pustovitdmytro / sns-telegram-bot

Telegram transport for SNS notifications

sns-telegram-bot

Telegram transport for SNS notifications.

Table of Contents

• Requirements
• Installation
• Usage
• API Documentation
• Community Bot
• Contribute

Requirements

To use library you need to have node and npm installed in your machine:

• node >=10
• npm >=6

Package is continuously tested on darwin, linux and win32 platforms. All active and maintenance LTS node releases are supported.

Installation

Clone sources from GitHub, and install modules:

  git clone [email protected]:pustovitDmytro/sns-telegram-bot.git
  cd sns-telegram-bot
  npm install

Usage

pass configuration as env variables (.env files supported)

default values are in .env.defaults

run compiled version by:

  node lib/app.js

or sources by:

  npx babel-node runner.js

API Documentation

Check api-blueprint and swagger in docs folder or Github-pages

Community Bot

If you don't want to self-deploy, just use community bot @aws_sns_to_tg_bot. It does not store any data, so feel free to use it.

Contribute

Make the changes to the code and tests. Then commit to your branch. Be sure to follow the commit message conventions. Read Contributing Guidelines for details.

sns-telegram-bot's Issues

Bug: make apidoc accessible by index.md

make apidoc accessible by index.md

Please follow the general troubleshooting steps first:

• I've searched on the issue tracker before creating one.
• I'm running the latest package version.
• I'm ready to provide help with a fix if needed.

Lalaps Dashboard

This issue provides visibility into Lalaps updates and their statuses.

npm

Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
Library: follow-redirects
Affected versions: <1.14.8
Severity: moderate
✔️ #113
✔️ #114
✔️ #140
Root Libraries:

Prototype Pollution in minimist
Library: minimist
Affected versions: <1.2.6
Severity: critical
✔️ #113
✔️ #114
✔️ #140
Root Libraries:

Inefficient Regular Expression Complexity in chalk/ansi-regex
Library: ansi-regex
Affected versions: >=3.0.0 <3.0.1
Severity: high
✔️ #114
✔️ #140
Root Libraries:

decode-uri-component vulnerable to Denial of Service (DoS)
Library: decode-uri-component
Affected versions: <=0.2.0
Severity: low
Root Libraries:

• ❌ danger

Got allows a redirect to a UNIX socket
Library: got
Affected versions: <11.8.5
Severity: moderate
✔️ #114
✔️ #140
Root Libraries:

• ✔️ nodemon #114 #140

minimatch ReDoS vulnerability
Library: minimatch
Affected versions: <3.0.5
Severity: high
Root Libraries:

• ✔️ mocha #114 #140

Packing does not respect root-level ignore files in workspaces
Library: npm
Affected versions: >=7.9.0 <8.11.0
Severity: high
✔️ #114
✔️ #140
Root Libraries:

Authorization Bypass in parse-path
Library: parse-path
Affected versions: <5.0.0
Severity: high
Root Libraries:

Cross site scripting in parse-url
Library: parse-url
Affected versions: <6.0.1
Severity: moderate
✔️ #114
✔️ #140
Root Libraries:

Exposure of Sensitive Information to an Unauthorized Actor in semantic-release
Library: semantic-release
Affected versions: >=17.0.4 <19.0.3
Severity: moderate
✔️ #114
✔️ #140
Root Libraries:

• ✔️ semantic-release #114 #140

Regular expression denial of service in semver-regex
Library: semver-regex
Affected versions: <3.1.4
Severity: low
✔️ #114
✔️ #140
Root Libraries:

Last Updated: 01 Dec 2022, at 01:31 UTC

CVE-2023-2251 (High) detected in yaml-1.10.2.tgz - autoclosed

CVE-2023-2251 - High Severity Vulnerability

Vulnerable Library - yaml-1.10.2.tgz

JavaScript parser and stringifier for YAML

Library home page: https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/yaml/package.json

Dependency Hierarchy:

• lockfile-lint-4.6.2.tgz (Root Library)
  • cosmiconfig-6.0.0.tgz
    • ❌ yaml-1.10.2.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

Uncaught Exception in GitHub repository eemeli/yaml prior to 2.2.2.

