๐ป My Github account statistics:
๐ข I'm currently working at the WebbyLab
๐ซ How to reach me:
- telegram: @dimapustovit
- email: [email protected]
- skype: dima.pustovit
Keep code usage instructions.
License: MIT License
๐ป My Github account statistics:
๐ข I'm currently working at the WebbyLab
๐ซ How to reach me:
This issue provides visibility into Lalaps updates and their statuses.
minimatch ReDoS vulnerability
Library: minimatch
Affected versions: <3.0.5
Severity: high
โ๏ธ #92
โ๏ธ #68
Root Libraries:
decode-uri-component vulnerable to Denial of Service (DoS)
Library: decode-uri-component
Affected versions: <=0.2.0
Severity: low
Root Libraries:
Authorization Bypass in parse-path
Library: parse-path
Affected versions: <5.0.0
Severity: high
โ๏ธ #92
โ๏ธ #68
Root Libraries:
parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing
Library: parse-url
Affected versions: <8.1.0
Severity: moderate
โ๏ธ #92
โ๏ธ #68
Root Libraries:
Last Updated: 01 Dec 2022, at 01:12 UTC
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
Publish Date: 2022-09-14
URL: CVE-2022-2900
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Is your feature request related to a problem? Please describe.
Add unit tests alongside e2e (not checked in package:test)
JSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonwebtoken/package.json
Dependency Hierarchy:
Found in base branch: master
node-jsonwebtoken is a JsonWebToken implementation for node.js. For versions <= 8.5.1
of jsonwebtoken
library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey
argument from the readme link of the jwt.verify()
function, they can write arbitrary files on the host machine. Users are affected only if untrusted entities are allowed to modify the key retrieval parameter of the jwt.verify()
on a host that you control. This issue has been fixed, please update to version 9.0.0.
Publish Date: 2022-12-21
URL: CVE-2022-23529
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-27h2-hvpr-p74q
Release Date: 2022-12-21
Fix Resolution: jsonwebtoken - 9.0.0
Step up your Open Source Security Game with Mend here
a package manager for JavaScript
Library home page: https://registry.npmjs.org/npm/-/npm-7.24.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/npm/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json.
Publish Date: 2021-11-13
URL: CVE-2021-43616
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43616
Release Date: 2021-11-13
Fix Resolution: npm - 8.1.4
Step up your Open Source Security Game with WhiteSource here
JSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonwebtoken/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1
of jsonwebtoken
library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey
argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
Publish Date: 2022-12-22
URL: CVE-2022-23541
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-hjrf-2m68-5959
Release Date: 2022-12-22
Fix Resolution: jsonwebtoken - 9.0.0
Step up your Open Source Security Game with Mend here
a package manager for JavaScript
Library home page: https://registry.npmjs.org/npm/-/npm-8.3.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/npm/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces
, --workspace=<name>
). Anyone who has run npm pack
or npm publish
inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.
Publish Date: 2022-06-13
URL: CVE-2022-29244
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-hj9c-8jmm-8c52
Release Date: 2022-06-13
Fix Resolution (npm): 8.11.0
Direct dependency fix Resolution (semantic-release): 19.0.3
Step up your Open Source Security Game with Mend here
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/axios/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository axios/axios prior to 0.26.
Publish Date: 2022-05-03
URL: CVE-2022-1214
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/ef7b4ab6-a3f6-4268-a21a-e7104d344607/
Release Date: 2022-05-03
Fix Resolution: axios - v0.26.0
Step up your Open Source Security Game with WhiteSource here
Automated semver compliant package publishing
Library home page: https://registry.npmjs.org/semantic-release/-/semantic-release-19.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/semantic-release/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI
. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with encodeURI
when included in a URL are already masked properly.
