org_name_change's People
org_name_change's Issues
react-scripts-5.0.1.tgz: 3 vulnerabilities (highest severity is: 7.5) - autoclosed
Vulnerable Library - react-scripts-5.0.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/terser/package.json
Found in HEAD commit: 93579a11236837cb74c2f23df20a2c82f3b3ad60
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2021-33587 | 7.5 | css-what-3.4.2.tgz | Transitive | N/A | ❌ | |
CVE-2022-25858 | 7.5 | terser-5.14.1.tgz | Transitive | N/A | ❌ | |
CVE-2021-3803 | 7.5 | nth-check-1.0.2.tgz | Transitive | N/A | ❌ |
Details
CVE-2021-33587
Vulnerable Library - css-what-3.4.2.tgz
a CSS selector parser
Library home page: https://registry.npmjs.org/css-what/-/css-what-3.4.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/svgo/node_modules/css-what/package.json
Dependency Hierarchy:
- react-scripts-5.0.1.tgz (Root Library)
- webpack-5.5.0.tgz
- plugin-svgo-5.5.0.tgz
- svgo-1.3.2.tgz
- css-select-2.1.0.tgz
- ❌ css-what-3.4.2.tgz (Vulnerable Library)
- css-select-2.1.0.tgz
- svgo-1.3.2.tgz
- plugin-svgo-5.5.0.tgz
- webpack-5.5.0.tgz
Found in HEAD commit: 93579a11236837cb74c2f23df20a2c82f3b3ad60
Found in base branch: main
Vulnerability Details
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
Publish Date: 2021-05-28
URL: CVE-2021-33587
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587
Release Date: 2021-05-28
Fix Resolution: css-what - 5.0.1
CVE-2022-25858
Vulnerable Library - terser-5.14.1.tgz
JavaScript parser, mangler/compressor and beautifier toolkit for ES6+
Library home page: https://registry.npmjs.org/terser/-/terser-5.14.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/terser/package.json
Dependency Hierarchy:
- react-scripts-5.0.1.tgz (Root Library)
- terser-webpack-plugin-5.3.3.tgz
- ❌ terser-5.14.1.tgz (Vulnerable Library)
- terser-webpack-plugin-5.3.3.tgz
Found in HEAD commit: 93579a11236837cb74c2f23df20a2c82f3b3ad60
Found in base branch: main
Vulnerability Details
The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
Publish Date: 2022-07-15
URL: CVE-2022-25858
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25858
Release Date: 2022-07-15
Fix Resolution: terser - 4.8.1,5.14.2
CVE-2021-3803
Vulnerable Library - nth-check-1.0.2.tgz
performant nth-check parser & compiler
Library home page: https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/svgo/node_modules/nth-check/package.json
Dependency Hierarchy:
- react-scripts-5.0.1.tgz (Root Library)
- webpack-5.5.0.tgz
- plugin-svgo-5.5.0.tgz
- svgo-1.3.2.tgz
- css-select-2.1.0.tgz
- ❌ nth-check-1.0.2.tgz (Vulnerable Library)
- css-select-2.1.0.tgz
- svgo-1.3.2.tgz
- plugin-svgo-5.5.0.tgz
- webpack-5.5.0.tgz
Found in HEAD commit: 93579a11236837cb74c2f23df20a2c82f3b3ad60
Found in base branch: main
Vulnerability Details
nth-check is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3803
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-09-17
Fix Resolution: nth-check - v2.0.1
react-scripts-2.1.8.tgz: 24 vulnerabilities (highest severity is: 9.8)
Vulnerable Library - react-scripts-2.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-dev-utils/node_modules/glob-parent/package.json,/node_modules/chokidar/node_modules/glob-parent/package.json
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2021-23436 | 9.8 | immer-1.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2020-28499 | 9.8 | merge-1.2.1.tgz | Transitive | 3.0.0 | ✅ | |
CVE-2021-3757 | 9.8 | immer-1.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2021-42740 | 9.8 | shell-quote-1.6.1.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2020-7660 | 8.1 | serialize-javascript-1.9.1.tgz | Transitive | 3.4.3 | ✅ | |
CVE-2021-23424 | 7.5 | ansi-html-0.0.7.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2022-25858 | 7.5 | terser-3.17.0.tgz | Transitive | N/A | ❌ | |
CVE-2020-28477 | 7.5 | immer-1.10.0.tgz | Transitive | 4.0.0 | ✅ | |
CVE-2020-28469 | 7.5 | detected in multiple dependencies | Transitive | 5.0.0 | ✅ | |
WS-2020-0042 | 7.5 | acorn-5.7.4.tgz | Transitive | 4.0.0 | ✅ | |
CVE-2021-33502 | 7.5 | normalize-url-3.3.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2021-33587 | 7.5 | css-what-3.4.2.tgz | Transitive | 5.0.1 | ✅ | |
CVE-2021-23382 | 7.5 | postcss-6.0.23.tgz | Transitive | 3.0.0 | ✅ | |
CVE-2022-24772 | 7.5 | node-forge-0.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2022-24771 | 7.5 | node-forge-0.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2021-3803 | 7.5 | nth-check-1.0.2.tgz | Transitive | 5.0.1 | ✅ | |
WS-2022-0008 | 6.6 | node-forge-0.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2022-0122 | 6.1 | node-forge-0.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2021-24033 | 5.6 | react-dev-utils-8.0.0.tgz | Transitive | 4.0.0 | ✅ | |