Publish Date: 2023-04-24

URL: CVE-2023-2251

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f9xv-q969-pqx4

Release Date: 2023-04-24

Fix Resolution: yaml - 2.2.2

---

Step up your Open Source Security Game with Mend here

CVE-2023-45857 (Medium) detected in axios-0.25.0.tgz

CVE-2023-45857 - Medium Severity Vulnerability

Vulnerable Library - axios-0.25.0.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.25.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• base-api-client-1.5.10.tgz (Root Library)
  • ❌ axios-0.25.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Publish Date: 2023-11-08

URL: CVE-2023-45857

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-11-08

Fix Resolution: axios - 1.6.0

---

Step up your Open Source Security Game with Mend here

CVE-2022-0722 (High) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-0722 - High Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-0722

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/2490ef6d-5577-4714-a4dd-9608251b4226

Release Date: 2022-06-27

Fix Resolution (parse-url): 6.0.1

Direct dependency fix Resolution (semantic-release-telegram): 1.5.2

---

Step up your Open Source Security Game with Mend here

CVE-2022-29244 (High) detected in npm-8.4.1.tgz - autoclosed

CVE-2022-29244 - High Severity Vulnerability

Vulnerable Library - npm-8.4.1.tgz

a package manager for JavaScript

Library home page: https://registry.npmjs.org/npm/-/npm-8.4.1.tgz

Dependency Hierarchy:

• semantic-release-19.0.2.tgz (Root Library)
  • npm-9.0.0.tgz
    • ❌ npm-8.4.1.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Publish Date: 2022-06-13

URL: CVE-2022-29244

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hj9c-8jmm-8c52

Release Date: 2022-06-13

Fix Resolution (npm): 8.11.0

Direct dependency fix Resolution (semantic-release): 19.0.3

---

Step up your Open Source Security Game with Mend here

Action Required: Fix Renovate Configuration

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

Location: .renovaterc
Error type: Invalid JSON (parsing failed)
Message: Syntax error: expecting end of expression or separator near "labe

CVE-2022-23541 (Medium) detected in jsonwebtoken-8.5.1.tgz - autoclosed

CVE-2022-23541 - Medium Severity Vulnerability

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Dependency Hierarchy:

• danger-10.9.0.tgz (Root Library)
  • ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

Publish Date: 2022-12-22

URL: CVE-2022-23541

CVSS 3 Score Details (6.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjrf-2m68-5959

Release Date: 2022-12-22

Fix Resolution (jsonwebtoken): 9.0.0

Direct dependency fix Resolution (danger): 11.2.1

---

Step up your Open Source Security Game with Mend here

Bug: raise conditions in polling

Issue Description
Resolve raise conditions in polling (remove settimeout)

Feature: Improve coverage

Is your feature request related to a problem? Please describe.
Improve coverage to 85% by branches

WS-2022-0239 (Medium) detected in parse-url-6.0.0.tgz - autoclosed

WS-2022-0239 - Medium Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Cross-Site Scripting via Improper Input Validation (parser differential) in parse-url before 8.0.0.
Through this vulnerability, an attacker is capable to execute malicious JS codes.

Publish Date: 2022-07-02

URL: WS-2022-0239

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5fa3115f-5c97-4928-874c-3cc6302e154e

Release Date: 2022-07-02

Fix Resolution (parse-url): 8.0.0

Direct dependency fix Resolution (semantic-release-telegram): 1.6.0

---

Step up your Open Source Security Game with Mend here

CVE-2022-25881 (High) detected in http-cache-semantics-4.1.0.tgz - autoclosed

CVE-2022-25881 - High Severity Vulnerability

Vulnerable Library - http-cache-semantics-4.1.0.tgz

Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies

Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz

Dependency Hierarchy:

• semantic-release-heroku-1.3.4.tgz (Root Library)
  • libnpmversion-2.0.2.tgz
    • run-script-2.0.0.tgz
      • node-gyp-8.4.1.tgz
        • make-fetch-happen-9.1.0.tgz
          • ❌ http-cache-semantics-4.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Publish Date: 2023-01-31

URL: CVE-2022-25881

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rc47-6667-2j5j

Release Date: 2023-01-31

Fix Resolution (http-cache-semantics): 4.1.1

Direct dependency fix Resolution (semantic-release-heroku): 1.3.5

---

Step up your Open Source Security Game with Mend here

WS-2022-0237 (High) detected in parse-url-6.0.0.tgz - autoclosed

WS-2022-0237 - High Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Regular Expression Denial of Service (ReDoS) in ionicabizau/parse-url before 8.0.0.
It allows cause a denial of service when calling function parse-url

