodemon): 2.0.3

---

Step up your Open Source Security Game with Mend here

CVE-2022-25883 (High) detected in semver-6.3.0.tgz, semver-5.7.1.tgz

CVE-2022-25883 - High Severity Vulnerability

Vulnerable Libraries - semver-6.3.0.tgz, semver-5.7.1.tgz

semver-6.3.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/imagemin/node_modules/semver/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-7.0.1.tgz
    • make-dir-3.0.2.tgz
      • ❌ semver-6.3.0.tgz (Vulnerable Library)

semver-5.7.1.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semver/package.json,/package.json

Dependency Hierarchy:

• nodemon-2.0.2.tgz (Root Library)
  • ❌ semver-5.7.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution (semver): 6.3.1

Direct dependency fix Resolution (gulp-imagemin): 8.0.0

Fix Resolution (semver): 6.3.1

Direct dependency fix Resolution (nodemon): 2.0.17

---

Step up your Open Source Security Game with Mend here

CVE-2021-37701 (High) detected in tar-4.4.13.tgz

CVE-2021-37701 - High Severity Vulnerability

Vulnerable Library - tar-4.4.13.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • glob-watcher-5.0.3.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.12.tgz
        • node-pre-gyp-0.14.0.tgz
          • ❌ tar-4.4.13.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Publish Date: 2021-08-31

URL: CVE-2021-37701

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9r2w-394v-53qc

Release Date: 2021-08-31

Fix Resolution: tar - 4.4.16,5.0.8,6.1.7

---

Step up your Open Source Security Game with Mend here

CVE-2022-33987 (Medium) detected in multiple libraries

CVE-2022-33987 - Medium Severity Vulnerability

Vulnerable Libraries - got-8.3.2.tgz, got-7.1.0.tgz, got-6.7.1.tgz

got-8.3.2.tgz

Simplified HTTP requests

Library home page: https://registry.npmjs.org/got/-/got-8.3.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/bin-wrapper/node_modules/got/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-gifsicle-7.0.0.tgz
    • gifsicle-5.0.0.tgz
      • bin-wrapper-4.1.0.tgz
        • download-7.1.0.tgz
          • ❌ got-8.3.2.tgz (Vulnerable Library)

got-7.1.0.tgz

Simplified HTTP requests

Library home page: https://registry.npmjs.org/got/-/got-7.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/download/node_modules/got/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-gifsicle-7.0.0.tgz
    • gifsicle-5.0.0.tgz
      • bin-build-3.0.0.tgz
        • download-6.2.5.tgz
          • ❌ got-7.1.0.tgz (Vulnerable Library)

got-6.7.1.tgz

Simplified HTTP requests

Library home page: https://registry.npmjs.org/got/-/got-6.7.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/got/package.json

Dependency Hierarchy:

• nodemon-2.0.2.tgz (Root Library)
  • update-notifier-2.5.0.tgz
    • latest-version-3.1.0.tgz
      • package-json-4.0.1.tgz
        • ❌ got-6.7.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Publish Date: 2022-06-18

URL: CVE-2022-33987

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987

Release Date: 2022-06-18

Fix Resolution (got): 11.8.6

Direct dependency fix Resolution (nodemon): 2.0.17

---

Step up your Open Source Security Game with Mend here

CVE-2020-7774 (Critical) detected in y18n-3.2.1.tgz

CVE-2020-7774 - Critical Severity Vulnerability

Vulnerable Library - y18n-3.2.1.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-3.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/y18n/package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • gulp-cli-2.2.0.tgz
    • yargs-7.1.0.tgz
      • ❌ y18n-3.2.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1654

Release Date: 2020-11-17

Fix Resolution: 3.2.2, 4.0.1, 5.0.5

---

Step up your Open Source Security Game with Mend here

CVE-2020-28503 (Critical) detected in copy-props-2.0.4.tgz

CVE-2020-28503 - Critical Severity Vulnerability

Vulnerable Library - copy-props-2.0.4.tgz

Copy properties deeply between two objects.