CVE-2019-16769 | 5.4 | serialize-javascript-1.9.1.tgz | Transitive | 3.3.0 | ✅ | |
CVE-2020-7693 | 5.3 | sockjs-0.3.19.tgz | Transitive | 3.4.2 | ✅ | |
CVE-2020-7608 | 5.3 | detected in multiple dependencies | Transitive | 3.4.2 | ✅ | |
CVE-2022-24773 | 5.3 | node-forge-0.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2021-23364 | 5.3 | browserslist-4.4.1.tgz | Transitive | 3.0.0 | ✅ |
Details
CVE-2021-23436
Vulnerable Library - immer-1.10.0.tgz
Create your next immutable state by mutating the current one
Library home page: https://registry.npmjs.org/immer/-/immer-1.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/immer/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- react-dev-utils-8.0.0.tgz
- ❌ immer-1.10.0.tgz (Vulnerable Library)
- react-dev-utils-8.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "proto" || p === "constructor") in applyPatches_ returns false if p is ['proto'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.
Publish Date: 2021-09-01
URL: CVE-2021-23436
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23436
Release Date: 2021-09-01
Fix Resolution (immer): 9.0.6
Direct dependency fix Resolution (react-scripts): 5.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2020-28499
Vulnerable Library - merge-1.2.1.tgz
Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.
Library home page: https://registry.npmjs.org/merge/-/merge-1.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/merge/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- jest-23.6.0.tgz
- jest-cli-23.6.0.tgz
- jest-haste-map-23.6.0.tgz
- sane-2.5.2.tgz
- exec-sh-0.2.2.tgz
- ❌ merge-1.2.1.tgz (Vulnerable Library)
- exec-sh-0.2.2.tgz
- sane-2.5.2.tgz
- jest-haste-map-23.6.0.tgz
- jest-cli-23.6.0.tgz
- jest-23.6.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .
Publish Date: 2021-02-18
URL: CVE-2020-28499
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-02-18
Fix Resolution (merge): 2.1.0
Direct dependency fix Resolution (react-scripts): 3.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2021-3757
Vulnerable Library - immer-1.10.0.tgz
Create your next immutable state by mutating the current one
Library home page: https://registry.npmjs.org/immer/-/immer-1.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/immer/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- react-dev-utils-8.0.0.tgz
- ❌ immer-1.10.0.tgz (Vulnerable Library)
- react-dev-utils-8.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Publish Date: 2021-09-02
URL: CVE-2021-3757
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa/
Release Date: 2021-09-02
Fix Resolution (immer): 9.0.6
Direct dependency fix Resolution (react-scripts): 5.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2021-42740
Vulnerable Library - shell-quote-1.6.1.tgz
quote and parse shell commands
Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.6.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/shell-quote/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- react-dev-utils-8.0.0.tgz
- ❌ shell-quote-1.6.1.tgz (Vulnerable Library)
- react-dev-utils-8.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Publish Date: 2021-10-21
URL: CVE-2021-42740
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740
Release Date: 2021-10-21
Fix Resolution (shell-quote): 1.7.3
Direct dependency fix Resolution (react-scripts): 5.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2020-7660
Vulnerable Library - serialize-javascript-1.9.1.tgz
Serialize JavaScript to a superset of JSON that includes regular expressions and functions.
Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.9.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-scripts/node_modules/serialize-javascript/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- terser-webpack-plugin-1.2.2.tgz
- ❌ serialize-javascript-1.9.1.tgz (Vulnerable Library)
- terser-webpack-plugin-1.2.2.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Publish Date: 2020-06-01
URL: CVE-2020-7660
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660
Release Date: 2020-06-08
Fix Resolution (serialize-javascript): 3.1.0
Direct dependency fix Resolution (react-scripts): 3.4.3
⛑️ Automatic Remediation is available for this issue
CVE-2021-23424
Vulnerable Library - ansi-html-0.0.7.tgz
An elegant lib that converts the chalked (ANSI) text to HTML.
Library home page: https://registry.npmjs.org/ansi-html/-/ansi-html-0.0.7.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ansi-html/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- ❌ ansi-html-0.0.7.tgz (Vulnerable Library)
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.