Publish Date: 2022-07-04

URL: WS-2022-0237

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-07-04

Fix Resolution (parse-url): 8.0.0

Direct dependency fix Resolution (semantic-release-telegram): 1.6.0

---

Step up your Open Source Security Game with Mend here

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

• Upgrade: Update dependency logger-decorator to v1.8.1
• Chore: Update devDependencies (non-major) (@babel/cli, @babel/core, @babel/node, @babel/plugin-proposal-class-properties, @babel/plugin-proposal-decorators, @babel/plugin-proposal-object-rest-spread, @babel/plugin-proposal-optional-chaining, @babel/preset-env, @babel/runtime, @commitlint/cli, @commitlint/lint, @semantic-release/changelog, chai, danger, eslint, eslint-config-incredible, eslint-import-resolver-babel-module, eslint-plugin-censor, eslint-plugin-import, eslint-plugin-mocha, eslint-plugin-no-secrets, eslint-plugin-node, eslint-plugin-promise, eslint-plugin-regexp, eslint-plugin-security, eslint-plugin-sonarjs, fs-extra, jscpd, lockfile-lint, mocha, mocha-junit-reporter, node-package-tester, nodemon, rest-chronicle, semantic-release-heroku, semantic-release-telegram, supertest, winston-array-transport)
• Upgrade: Update dependency dayjs to v1.11.11
• Upgrade: Update dependency dotenv to v16.4.5
• Upgrade: Update dependency livr to v2.7.1
• Upgrade: Update dependency livr-extra-rules to v1.3.2
• Upgrade: Update dependency qs to v6.12.1
• Upgrade: Update dependency winston to v3.13.0
• chore: update actions/checkout action to v4
• chore: update actions/setup-node action to v4
• 🔐 Create all rate-limited PRs at once 🔐

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Chore: Update dependency semantic-release to v19.0.3 [SECURITY]
• Upgrade: Update dependency express to v4.19.2 [SECURITY]
• Upgrade: Update dependency confme to v1.2.0
• Upgrade: Update dependency yargs to v17.7.2
• Chore: Update devDependencies (non-major) (major) (@commitlint/cli, @commitlint/lint, babel-plugin-module-resolver, chai, conventional-changelog-eslint, danger, eslint, eslint-plugin-markdown, eslint-plugin-regexp, eslint-plugin-security, eslint-plugin-unicorn, fs-extra, husky, mocha, nodemon, supertest, uuid)
• Chore: Lock file maintenance
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

github-actions

.github/workflows/npt.yml

• actions/checkout v2
• actions/setup-node v2
• actions/setup-node v2

npm

package.json

• base-api-client 1.5.10
• body-parser 1.20.2
• confme 1.1.1
• cors 2.8.5
• dayjs 1.10.7
• dotenv 16.0.0
• express 4.17.2
• handlebars 4.7.8
• livr 2.3.3
• livr-extra-rules 1.2.1
• logger-decorator 1.8.0
• ms 2.1.3
• myrmidon 1.10.0
• qs 6.10.3
• winston 3.12.0
• yargs 17.2.1
• @babel/cli ^7.16.8
• @babel/core ^7.16.12
• @babel/node ^7.16.8
• @babel/plugin-proposal-class-properties ^7.16.7
• @babel/plugin-proposal-decorators ^7.16.7
• @babel/plugin-proposal-object-rest-spread ^7.16.7
• @babel/plugin-proposal-optional-chaining ^7.16.7
• @babel/polyfill ^7.12.1
• @babel/preset-env ^7.16.11
• @babel/runtime ^7.16.7
• @commitlint/cli ^16.1.0
• @commitlint/lint ^16.0.0
• @semantic-release/changelog ^6.0.1
• @semantic-release/git ^10.0.1
• babel-plugin-module-resolver ^4.1.0
• chai ^4.3.6
• cls-hooked ^4.2.2
• conventional-changelog-eslint ^3.0.9
• coveralls ^3.1.1
• danger ^10.8.0
• eslint ^8.7.0
• eslint-config-incredible ^2.4.1
• eslint-import-resolver-babel-module ^5.3.1
• eslint-plugin-censor ^1.5.2
• eslint-plugin-import ^2.25.4
• eslint-plugin-markdown ^2.2.1
• eslint-plugin-mocha ^10.0.3
• eslint-plugin-no-secrets ^0.8.9
• eslint-plugin-node ^11.1.0
• eslint-plugin-promise ^6.0.0
• eslint-plugin-regexp ^1.5.1
• eslint-plugin-scanjs-rules ^0.2.1
• eslint-plugin-security ^1.4.0
• eslint-plugin-sonarjs ^0.11.0
• eslint-plugin-unicorn ^40.1.0
• fs-extra ^10.0.0
• husky ^7.0.4
• jscpd ^3.4.5
• json-query ^2.2.2
• lockfile-lint ^4.6.2
• mocha ^9.2.0
• mocha-junit-reporter ^2.0.2
• node-package-tester ^1.2.0
• nodemon ^2.0.15
• nyc ^15.1.0
• rest-chronicle ^2.0.0
• semantic-release ^19.0.2
• semantic-release-heroku ^1.3.3
• semantic-release-telegram ^1.5.1
• supertest ^6.2.2
• uuid ^8.3.2
• winston-array-transport ^1.1.7
• node >=10.4

---

• Check this box to trigger a request for Renovate to run again on this repository

CVE-2022-25901 (High) detected in cookiejar-2.1.3.tgz

CVE-2022-25901 - High Severity Vulnerability

Vulnerable Library - cookiejar-2.1.3.tgz

simple persistent cookiejar system

Library home page: https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.3.tgz

Dependency Hierarchy:

• supertest-6.2.2.tgz (Root Library)
  • superagent-7.1.1.tgz
    • ❌ cookiejar-2.1.3.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.