Library home page: https://registry.npmjs.org/copy-props/-/copy-props-2.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/copy-props/package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • gulp-cli-2.2.0.tgz
    • ❌ copy-props-2.0.4.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.

Publish Date: 2021-03-23

URL: CVE-2020-28503

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-03-23

Fix Resolution: copy-props - 2.0.5

---

Step up your Open Source Security Game with Mend here

CVE-2024-27088 (Low) detected in es5-ext-0.10.53.tgz

CVE-2024-27088 - Low Severity Vulnerability

Vulnerable Library - es5-ext-0.10.53.tgz

ECMAScript extensions and shims

Library home page: https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.53.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/es5-ext/package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • undertaker-1.2.1.tgz
    • es6-weak-map-2.0.3.tgz
      • ❌ es5-ext-0.10.53.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into function#copy or function#toStringTokens may cause the script to stall. The vulnerability is patched in v0.10.63.

Publish Date: 2024-02-26

URL: CVE-2024-27088

CVSS 3 Score Details (0.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-27088

Release Date: 2024-02-26

Fix Resolution: es5-ext - 0.10.63

---

Step up your Open Source Security Game with Mend here

CVE-2021-35065 (High) detected in glob-parent-5.1.1.tgz, glob-parent-3.1.0.tgz - autoclosed

CVE-2021-35065 - High Severity Vulnerability

Vulnerable Libraries - glob-parent-5.1.1.tgz, glob-parent-3.1.0.tgz

glob-parent-5.1.1.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

• nodemon-2.0.2.tgz (Root Library)
  • chokidar-3.3.1.tgz
    • ❌ glob-parent-5.1.1.tgz (Vulnerable Library)

glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-watcher/node_modules/glob-parent/package.json,/node_modules/glob-stream/node_modules/glob-parent/package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • glob-watcher-5.0.3.tgz
    • chokidar-2.1.8.tgz
      • ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The package glob-parent before 6.0.1 are vulnerable to Regular Expression Denial of Service (ReDoS)

Publish Date: 2021-06-22

URL: CVE-2021-35065

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cj88-88mr-972w

Release Date: 2021-06-22

Fix Resolution: glob-parent - 6.0.1

---

Step up your Open Source Security Game with Mend here

CVE-2021-3795 (High) detected in semver-regex-2.0.0.tgz

CVE-2021-3795 - High Severity Vulnerability

Vulnerable Library - semver-regex-2.0.0.tgz

Regular expression for matching semver versions

Library home page: https://registry.npmjs.org/semver-regex/-/semver-regex-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semver-regex/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-gifsicle-7.0.0.tgz
    • gifsicle-5.0.0.tgz
      • bin-wrapper-4.1.0.tgz
        • bin-version-check-4.0.0.tgz
          • bin-version-3.1.0.tgz
            • find-versions-3.2.0.tgz
              • ❌ semver-regex-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

semver-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-15

URL: CVE-2021-3795

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-15

Fix Resolution: semver-regex - 3.1.3,4.0.1

---

Step up your Open Source Security Game with Mend here

CVE-2021-43307 (High) detected in semver-regex-2.0.0.tgz

CVE-2021-43307 - High Severity Vulnerability

Vulnerable Library - semver-regex-2.0.0.tgz

Regular expression for matching semver versions

Library home page: https://registry.npmjs.org/semver-regex/-/semver-regex-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semver-regex/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-gifsicle-7.0.0.tgz
    • gifsicle-5.0.0.tgz
      • bin-wrapper-4.1.0.tgz
        • bin-version-check-4.0.0.tgz
          • bin-version-3.1.0.tgz
            • find-versions-3.2.0.tgz
              • ❌ semver-regex-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method

Publish Date: 2022-06-02

URL: CVE-2021-43307

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/

Release Date: 2022-06-02

Fix Resolution: semver-regex - 3.1.4,4.0.3

---

Step up your Open Source Security Game with Mend here

CVE-2020-8244 (Medium) detected in bl-1.2.2.tgz

CVE-2020-8244 - Medium Severity Vulnerability

Vulnerable Library - bl-1.2.2.tgz

Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!