Publish Date: 2022-06-09
URL: CVE-2022-31051
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-x2pg-mjhr-2m5x
Release Date: 2022-06-09
Fix Resolution: 19.0.3
Step up your Open Source Security Game with Mend here
Regular expression for matching ANSI escape codes
Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/npm/node_modules/string-width/node_modules/ansi-regex/package.json
Dependency Hierarchy:
Regular expression for matching ANSI escape codes
Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/npm/node_modules/cli-table3/node_modules/ansi-regex/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3807
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/
Release Date: 2021-09-17
Fix Resolution (ansi-regex): 3.0.1
Direct dependency fix Resolution (semantic-release): 19.0.3
Fix Resolution (ansi-regex): 5.0.1
Direct dependency fix Resolution (semantic-release): 19.0.3
Step up your Open Source Security Game with Mend here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Publish Date: 2022-06-27
URL: CVE-2022-2216
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/505a3d39-2723-4a06-b1f7-9b2d133c92e1/
Release Date: 2022-06-27
Fix Resolution: parse-url - 6.0.1
Step up your Open Source Security Game with Mend here
Node 10:
TypeError: Module.createRequire is not a function
at Object.<anonymous> (/home/runner/work/code-chronicle/code-chronicle/tmp/package-tests/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2359:26)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:789:10)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
at Function.Module._load (internal/modules/cjs/loader.js:585:3)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/home/runner/work/code-chronicle/code-chronicle/tmp/package-tests/node_modules/eslint/lib/cli-engine/cli-engine.js:33:5)
https://github.com/pustovitDmytro/code-chronicle/runs/4928751244?check_suite_focus=true
JSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonwebtoken/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
In versions <=8.5.1
of jsonwebtoken
library, lack of algorithm definition in the jwt.verify()
function can lead to signature validation bypass due to defaulting to the none
algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify()
function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify()
method. There will be no impact, if you update to version 9.0.0 and you donโt need to allow for the none
algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify()
options.
Publish Date: 2022-12-22
URL: CVE-2022-23540
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540
Release Date: 2022-12-22
Fix Resolution: jsonwebtoken - 9.0.0
Step up your Open Source Security Game with Mend here
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js
Path to dependency file: /node_modules/redeyed/examples/browser/index.html
Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.
Publish Date: 2018-01-18
URL: CVE-2012-6708
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708
Release Date: 2018-01-18
Fix Resolution: jQuery - v1.9.0
Step up your Open Source Security Game with WhiteSource here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in base branch: master
Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.
Publish Date: 2022-09-15
URL: CVE-2022-3224
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3224
Release Date: 2022-09-15
Fix Resolution: parse-url - 8.1.0
Step up your Open Source Security Game with Mend here
a glob matcher in javascript
Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/minimatch/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Publish Date: 2022-10-17
URL: CVE-2022-3517
Base Score Metrics:
Step up your Open Source Security Game with Mend here
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js
Path to dependency file: /node_modules/redeyed/examples/browser/index.html
Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11022
Base Score Metrics:
Type: Upgrade version
Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
Release Date: 2020-04-29
Fix Resolution: jQuery - 3.5.0
Step up your Open Source Security Game with WhiteSource here
simple, flexible, fun test framework
Library home page: https://registry.npmjs.org/mocha/-/mocha-9.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mocha/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
There is regular Expression Denial of Service (ReDoS) vulnerability in mocha.
It allows cause a denial of service when stripping crafted invalid function definition from strs.
Publish Date: 2021-09-18
URL: WS-2021-0638
Base Score Metrics:
Step up your Open Source Security Game with Mend here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Publish Date: 2022-06-27
URL: CVE-2022-2218
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/024912d3-f103-4daf-a1d0-567f4d9f2bf5/
Release Date: 2022-06-27
Fix Resolution: parse-url - 6.0.1
Step up your Open Source Security Game with Mend here
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js
Path to dependency file: /node_modules/redeyed/examples/browser/index.html
Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11023
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-04-29
Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0
Step up your Open Source Security Game with WhiteSource here
master
branch failed. ๐จI recommend you give this issue a high priority, so other packages depending on you can benefit from your bug fixes and new features again.
You can find below the list of errors reported by semantic-release. Each one of them has to be resolved in order to automatically publish your package. Iโm sure you can fix this ๐ช.
Errors are usually caused by a misconfiguration or an authentication problem. With each error reported below you will find explanation and guidance to help you to resolve it.
Once all the errors are resolved, semantic-release will release your package the next time you push a commit to the master
branch. You can also manually restart the failed CI job that runs semantic-release.
If you are not sure how to resolve this, here are some links that can help you:
If those donโt help, or if this issue is reporting something you think isnโt right, you can always ask the humans behind semantic-release.
semantic-release cannot push the version tag to the branch master
on the remote Git repository with URL https://[secure]@github.com/pustovitDmytro/code-chronicle.git
.
This can be caused by:
Good luck with your project โจ
Your semantic-release bot ๐ฆ๐
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/minimist/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Publish Date: 2022-03-17
URL: CVE-2021-44906
Base Score Metrics:
Step up your Open Source Security Game with Mend here
A tiny (108 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.1.25.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nanoid/package.json
Dependency Hierarchy:
Found in base branch: master
The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
Publish Date: 2022-01-14
URL: CVE-2021-23566
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23566
Release Date: 2022-01-14
Fix Resolution: nanoid - 3.1.31
Step up your Open Source Security Game with WhiteSource here
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
Warning
These dependencies are deprecated:
These updates are currently rate-limited. Click on a checkbox below to force their creation now.