Publish Date: 2023-01-18

URL: CVE-2022-25901

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-01-18

Fix Resolution (cookiejar): 2.1.4

Direct dependency fix Resolution (supertest): 6.2.3

---

Step up your Open Source Security Game with Mend here

CVE-2023-28155 (Medium) detected in request-2.88.2.tgz

CVE-2023-28155 - Medium Severity Vulnerability

Vulnerable Library - request-2.88.2.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz

Dependency Hierarchy:

• coveralls-3.1.1.tgz (Root Library)
  • ❌ request-2.88.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).NOTE: The request package is no longer supported by the maintainer.

Publish Date: 2023-03-16

URL: CVE-2023-28155

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p8p7-x288-28g6

Release Date: 2023-03-16

Fix Resolution: @cypress/request - 3.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2022-3224 (Medium) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-3224 - Medium Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.

Publish Date: 2022-09-15

URL: CVE-2022-3224

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3224

Release Date: 2022-09-15

Fix Resolution (parse-url): 8.1.0

Direct dependency fix Resolution (semantic-release-telegram): 1.6.0

---

Step up your Open Source Security Game with Mend here

CVE-2023-26136 (Critical) detected in tough-cookie-2.5.0.tgz

CVE-2023-26136 - Critical Severity Vulnerability

Vulnerable Library - tough-cookie-2.5.0.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz

Dependency Hierarchy:

• coveralls-3.1.1.tgz (Root Library)
  • request-2.88.2.tgz
    • ❌ tough-cookie-2.5.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Publish Date: 2023-07-01

URL: CVE-2023-26136

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136

Release Date: 2023-07-01

Fix Resolution: tough-cookie - 4.1.3

---

Step up your Open Source Security Game with Mend here

CVE-2022-38900 (High) detected in decode-uri-component-0.2.0.tgz - autoclosed

CVE-2022-38900 - High Severity Vulnerability

Vulnerable Library - decode-uri-component-0.2.0.tgz

A better decodeURIComponent

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Dependency Hierarchy:

• danger-10.9.0.tgz (Root Library)
  • gitlab-10.2.1.tgz
    • query-string-6.14.1.tgz
      • ❌ decode-uri-component-0.2.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w573-4hg7-7wgq

Release Date: 2022-11-28

Fix Resolution (decode-uri-component): 0.2.1

Direct dependency fix Resolution (danger): 11.0.2

---

Step up your Open Source Security Game with Mend here

CVE-2022-2218 (Medium) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-2218 - Medium Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-2218

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/024912d3-f103-4daf-a1d0-567f4d9f2bf5/

Release Date: 2022-06-27

Fix Resolution (parse-url): 6.0.1

Direct dependency fix Resolution (semantic-release-telegram): 1.5.2

---

Step up your Open Source Security Game with Mend here

CVE-2022-33987 (Medium) detected in got-9.6.0.tgz - autoclosed

CVE-2022-33987 - Medium Severity Vulnerability

Vulnerable Library - got-9.6.0.tgz

Simplified HTTP requests

Library home page: https://registry.npmjs.org/got/-/got-9.6.0.tgz

Dependency Hierarchy:

• nodemon-2.0.15.tgz (Root Library)
  • update-notifier-5.1.0.tgz
    • latest-version-5.1.0.tgz
      • package-json-6.5.0.tgz
        • ❌ got-9.6.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Publish Date: 2022-06-18

URL: CVE-2022-33987

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987

Release Date: 2022-06-18

Fix Resolution (got): 11.8.6

Direct dependency fix Resolution (nodemon): 2.0.17

---

Step up your Open Source Security Game with Mend here

CVE-2022-0624 (High) detected in parse-path-4.0.3.tgz - autoclosed

CVE-2022-0624 - High Severity Vulnerability

Vulnerable Library - parse-path-4.0.3.tgz

Parse paths (local paths, urls: ssh/git/etc)

Library home page: https://registry.npmjs.org/parse-path/-/parse-path-4.0.3.tgz

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • parse-url-6.0.0.tgz
        • ❌ parse-path-4.0.3.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.