Library home page: https://registry.npmjs.org/bl/-/bl-1.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/bl/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-gifsicle-7.0.0.tgz
    • gifsicle-5.0.0.tgz
      • bin-build-3.0.0.tgz
        • decompress-4.2.0.tgz
          • decompress-tar-4.1.1.tgz
            • tar-stream-1.6.2.tgz
              • ❌ bl-1.2.2.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.

Publish Date: 2020-08-30

URL: CVE-2020-8244

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-pp7h-53gx-mx7r

Release Date: 2020-08-30

Fix Resolution (bl): 1.2.3

Direct dependency fix Resolution (gulp-imagemin): 8.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2020-28469 (High) detected in glob-parent-5.1.1.tgz, glob-parent-3.1.0.tgz

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Libraries - glob-parent-5.1.1.tgz, glob-parent-3.1.0.tgz

glob-parent-5.1.1.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

• nodemon-2.0.2.tgz (Root Library)
  • chokidar-3.3.1.tgz
    • ❌ glob-parent-5.1.1.tgz (Vulnerable Library)

glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-watcher/node_modules/glob-parent/package.json,/node_modules/glob-stream/node_modules/glob-parent/package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • glob-watcher-5.0.3.tgz
    • chokidar-2.1.8.tgz
      • ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution (glob-parent): 5.1.2

Direct dependency fix Resolution (nodemon): 2.0.3

---

Step up your Open Source Security Game with Mend here

CVE-2021-3807 (High) detected in ansi-regex-3.0.0.tgz

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Library - ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ansi-regex/package.json

Dependency Hierarchy:

• nodemon-2.0.2.tgz (Root Library)
  • update-notifier-2.5.0.tgz
    • boxen-1.3.0.tgz
      • string-width-2.1.1.tgz
        • strip-ansi-4.0.0.tgz
          • ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 3.0.1

Direct dependency fix Resolution (nodemon): 2.0.3

---

Step up your Open Source Security Game with Mend here

CVE-2024-4068 (High) detected in braces-3.0.2.tgz, braces-2.3.2.tgz

CVE-2024-4068 - High Severity Vulnerability

Vulnerable Libraries - braces-3.0.2.tgz, braces-2.3.2.tgz

braces-3.0.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/braces/package.json

Dependency Hierarchy:

• nodemon-2.0.2.tgz (Root Library)
  • chokidar-3.3.1.tgz
    • ❌ braces-3.0.2.tgz (Vulnerable Library)

braces-2.3.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-2.3.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/findup-sync/node_modules/braces/package.json,/node_modules/matchdep/node_modules/braces/package.json,/node_modules/glob-watcher/node_modules/braces/package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • glob-watcher-5.0.3.tgz
    • chokidar-2.1.8.tgz
      • ❌ braces-2.3.2.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.

Publish Date: 2024-05-14

URL: CVE-2024-4068

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-14

Fix Resolution: braces - 3.0.3

---

Step up your Open Source Security Game with Mend here

CVE-2022-3517 (High) detected in minimatch-3.0.4.tgz

CVE-2022-3517 - High Severity Vulnerability

Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimatch/package.json,/package.json

Dependency Hierarchy:

• nodemon-2.0.2.tgz (Root Library)
  • ❌ minimatch-3.0.4.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5

---

Step up your Open Source Security Game with Mend here

CVE-2020-12265 (Critical) detected in decompress-tar-4.1.1.tgz, decompress-4.2.0.tgz

CVE-2020-12265 - Critical Severity Vulnerability

Vulnerable Libraries - decompress-tar-4.1.1.tgz, decompress-4.2.0.tgz

decompress-tar-4.1.1.tgz

decompress tar plugin

Library home page: https://registry.npmjs.org/decompress-tar/-/decompress-tar-4.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decompress-tar/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-gifsicle-7.0.0.tgz
    • gifsicle-5.0.0.tgz
      • bin-build-3.0.0.tgz
        • decompress-4.2.0.tgz
          • ❌ decompress-tar-4.1.1.tgz (Vulnerable Library)

decompress-4.2.0.tgz

Extracting archives made easy

Library home page: https://registry.npmjs.org/decompress/-/decompress-4.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decompress/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-gifsicle-7.0.0.tgz
    • gifsicle-5.0.0.tgz
      • bin-build-3.0.0.tgz
        • ❌ decompress-4.2.0.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.
Mend Note: Decompress versions prior to 4.2.1 are vulnerable to CVE-2020-12265 which could lead to Path Traversal. decompress-tar is a tar plugin for decompress and is also vulnerable to CVE-2020-12265 and there is no fixed version for decompress-tar.