@babel/cli
, @babel/core
, @babel/node
, @babel/plugin-proposal-class-properties
, @babel/plugin-proposal-decorators
, @babel/plugin-proposal-object-rest-spread
, @babel/plugin-proposal-optional-chaining
, @babel/preset-env
, @babel/runtime
, @commitlint/cli
, @semantic-release/changelog
, @semantic-release/git
, chai
, chance
, danger
, eslint-config-incredible
, eslint-plugin-censor
, eslint-plugin-import
, eslint-plugin-no-secrets
, eslint-plugin-node
, eslint-plugin-promise
, eslint-plugin-regexp
, eslint-plugin-security
, eslint-plugin-sonarjs
, husky
, jscpd
, lockfile-lint
, mocha
, mocha-junit-reporter
, node-package-tester
, semantic-release
, semantic-release-telegram
)remark
, remark-preset-lint-recommended
, remark-toc
)These updates have all been created already. Click a checkbox below to force a retry/rebase of any.
@commitlint/cli
, @commitlint/lint
, babel-plugin-module-resolver
, chai
, conventional-changelog-eslint
, danger
, eslint
, eslint-plugin-markdown
, eslint-plugin-mocha
, eslint-plugin-no-secrets
, eslint-plugin-promise
, eslint-plugin-regexp
, eslint-plugin-security
, eslint-plugin-sonarjs
, eslint-plugin-unicorn
, husky
, jscpd
, mocha
, nyc
, semantic-release
).github/workflows/npt.yml
actions/checkout v2
actions/setup-node v2
actions/setup-node v2
package.json
@babel/parser 7.17.0
chai 4.3.6
cls-hooked 4.2.2
docopt 0.6.2
doctrine 3.0.0
escodegen 2.0.0
esprima 4.0.1
fs-extra 10.0.0
globby 11.1.0
handlebars 4.7.7
mdinclude 0.7.2
myrmidon 1.7.2
remark 13.0.0
remark-preset-lint-recommended 5.0.0
remark-toc 7.2.0
uuid 8.3.2
@babel/cli ^7.15.7
@babel/core ^7.15.5
@babel/node ^7.15.4
@babel/plugin-proposal-class-properties ^7.14.5
@babel/plugin-proposal-decorators ^7.15.4
@babel/plugin-proposal-object-rest-spread ^7.15.6
@babel/plugin-proposal-optional-chaining ^7.14.5
@babel/polyfill ^7.12.1
@babel/preset-env ^7.15.6
@babel/runtime ^7.15.4
@commitlint/cli ^13.2.0
@commitlint/lint ^13.2.0
@semantic-release/changelog ^6.0.0
@semantic-release/git ^10.0.0
babel-plugin-module-resolver ^4.1.0
babel-plugin-shebang ^1.0.0
chai ^4.3.4
chance ^1.1.8
conventional-changelog-eslint ^3.0.9
coveralls ^3.1.1
danger ^10.6.6
eslint ^7.32.0
eslint-config-incredible ^2.3.4
eslint-plugin-censor ^1.5.1
eslint-plugin-import ^2.24.2
eslint-plugin-markdown ^2.2.1
eslint-plugin-mocha ^9.0.0
eslint-plugin-no-secrets ^0.8.9
eslint-plugin-node ^11.1.0
eslint-plugin-promise ^5.1.0
eslint-plugin-regexp ^1.3.1
eslint-plugin-scanjs-rules ^0.2.1
eslint-plugin-security ^1.4.0
eslint-plugin-sonarjs ^0.10.0
eslint-plugin-unicorn ^36.0.0
husky ^7.0.2
jscpd ^3.3.26
lockfile-lint ^4.6.2
mocha ^9.1.2
mocha-junit-reporter ^2.0.0
node-package-tester ^1.3.3
nyc ^15.1.0
semantic-release ^19.0.3
semantic-release-telegram ^1.6.0
eslint >= 7
node >=10
Utility for getting a function's name for node and the browser
Library home page: https://registry.npmjs.org/get-func-name/-/get-func-name-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: master
get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit f934b228b
which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Publish Date: 2023-09-27
URL: CVE-2023-43646
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-4q6p-r6v2-jvc5
Release Date: 2023-09-27
Fix Resolution: get-func-name - 2.0.1,3.0.0
Step up your Open Source Security Game with Mend here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Publish Date: 2022-06-27
URL: CVE-2022-0722
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/2490ef6d-5577-4714-a4dd-9608251b4226
Release Date: 2022-06-27
Fix Resolution: parse-url - 6.0.1
Step up your Open Source Security Game with Mend here
Fast implementation of JSON-Patch (RFC-6902) with duplex (observe changes) capabilities
Library home page: https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-3.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/fast-json-patch/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.