Publish Date: 2022-06-28

URL: CVE-2022-0624

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0624

Release Date: 2022-06-28

Fix Resolution (parse-path): 5.0.0

Direct dependency fix Resolution (semantic-release-telegram): 1.6.0

---

Step up your Open Source Security Game with Mend here

CVE-2023-0842 (Medium) detected in xml2js-0.4.23.tgz - autoclosed

CVE-2023-0842 - Medium Severity Vulnerability

Vulnerable Library - xml2js-0.4.23.tgz

Simple XML to JavaScript object converter.

Library home page: https://registry.npmjs.org/xml2js/-/xml2js-0.4.23.tgz

Dependency Hierarchy:

• jscpd-3.4.5.tgz (Root Library)
  • finder-3.4.5.tgz
    • blamer-1.0.1.tgz
      • ❌ xml2js-0.4.23.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.

Publish Date: 2023-04-05

URL: CVE-2023-0842

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-0842

Release Date: 2023-04-05

Fix Resolution (xml2js): 0.5.0

Direct dependency fix Resolution (jscpd): 3.5.0

---

Step up your Open Source Security Game with Mend here

CVE-2022-0235 (Medium) detected in node-fetch-2.6.1.tgz - autoclosed

CVE-2022-0235 - Medium Severity Vulnerability

Vulnerable Library - node-fetch-2.6.1.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-fetch/package.json

Dependency Hierarchy:

• danger-10.8.0.tgz (Root Library)
  • ❌ node-fetch-2.6.1.tgz (Vulnerable Library)

Found in HEAD commit: 71675f6ded3079f055603bc7ddf22f36bc7dea7e

Found in base branch: master

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r683-j2x4-v87g

Release Date: 2022-01-16

Fix Resolution: node-fetch - 2.6.7,3.1.1

---

Step up your Open Source Security Game with WhiteSource here

Bug: Add readme [1.2.0]

Issue Description
Add documentation
Add Self-Hosted guide
Add link to original bot

CVE-2021-44906 (Critical) detected in minimist-1.2.5.tgz

CVE-2021-44906 - Critical Severity Vulnerability

Vulnerable Library - minimist-1.2.5.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• coveralls-3.1.1.tgz (Root Library)
  • ❌ minimist-1.2.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvch-5gv4-984h

Release Date: 2022-03-17

Fix Resolution: minimist - 0.2.4,1.2.6

---

Step up your Open Source Security Game with Mend here

CVE-2021-43307 (High) detected in semver-regex-3.1.3.tgz - autoclosed

CVE-2021-43307 - High Severity Vulnerability

Vulnerable Library - semver-regex-3.1.3.tgz

Regular expression for matching semver versions

Library home page: https://registry.npmjs.org/semver-regex/-/semver-regex-3.1.3.tgz

Dependency Hierarchy:

• semantic-release-19.0.2.tgz (Root Library)
  • find-versions-4.0.0.tgz
    • ❌ semver-regex-3.1.3.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method

Publish Date: 2022-06-02

URL: CVE-2021-43307

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/

Release Date: 2022-06-02

Fix Resolution (semver-regex): 3.1.4

Direct dependency fix Resolution (semantic-release): 19.0.3

---

Step up your Open Source Security Game with Mend here

CVE-2022-23529 (High) detected in jsonwebtoken-8.5.1.tgz - autoclosed

CVE-2022-23529 - High Severity Vulnerability

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

• danger-10.9.0.tgz (Root Library)
  • ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

node-jsonwebtoken is a JsonWebToken implementation for node.js. For versions <= 8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey argument from the readme link of the jwt.verify() function, they can write arbitrary files on the host machine. Users are affected only if untrusted entities are allowed to modify the key retrieval parameter of the jwt.verify() on a host that you control. This issue has been fixed, please update to version 9.0.0.

Publish Date: 2022-12-21

URL: CVE-2022-23529

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-27h2-hvpr-p74q

Release Date: 2022-12-21

Fix Resolution: jsonwebtoken - 9.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2023-45133 (High) detected in traverse-7.17.0.tgz - autoclosed

CVE-2023-45133 - High Severity Vulnerability

Vulnerable Library - traverse-7.17.0.tgz

The Babel Traverse module maintains the overall tree state, and is responsible for replacing, removing, and adding nodes

Library home page: https://registry.npmjs.org/@babel/traverse/-/traverse-7.17.0.tgz

Dependency Hierarchy:

• core-7.17.0.tgz (Root Library)
  • ❌ traverse-7.17.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluate()or path.evaluateTruthy() internal Babel methods. Known affected plugins are @babel/plugin-transform-runtime; @babel/preset-env when using its useBuiltIns option; and any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider, such as babel-plugin-polyfill-corejs3, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-es-shims, babel-plugin-polyfill-regenerator. No other plugins under the @babel/ namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in @babel/[email protected] and @babel/[email protected]. Those who cannot upgrade @babel/traverse and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected @babel/traverse versions: @babel/plugin-transform-runtime v7.23.2, @babel/preset-env v7.23.2, @babel/helper-define-polyfill-provider v0.4.3, babel-plugin-polyfill-corejs2 v0.4.6, babel-plugin-polyfill-corejs3 v0.8.5, babel-plugin-polyfill-es-shims v0.10.0, babel-plugin-polyfill-regenerator v0.5.3.