Publish Date: 2020-04-26

URL: CVE-2020-12265

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12265

Release Date: 2020-04-26

Fix Resolution: decompress - 4.2.1, decompress-tar - No fix version available

---

Step up your Open Source Security Game with Mend here

CVE-2022-29078 (Critical) detected in ejs-3.0.1.tgz

CVE-2022-29078 - Critical Severity Vulnerability

Vulnerable Library - ejs-3.0.1.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-3.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy:

• ❌ ejs-3.0.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Publish Date: 2022-04-25

URL: CVE-2022-29078

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29078~

Release Date: 2022-04-25

Fix Resolution: 3.1.7

---

Step up your Open Source Security Game with Mend here

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update dependency ejs to v3.1.10 [SECURITY]
• Update dependency express to v4.19.2 [SECURITY]
• Update dependency nodemon to v2.0.22
• Update dependency gulp to v5
• Update dependency gulp-imagemin to v9
• Update dependency nodemon to v3
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

npm

package.json

• ejs ^3.0.1
• express ^4.17.1
• nodemon ^2.0.2
• gulp ^4.0.2
• gulp-imagemin ^7.1.0

---

• Check this box to trigger a request for Renovate to run again on this repository

CVE-2024-28863 (Medium) detected in tar-4.4.13.tgz

CVE-2024-28863 - Medium Severity Vulnerability

Vulnerable Library - tar-4.4.13.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • glob-watcher-5.0.3.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.12.tgz
        • node-pre-gyp-0.14.0.tgz
          • ❌ tar-4.4.13.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Publish Date: 2024-03-21

URL: CVE-2024-28863

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f5x3-32g6-xq36

Release Date: 2024-03-21

Fix Resolution: tar - 6.2.1

---

Step up your Open Source Security Game with Mend here

CVE-2022-24999 (High) detected in qs-6.7.0.tgz

CVE-2022-24999 - High Severity Vulnerability

Vulnerable Library - qs-6.7.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.7.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy:

• express-4.17.1.tgz (Root Library)
  • ❌ qs-6.7.0.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.7.3

Direct dependency fix Resolution (express): 4.17.2

---

Step up your Open Source Security Game with Mend here

CVE-2021-23362 (Medium) detected in hosted-git-info-2.8.8.tgz - autoclosed

CVE-2021-23362 - Medium Severity Vulnerability

Vulnerable Library - hosted-git-info-2.8.8.tgz

Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab

Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.8.tgz

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • gulp-cli-2.2.0.tgz
    • yargs-7.1.0.tgz
      • read-pkg-up-1.0.1.tgz
        • read-pkg-1.1.0.tgz
          • normalize-package-data-2.5.0.tgz
            • ❌ hosted-git-info-2.8.8.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Publish Date: 2021-03-23

URL: CVE-2021-23362

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-43f8-2h32-f4cj

Release Date: 2021-03-23

Fix Resolution: hosted-git-info - 2.8.9,3.0.8

---

Step up your Open Source Security Game with WhiteSource here

CVE-2024-29041 (Medium) detected in express-4.17.1.tgz

CVE-2024-29041 - Medium Severity Vulnerability

Vulnerable Library - express-4.17.1.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express/package.json

Dependency Hierarchy:

• ❌ express-4.17.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is res.location() but this is also called from within res.redirect(). The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