Publish Date: 2022-12-25
URL: CVE-2021-4279
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2021-4279
Release Date: 2022-12-25
Fix Resolution: fast-json-patch - 3.1.1
Step up your Open Source Security Game with Mend here
JSON Schema validation and specifications
Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/json-schema/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Publish Date: 2021-11-13
URL: CVE-2021-3918
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918
Release Date: 2021-11-13
Fix Resolution: json-schema - 0.4.0
Step up your Open Source Security Game with WhiteSource here
The semantic version parser used by npm.
Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: master
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Publish Date: 2023-06-21
URL: CVE-2022-25883
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-c2qf-rxjj-qqgw
Release Date: 2023-06-21
Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2
Step up your Open Source Security Game with Mend here
Run npt cli tests for all supported platforms
Regular expression for matching semver versions
Library home page: https://registry.npmjs.org/semver-regex/-/semver-regex-3.1.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/semver-regex/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
Publish Date: 2022-06-02
URL: CVE-2021-43307
Base Score Metrics:
Type: Upgrade version
Origin: https://research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/
Release Date: 2022-06-02
Fix Resolution (semver-regex): 3.1.4
Direct dependency fix Resolution (semantic-release): 19.0.3
Step up your Open Source Security Game with Mend here
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js
Path to dependency file: /node_modules/redeyed/examples/browser/index.html
Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
Publish Date: 2020-05-19
URL: CVE-2020-7656
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-q4m3-2j7h-f7xw
Release Date: 2020-05-28
Fix Resolution: jquery - 1.9.0
Step up your Open Source Security Game with WhiteSource here
Simple JSON Addressing.
Library home page: https://registry.npmjs.org/jsonpointer/-/jsonpointer-4.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonpointer/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.
Publish Date: 2021-11-03
URL: CVE-2021-23807
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23807
Release Date: 2021-11-03
Fix Resolution (jsonpointer): 5.0.0
Direct dependency fix Resolution (danger): 11.0.2
Step up your Open Source Security Game with WhiteSource here
A light-weight module that brings window.fetch to node.js
Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-fetch/package.json
Dependency Hierarchy:
Found in base branch: master
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Publish Date: 2022-01-16
URL: CVE-2022-0235
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-r683-j2x4-v87g
Release Date: 2022-01-16
Fix Resolution: node-fetch - 2.6.7,3.1.1
Step up your Open Source Security Game with WhiteSource here
A better decodeURIComponent
Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/decode-uri-component/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
Publish Date: 2022-11-28
URL: CVE-2022-38900
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-w573-4hg7-7wgq
Release Date: 2022-11-28
Fix Resolution: decode-uri-component - 0.2.1
Step up your Open Source Security Game with Mend here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
Cross-Site Scripting via Improper Input Validation (parser differential) in parse-url before 8.0.0.
Through this vulnerability, an attacker is capable to execute malicious JS codes.
Publish Date: 2022-07-02
URL: WS-2022-0239
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/5fa3115f-5c97-4928-874c-3cc6302e154e
Release Date: 2022-07-02
Fix Resolution: parse-url - 8.0.0
Step up your Open Source Security Game with Mend here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
File Protocol Spoofing in parse-url before 8.0.0 can lead to attacks, such as XSS, Arbitrary Read/Write File, and Remote Code Execution.
Publish Date: 2022-06-30
URL: WS-2022-0238
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/52060edb-e426-431b-a0d0-e70407e44f18/
Release Date: 2022-06-30
Fix Resolution: parse-url - 8.0.0
Step up your Open Source Security Game with Mend here
Wrap words to a specified length.
Library home page: https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: master
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
Publish Date: 2023-06-22
URL: CVE-2023-26115
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-j8xg-fqg3-53r7
Release Date: 2023-06-22
Fix Resolution: word-wrap - 1.2.4
Step up your Open Source Security Game with Mend here
JSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonwebtoken/package.json
Dependency Hierarchy:
Found in base branch: master
Versions <=8.5.1
of jsonwebtoken
library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, youโll need to set the allowInvalidAsymmetricKeyTypes
option to true
in the sign()
and/or verify()
functions.