Publish Date: 2023-10-12

URL: CVE-2023-45133

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-67hx-6x53-jw92

Release Date: 2023-10-12

Fix Resolution (@babel/traverse): 7.23.2

Direct dependency fix Resolution (@babel/core): 7.17.2

---

Step up your Open Source Security Game with Mend here

CVE-2021-3807 (High) detected in ansi-regex-3.0.0.tgz, ansi-regex-5.0.0.tgz - autoclosed

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Libraries - ansi-regex-3.0.0.tgz, ansi-regex-5.0.0.tgz

ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Dependency Hierarchy:

• semantic-release-19.0.2.tgz (Root Library)
  • npm-9.0.0.tgz
    • npm-8.4.1.tgz
      • npmlog-6.0.0.tgz
        • gauge-4.0.0.tgz
          • wide-align-1.1.5.tgz
            • string-width-2.1.1.tgz
              • strip-ansi-4.0.0.tgz
                • ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)

ansi-regex-5.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz

Dependency Hierarchy:

• semantic-release-19.0.2.tgz (Root Library)
  • npm-9.0.0.tgz
    • npm-8.4.1.tgz
      • cli-table3-0.6.1.tgz
        • string-width-4.2.2.tgz
          • strip-ansi-6.0.0.tgz
            • ❌ ansi-regex-5.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 3.0.1

Direct dependency fix Resolution (semantic-release): 19.0.3

Fix Resolution (ansi-regex): 3.0.1

Direct dependency fix Resolution (semantic-release): 19.0.3

---

Step up your Open Source Security Game with Mend here

CVE-2022-46175 (High) detected in json5-2.2.0.tgz

CVE-2022-46175 - High Severity Vulnerability

Vulnerable Library - json5-2.2.0.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-2.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• confme-1.1.1.tgz (Root Library)
  • ❌ json5-2.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution: json5 - 2.2.2

---

Step up your Open Source Security Game with Mend here

Feature: Add apidoc

Is your feature request related to a problem? Please describe.
generate apidoc from rest-chronicle

CVE-2022-31051 (High) detected in semantic-release-19.0.2.tgz - autoclosed

CVE-2022-31051 - High Severity Vulnerability

Vulnerable Library - semantic-release-19.0.2.tgz

Automated semver compliant package publishing

Library home page: https://registry.npmjs.org/semantic-release/-/semantic-release-19.0.2.tgz

Dependency Hierarchy:

• ❌ semantic-release-19.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with encodeURI when included in a URL are already masked properly.

Publish Date: 2022-06-09

URL: CVE-2022-31051

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-x2pg-mjhr-2m5x

Release Date: 2022-06-09

Fix Resolution: 19.0.3

---

Step up your Open Source Security Game with Mend here

CVE-2022-23540 (High) detected in jsonwebtoken-8.5.1.tgz - autoclosed

CVE-2022-23540 - High Severity Vulnerability

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Dependency Hierarchy:

• danger-10.9.0.tgz (Root Library)
  • ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify() function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify() method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify() options.

Publish Date: 2022-12-22

URL: CVE-2022-23540

CVSS 3 Score Details (7.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: High
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540

Release Date: 2022-12-22

Fix Resolution (jsonwebtoken): 9.0.0

Direct dependency fix Resolution (danger): 11.2.1

---

Step up your Open Source Security Game with Mend here

WS-2021-0638 (High) detected in mocha-9.2.0.tgz - autoclosed

WS-2021-0638 - High Severity Vulnerability

Vulnerable Library - mocha-9.2.0.tgz

simple, flexible, fun test framework

Library home page: https://registry.npmjs.org/mocha/-/mocha-9.2.0.tgz

Dependency Hierarchy:

• ❌ mocha-9.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

There is regular Expression Denial of Service (ReDoS) vulnerability in mocha.
It allows cause a denial of service when stripping crafted invalid function definition from strs.