Publish Date: 2024-03-25

URL: CVE-2024-29041

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rv95-896h-c2vc

Release Date: 2024-03-25

Fix Resolution: 4.19.0

---

Step up your Open Source Security Game with Mend here

CVE-2020-8116 (High) detected in dot-prop-4.2.0.tgz

CVE-2020-8116 - High Severity Vulnerability

Vulnerable Library - dot-prop-4.2.0.tgz

Get, set, or delete a property from a nested object using a dot path

Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dot-prop/package.json

Dependency Hierarchy:

• nodemon-2.0.2.tgz (Root Library)
  • update-notifier-2.5.0.tgz
    • configstore-3.1.2.tgz
      • ❌ dot-prop-4.2.0.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Publish Date: 2020-02-04

URL: CVE-2020-8116

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116

Release Date: 2020-02-04

Fix Resolution (dot-prop): 4.2.1

Direct dependency fix Resolution (nodemon): 2.0.3

---

Step up your Open Source Security Game with Mend here

WS-2020-0044 (High) detected in decompress-4.2.0.tgz

WS-2020-0044 - High Severity Vulnerability

Vulnerable Library - decompress-4.2.0.tgz

Extracting archives made easy

Library home page: https://registry.npmjs.org/decompress/-/decompress-4.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decompress/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-gifsicle-7.0.0.tgz
    • gifsicle-5.0.0.tgz
      • bin-build-3.0.0.tgz
        • ❌ decompress-4.2.0.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

decompress in all its versions is vulnerable to arbitrary file write. the package fails to prevent an extraction of files with relative paths which allows attackers to write to any folder in the system.

Publish Date: 2020-03-08

URL: WS-2020-0044

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-08

Fix Resolution (decompress): 4.2.1

Direct dependency fix Resolution (gulp-imagemin): 8.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2024-33883 (High) detected in ejs-3.0.1.tgz

CVE-2024-33883 - High Severity Vulnerability

Vulnerable Library - ejs-3.0.1.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-3.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy:

• ❌ ejs-3.0.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Publish Date: 2024-04-28

URL: CVE-2024-33883

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-33883

Release Date: 2024-04-28

Fix Resolution: ejs - 3.1.10

---

Step up your Open Source Security Game with Mend here

CVE-2021-33587 (High) detected in css-what-3.2.1.tgz - autoclosed

CVE-2021-33587 - High Severity Vulnerability

Vulnerable Library - css-what-3.2.1.tgz

a CSS selector parser

Library home page: https://registry.npmjs.org/css-what/-/css-what-3.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/css-what/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-svgo-7.1.0.tgz
    • svgo-1.3.2.tgz
      • css-select-2.1.0.tgz
        • ❌ css-what-3.2.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Publish Date: 2021-05-28

URL: CVE-2021-33587

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587

Release Date: 2021-05-28

Fix Resolution (css-what): 5.0.1

Direct dependency fix Resolution (gulp-imagemin): 8.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2021-37713 (High) detected in tar-4.4.13.tgz

CVE-2021-37713 - High Severity Vulnerability

Vulnerable Library - tar-4.4.13.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • glob-watcher-5.0.3.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.12.tgz
        • node-pre-gyp-0.14.0.tgz
          • ❌ tar-4.4.13.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain .. path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory. Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path. This only affects users of node-tar on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

Publish Date: 2021-08-31

URL: CVE-2021-37713

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5955-9wpr-37jh

Release Date: 2021-08-31

Fix Resolution: tar - 4.4.18,5.0.10,6.1.9

---

Step up your Open Source Security Game with Mend here

CVE-2021-23440 (High) detected in set-value-2.0.1.tgz - autoclosed

CVE-2021-23440 - High Severity Vulnerability

Vulnerable Library - set-value-2.0.1.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/set-value/package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • gulp-cli-2.2.0.tgz
    • matchdep-2.0.0.tgz
      • micromatch-3.1.10.tgz
        • snapdragon-0.8.2.tgz
          • base-0.11.2.tgz
            • cache-base-1.0.1.tgz
              • ❌ set-value-2.0.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
Mend Note: After conducting further research, Mend has determined that all versions of set-value up to version 4.0.0 are vulnerable to CVE-2021-23440.