Publish Date: 2022-12-23
URL: CVE-2022-23539
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-8cf7-32gw-wr33
Release Date: 2022-12-23
Fix Resolution: jsonwebtoken - 9.0.0
Step up your Open Source Security Game with Mend here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Publish Date: 2022-06-27
URL: CVE-2022-2217
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/4e046c63-b1ca-4bcc-b418-29796918a71b/
Release Date: 2022-06-27
Fix Resolution: parse-url - 6.0.1
Step up your Open Source Security Game with Mend here
JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-2.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/json5/package.json
Dependency Hierarchy:
JSON for the ES5 era.
Library home page: https://registry.npmjs.org/json5/-/json5-0.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/find-babel-config/node_modules/json5/package.json
Dependency Hierarchy:
JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-1.0.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/tsconfig-paths/node_modules/json5/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse
method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__
, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse
and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse
. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse
should restrict parsing of __proto__
keys when parsing JSON strings to objects. As a point of reference, the JSON.parse
method included in JavaScript ignores __proto__
keys. Simply changing JSON5.parse
to JSON.parse
in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.
Publish Date: 2022-12-24
URL: CVE-2022-46175
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175
Release Date: 2022-12-24
Fix Resolution (json5): 2.2.2
Direct dependency fix Resolution (@babel/core): 7.16.5
Fix Resolution (json5): 1.0.2
Direct dependency fix Resolution (eslint-plugin-import): 2.25.0
Step up your Open Source Security Game with Mend here
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-url/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
Regular Expression Denial of Service (ReDoS) in ionicabizau/parse-url before 8.0.0.
It allows cause a denial of service when calling function parse-url
Publish Date: 2022-07-04
URL: WS-2022-0237
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Extract the non-magic parent path from a glob string.
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/glob-parent/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
The package glob-parent before 6.0.1 are vulnerable to Regular Expression Denial of Service (ReDoS)
Publish Date: 2021-06-22
URL: CVE-2021-35065
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-cj88-88mr-972w
Release Date: 2021-06-22
Fix Resolution (glob-parent): 6.0.1
Direct dependency fix Resolution (eslint): 8.0.0
Step up your Open Source Security Game with Mend here
Parse paths (local paths, urls: ssh/git/etc)
Library home page: https://registry.npmjs.org/parse-path/-/parse-path-4.0.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-path/package.json
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.
Publish Date: 2022-06-28
URL: CVE-2022-0624
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0624
Release Date: 2022-06-28
Fix Resolution: parse-path - 5.0.0
Step up your Open Source Security Game with Mend here
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/follow-redirects/package.json
Dependency Hierarchy:
Found in base branch: master
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
Publish Date: 2022-01-10
URL: CVE-2022-0155
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/
Release Date: 2022-01-10
Fix Resolution: follow-redirects - v1.14.7
Step up your Open Source Security Game with WhiteSource here
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js
Path to dependency file: /node_modules/redeyed/examples/browser/index.html
Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html
Dependency Hierarchy:
Found in HEAD commit: 6e512d3b26c0461e41894cae6558b35a24e5b20e
Found in base branch: master
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Publish Date: 2018-01-18
URL: CVE-2015-9251
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251
Release Date: 2018-01-18
Fix Resolution: jQuery - v3.0.0
Step up your Open Source Security Game with WhiteSource here
Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.
Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: master
The NPM package braces
, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js,
if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.
Publish Date: 2024-05-14
URL: CVE-2024-4068
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Issue Description
Glob matching for javascript/node.js. A replacement and faster alternative to minimatch and multimatch.
Library home page: https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: master
The NPM package micromatch
is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces()
in index.js
because the pattern .*
will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of micromatch should follow the fix recommendation as noted.
Publish Date: 2024-05-14
URL: CVE-2024-4067
Base Score Metrics:
Type: Upgrade version
Release Date: 2024-05-14
Fix Resolution (micromatch): 4.0.6
Direct dependency fix Resolution (globby): 12.0.0
Step up your Open Source Security Game with Mend here
Parses a link header and returns paging information for each contained link.
Library home page: https://registry.npmjs.org/parse-link-header/-/parse-link-header-1.0.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/parse-link-header/package.json
Dependency Hierarchy:
Found in base branch: master
The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.
Publish Date: 2021-12-24
URL: CVE-2021-23490
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23490
Release Date: 2021-12-24
Fix Resolution (parse-link-header): 2.0.0
Direct dependency fix Resolution (danger): 11.0.2
Step up your Open Source Security Game with WhiteSource here
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.