Publish Date: 2021-09-18

URL: WS-2021-0638

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-18

Fix Resolution: 10.1.0

---

Step up your Open Source Security Game with Mend here

CVE-2022-25883 (High) detected in semver-7.3.5.tgz

CVE-2022-25883 - High Severity Vulnerability

Vulnerable Library - semver-7.3.5.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.3.5.tgz

Dependency Hierarchy:

• cli-16.1.0.tgz (Root Library)
  • read-16.0.0.tgz
    • git-raw-commits-2.0.11.tgz
      • meow-8.1.2.tgz
        • normalize-package-data-3.0.3.tgz
          • ❌ semver-7.3.5.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution (semver): 7.5.2

Direct dependency fix Resolution (@commitlint/cli): 19.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2022-1214 (High) detected in axios-0.21.4.tgz, axios-0.25.0.tgz - autoclosed

CVE-2022-1214 - High Severity Vulnerability

Vulnerable Libraries - axios-0.21.4.tgz, axios-0.25.0.tgz

axios-0.21.4.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • base-api-client-1.5.3.tgz
    • ❌ axios-0.21.4.tgz (Vulnerable Library)

axios-0.25.0.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.25.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/base-api-client/node_modules/axios/package.json

Dependency Hierarchy:

• base-api-client-1.5.8.tgz (Root Library)
  • ❌ axios-0.25.0.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository axios/axios prior to 0.26.

Publish Date: 2022-05-03

URL: CVE-2022-1214

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/ef7b4ab6-a3f6-4268-a21a-e7104d344607/

Release Date: 2022-05-03

Fix Resolution: axios - v0.26.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2023-26143 (Critical) detected in blamer-1.0.1.tgz - autoclosed

CVE-2023-26143 - Critical Severity Vulnerability

Vulnerable Library - blamer-1.0.1.tgz

blamer is a tool for getting information about author of code from version control system

Library home page: https://registry.npmjs.org/blamer/-/blamer-1.0.1.tgz

Dependency Hierarchy:

• jscpd-3.4.5.tgz (Root Library)
  • finder-3.4.5.tgz
    • ❌ blamer-1.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.

Publish Date: 2023-09-19

URL: CVE-2023-26143

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9

Release Date: 2023-09-19

Fix Resolution (blamer): 1.0.4

Direct dependency fix Resolution (jscpd): 3.5.0

---

Step up your Open Source Security Game with Mend here

CVE-2023-43646 (High) detected in get-func-name-2.0.0.tgz - autoclosed

CVE-2023-43646 - High Severity Vulnerability

Vulnerable Library - get-func-name-2.0.0.tgz

Utility for getting a function's name for node and the browser

Library home page: https://registry.npmjs.org/get-func-name/-/get-func-name-2.0.0.tgz

Dependency Hierarchy:

• chai-4.3.6.tgz (Root Library)
  • ❌ get-func-name-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t'.repeat(54773) + '\t/function/i'. This issue has been addressed in commit f934b228b which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2023-09-27

URL: CVE-2023-43646

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4q6p-r6v2-jvc5

Release Date: 2023-09-27

Fix Resolution: get-func-name - 2.0.1,3.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2021-35065 (High) detected in glob-parent-5.1.2.tgz - autoclosed

CVE-2021-35065 - High Severity Vulnerability

Vulnerable Library - glob-parent-5.1.2.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

• cli-7.17.0.tgz (Root Library)
  • chokidar-3.5.3.tgz
    • ❌ glob-parent-5.1.2.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

The package glob-parent before 6.0.1 are vulnerable to Regular Expression Denial of Service (ReDoS)

Publish Date: 2021-06-22

URL: CVE-2021-35065

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cj88-88mr-972w

Release Date: 2021-06-22

Fix Resolution (glob-parent): 6.0.1

Direct dependency fix Resolution (@babel/cli): 7.17.3

---

Step up your Open Source Security Game with Mend here

CVE-2022-2900 (Critical) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-2900 - Critical Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.

Publish Date: 2022-09-14

URL: CVE-2022-2900

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-09-14

Fix Resolution (parse-url): 8.0.0

Direct dependency fix Resolution (semantic-release-telegram): 1.6.0

---

Step up your Open Source Security Game with Mend here

CVE-2022-23539 (High) detected in jsonwebtoken-8.5.1.tgz - autoclosed

CVE-2022-23539 - High Severity Vulnerability

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Dependency Hierarchy:

• danger-10.9.0.tgz (Root Library)
  • ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.

Publish Date: 2022-12-23

URL: CVE-2022-23539

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cf7-32gw-wr33

Release Date: 2022-12-23

Fix Resolution (jsonwebtoken): 9.0.0

Direct dependency fix Resolution (danger): 11.2.1

---

Step up your Open Source Security Game with Mend here

CVE-2021-4279 (Critical) detected in fast-json-patch-3.1.0.tgz - autoclosed

CVE-2021-4279 - Critical Severity Vulnerability

Vulnerable Library - fast-json-patch-3.1.0.tgz

Fast implementation of JSON-Patch (RFC-6902) with duplex (observe changes) capabilities

Library home page: https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-3.1.0.tgz

Dependency Hierarchy:

• danger-10.9.0.tgz (Root Library)
  • ❌ fast-json-patch-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.