Publish Date: 2021-09-12

URL: CVE-2021-23440

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-12

Fix Resolution: set-value - 4.0.1

---

Step up your Open Source Security Game with Mend here

CVE-2022-38900 (High) detected in decode-uri-component-0.2.0.tgz

CVE-2022-38900 - High Severity Vulnerability

Vulnerable Library - decode-uri-component-0.2.0.tgz

A better decodeURIComponent

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decode-uri-component/package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • gulp-cli-2.2.0.tgz
    • matchdep-2.0.0.tgz
      • micromatch-3.1.10.tgz
        • snapdragon-0.8.2.tgz
          • source-map-resolve-0.5.3.tgz
            • ❌ decode-uri-component-0.2.0.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w573-4hg7-7wgq

Release Date: 2022-11-28

Fix Resolution: decode-uri-component - 0.2.1

---

Step up your Open Source Security Game with Mend here

CVE-2021-29059 (High) detected in is-svg-4.2.1.tgz

CVE-2021-29059 - High Severity Vulnerability

Vulnerable Library - is-svg-4.2.1.tgz

Check if a string or buffer is SVG

Library home page: https://registry.npmjs.org/is-svg/-/is-svg-4.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/is-svg/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-svgo-7.1.0.tgz
    • ❌ is-svg-4.2.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.

Publish Date: 2021-06-21

URL: CVE-2021-29059

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-06-21

Fix Resolution (is-svg): 4.3.0

Direct dependency fix Resolution (gulp-imagemin): 8.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2024-4067 (Medium) detected in micromatch-4.0.2.tgz, micromatch-3.1.10.tgz

CVE-2024-4067 - Medium Severity Vulnerability

Vulnerable Libraries - micromatch-4.0.2.tgz, micromatch-3.1.10.tgz

micromatch-4.0.2.tgz

Glob matching for javascript/node.js. A replacement and faster alternative to minimatch and multimatch.

Library home page: https://registry.npmjs.org/micromatch/-/micromatch-4.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/micromatch/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-7.0.1.tgz
    • globby-10.0.2.tgz
      • fast-glob-3.2.2.tgz
        • ❌ micromatch-4.0.2.tgz (Vulnerable Library)

micromatch-3.1.10.tgz

Glob matching for javascript/node.js. A drop-in replacement and faster alternative to minimatch and multimatch.

Library home page: https://registry.npmjs.org/micromatch/-/micromatch-3.1.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/findup-sync/node_modules/micromatch/package.json,/node_modules/glob-watcher/node_modules/micromatch/package.json,/node_modules/matchdep/node_modules/micromatch/package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • glob-watcher-5.0.3.tgz
    • anymatch-2.0.0.tgz
      • ❌ micromatch-3.1.10.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The NPM package micromatch is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of micromatch should follow the fix recommendation as noted.

Publish Date: 2024-05-14

URL: CVE-2024-4067

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-14

Fix Resolution (micromatch): 4.0.6

Direct dependency fix Resolution (gulp-imagemin): 8.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2023-29827 (Medium) detected in ejs-3.0.1.tgz - autoclosed

CVE-2023-29827 - Medium Severity Vulnerability

Vulnerable Library - ejs-3.0.1.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-3.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy:

• ❌ ejs-3.0.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter.

Publish Date: 2023-05-04

URL: CVE-2023-29827

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with Mend here

CVE-2021-33502 (High) detected in normalize-url-2.0.1.tgz - autoclosed

CVE-2021-33502 - High Severity Vulnerability

Vulnerable Library - normalize-url-2.0.1.tgz

Normalize a URL

Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-2.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/normalize-url/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-gifsicle-7.0.0.tgz
    • gifsicle-5.0.0.tgz
      • bin-wrapper-4.1.0.tgz
        • download-7.1.0.tgz
          • got-8.3.2.tgz
            • cacheable-request-2.1.4.tgz
              • ❌ normalize-url-2.0.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Publish Date: 2021-05-24