Publish Date: 2022-12-25

URL: CVE-2021-4279

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2021-4279

Release Date: 2022-12-25

Fix Resolution (fast-json-patch): 3.1.1

Direct dependency fix Resolution (danger): 11.0.2

---

Step up your Open Source Security Game with Mend here

CVE-2022-2216 (Critical) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-2216 - Critical Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-2216

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/505a3d39-2723-4a06-b1f7-9b2d133c92e1/

Release Date: 2022-06-27

Fix Resolution (parse-url): 6.0.1

Direct dependency fix Resolution (semantic-release-telegram): 1.5.2

---

Step up your Open Source Security Game with Mend here

WS-2022-0238 (High) detected in parse-url-6.0.0.tgz - autoclosed

WS-2022-0238 - High Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

File Protocol Spoofing in parse-url before 8.0.0 can lead to attacks, such as XSS, Arbitrary Read/Write File, and Remote Code Execution.

Publish Date: 2022-06-30

URL: WS-2022-0238

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/52060edb-e426-431b-a0d0-e70407e44f18/

Release Date: 2022-06-30

Fix Resolution (parse-url): 8.0.0

Direct dependency fix Resolution (semantic-release-telegram): 1.6.0

---

Step up your Open Source Security Game with Mend here

CVE-2022-3517 (High) detected in minimatch-3.0.4.tgz - autoclosed

CVE-2022-3517 - High Severity Vulnerability

Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Dependency Hierarchy:

• eslint-8.8.0.tgz (Root Library)
  • ❌ minimatch-3.0.4.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5

---

Step up your Open Source Security Game with Mend here

CVE-2023-26115 (High) detected in word-wrap-1.2.3.tgz - autoclosed

CVE-2023-26115 - High Severity Vulnerability

Vulnerable Library - word-wrap-1.2.3.tgz

Wrap words to a specified length.

Library home page: https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.3.tgz

Dependency Hierarchy:

• eslint-8.8.0.tgz (Root Library)
  • optionator-0.9.1.tgz
    • ❌ word-wrap-1.2.3.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Publish Date: 2023-06-22

URL: CVE-2023-26115

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-j8xg-fqg3-53r7

Release Date: 2023-06-22

Fix Resolution: word-wrap - 1.2.4

---

Step up your Open Source Security Game with Mend here

CVE-2022-24999 (High) detected in qs-6.9.6.tgz

CVE-2022-24999 - High Severity Vulnerability

Vulnerable Library - qs-6.9.6.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.9.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• express-4.17.2.tgz (Root Library)
  • ❌ qs-6.9.6.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.9.7

Direct dependency fix Resolution (express): 4.17.3

---

Step up your Open Source Security Game with Mend here

CVE-2022-29622 (High) detected in formidable-2.0.1.tgz - autoclosed

CVE-2022-29622 - High Severity Vulnerability

Vulnerable Library - formidable-2.0.1.tgz

A node.js module for parsing form data, especially file uploads.

Library home page: https://registry.npmjs.org/formidable/-/formidable-2.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/formidable/package.json

Dependency Hierarchy:

• supertest-6.2.2.tgz (Root Library)
  • superagent-7.1.1.tgz
    • ❌ formidable-2.0.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled.
Mend Note: After conducting further research, Mend has determined that this is a controversial case - Mend security team suggest to refer to it as a risky feature and not as critical vulnerability

Publish Date: 2022-05-16

URL: CVE-2022-29622

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-05-16

Fix Resolution: formidable - 3.2.4

---

Step up your Open Source Security Game with Mend here

CVE-2022-2217 (Medium) detected in parse-url-6.0.0.tgz - autoclosed

CVE-2022-2217 - Medium Severity Vulnerability

Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Dependency Hierarchy:

• semantic-release-telegram-1.5.1.tgz (Root Library)
  • git-url-parse-11.6.0.tgz
    • git-up-4.0.5.tgz
      • ❌ parse-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 1935409b8ecca96fcded15e00801ae171e9cf439

Found in base branch: master

Vulnerability Details

Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-2217

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/4e046c63-b1ca-4bcc-b418-29796918a71b/

Release Date: 2022-06-27

Fix Resolution (parse-url): 6.0.1

Direct dependency fix Resolution (semantic-release-telegram): 1.5.2

---

Step up your Open Source Security Game with Mend here