URL: CVE-2021-33502

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502

Release Date: 2021-05-24

Fix Resolution: normalize-url - 4.5.1,5.3.1,6.0.1

---

Step up your Open Source Security Game with Mend here

CVE-2021-33623 (High) detected in trim-newlines-1.0.0.tgz

CVE-2021-33623 - High Severity Vulnerability

Vulnerable Library - trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/trim-newlines/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-gifsicle-7.0.0.tgz
    • gifsicle-5.0.0.tgz
      • logalot-2.1.0.tgz
        • squeak-1.3.0.tgz
          • lpad-align-1.1.2.tgz
            • meow-3.7.0.tgz
              • ❌ trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution (trim-newlines): 3.0.1

Direct dependency fix Resolution (gulp-imagemin): 8.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2021-23343 (High) detected in path-parse-1.0.6.tgz - autoclosed

CVE-2021-23343 - High Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/path-parse/package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • gulp-cli-2.2.0.tgz
    • liftoff-3.1.0.tgz
      • resolve-1.15.1.tgz
        • ❌ path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jbgutierrez/path-parse#8

Release Date: 2021-05-04

Fix Resolution: path-parse - 1.0.7

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-3803 (High) detected in nth-check-1.0.2.tgz

CVE-2021-3803 - High Severity Vulnerability

Vulnerable Library - nth-check-1.0.2.tgz

performant nth-check parser & compiler

Library home page: https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nth-check/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-svgo-7.1.0.tgz
    • svgo-1.3.2.tgz
      • css-select-2.1.0.tgz
        • ❌ nth-check-1.0.2.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

nth-check is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3803

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-17

Fix Resolution (nth-check): 2.0.1

Direct dependency fix Resolution (gulp-imagemin): 8.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2021-28092 (High) detected in is-svg-4.2.1.tgz

CVE-2021-28092 - High Severity Vulnerability

Vulnerable Library - is-svg-4.2.1.tgz

Check if a string or buffer is SVG

Library home page: https://registry.npmjs.org/is-svg/-/is-svg-4.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/is-svg/package.json

Dependency Hierarchy:

• gulp-imagemin-7.1.0.tgz (Root Library)
  • imagemin-svgo-7.1.0.tgz
    • ❌ is-svg-4.2.1.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time.

Publish Date: 2021-03-12

URL: CVE-2021-28092

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28092

Release Date: 2021-03-12

Fix Resolution (is-svg): 4.2.2

Direct dependency fix Resolution (gulp-imagemin): 8.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2020-7788 (Critical) detected in ini-1.3.5.tgz

CVE-2020-7788 - Critical Severity Vulnerability

Vulnerable Library - ini-1.3.5.tgz

An ini encoder/decoder for node

Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json,/node_modules/ini/package.json

Dependency Hierarchy:

• nodemon-2.0.2.tgz (Root Library)
  • update-notifier-2.5.0.tgz
    • is-installed-globally-0.1.0.tgz
      • global-dirs-0.1.1.tgz
        • ❌ ini-1.3.5.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Publish Date: 2020-12-11

URL: CVE-2020-7788

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788

Release Date: 2020-12-11

Fix Resolution (ini): 1.3.6

Direct dependency fix Resolution (nodemon): 2.0.3

---

Step up your Open Source Security Game with Mend here

CVE-2021-37712 (High) detected in tar-4.4.13.tgz

CVE-2021-37712 - High Severity Vulnerability

Vulnerable Library - tar-4.4.13.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• gulp-4.0.2.tgz (Root Library)
  • glob-watcher-5.0.3.tgz
    • chokidar-2.1.8.tgz
      • fsevents-1.2.12.tgz
        • node-pre-gyp-0.14.0.tgz
          • ❌ tar-4.4.13.tgz (Vulnerable Library)

Found in HEAD commit: c696f843563ded54e4831fe89b5e3f25e9a063eb

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.

Publish Date: 2021-08-31

URL: CVE-2021-37712

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qq89-hq3f-393p

Release Date: 2021-08-31

Fix Resolution: tar - 4.4.18,5.0.10,6.1.9

---

Step up your Open Source Security Game with Mend here