Publish Date: 2021-08-18
URL: CVE-2021-23424
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-23424
Release Date: 2021-08-18
Fix Resolution (ansi-html): 0.0.8
Direct dependency fix Resolution (react-scripts): 5.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2022-25858
Vulnerable Library - terser-3.17.0.tgz
JavaScript parser, mangler/compressor and beautifier toolkit for ES6+
Library home page: https://registry.npmjs.org/terser/-/terser-3.17.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-scripts/node_modules/terser/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- terser-webpack-plugin-1.2.2.tgz
- ❌ terser-3.17.0.tgz (Vulnerable Library)
- terser-webpack-plugin-1.2.2.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
Publish Date: 2022-07-15
URL: CVE-2022-25858
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25858
Release Date: 2022-07-15
Fix Resolution: terser - 4.8.1,5.14.2
CVE-2020-28477
Vulnerable Library - immer-1.10.0.tgz
Create your next immutable state by mutating the current one
Library home page: https://registry.npmjs.org/immer/-/immer-1.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/immer/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- react-dev-utils-8.0.0.tgz
- ❌ immer-1.10.0.tgz (Vulnerable Library)
- react-dev-utils-8.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
This affects all versions of package immer.
Publish Date: 2021-01-19
URL: CVE-2020-28477
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-01-19
Fix Resolution (immer): 8.0.1
Direct dependency fix Resolution (react-scripts): 4.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2020-28469
Vulnerable Libraries - glob-parent-2.0.0.tgz, glob-parent-3.1.0.tgz
glob-parent-2.0.0.tgz
Strips glob magic from a string to provide the parent path
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/glob-base/node_modules/glob-parent/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- jest-23.6.0.tgz
- jest-cli-23.6.0.tgz
- micromatch-2.3.11.tgz
- parse-glob-3.0.4.tgz
- glob-base-0.3.0.tgz
- ❌ glob-parent-2.0.0.tgz (Vulnerable Library)
- glob-base-0.3.0.tgz
- parse-glob-3.0.4.tgz
- micromatch-2.3.11.tgz
- jest-cli-23.6.0.tgz
- jest-23.6.0.tgz
glob-parent-3.1.0.tgz
Strips glob magic from a string to provide the parent directory path
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-dev-utils/node_modules/glob-parent/package.json,/node_modules/chokidar/node_modules/glob-parent/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- chokidar-2.1.8.tgz
- ❌ glob-parent-3.1.0.tgz (Vulnerable Library)
- chokidar-2.1.8.tgz
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Publish Date: 2021-06-03
URL: CVE-2020-28469
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
Release Date: 2021-06-03
Fix Resolution (glob-parent): 5.1.2
Direct dependency fix Resolution (react-scripts): 5.0.0
Fix Resolution (glob-parent): 5.1.2
Direct dependency fix Resolution (react-scripts): 5.0.0
⛑️ Automatic Remediation is available for this issue
WS-2020-0042
Vulnerable Library - acorn-5.7.4.tgz
ECMAScript parser
Library home page: https://registry.npmjs.org/acorn/-/acorn-5.7.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/acorn-dynamic-import/node_modules/acorn/package.json,/node_modules/jsdom/node_modules/acorn/package.json,/node_modules/react-scripts/node_modules/acorn/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- jest-23.6.0.tgz
- jest-cli-23.6.0.tgz
- jest-environment-jsdom-23.4.0.tgz
- jsdom-11.12.0.tgz
- ❌ acorn-5.7.4.tgz (Vulnerable Library)
- jsdom-11.12.0.tgz
- jest-environment-jsdom-23.4.0.tgz
- jest-cli-23.6.0.tgz
- jest-23.6.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
acorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.
Publish Date: 2020-03-01
URL: WS-2020-0042
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1488
Release Date: 2020-03-01
Fix Resolution (acorn): 6.4.1
Direct dependency fix Resolution (react-scripts): 4.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2021-33502
Vulnerable Library - normalize-url-3.3.0.tgz
Normalize a URL
Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-3.3.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/normalize-url/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- optimize-css-assets-webpack-plugin-5.0.1.tgz
- cssnano-4.1.11.tgz
- cssnano-preset-default-4.0.8.tgz
- postcss-normalize-url-4.0.1.tgz
- ❌ normalize-url-3.3.0.tgz (Vulnerable Library)
- postcss-normalize-url-4.0.1.tgz
- cssnano-preset-default-4.0.8.tgz
- cssnano-4.1.11.tgz
- optimize-css-assets-webpack-plugin-5.0.1.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
Publish Date: 2021-05-24
URL: CVE-2021-33502
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502
Release Date: 2021-05-24
Fix Resolution (normalize-url): 4.5.1
Direct dependency fix Resolution (react-scripts): 5.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2021-33587
Vulnerable Library - css-what-3.4.2.tgz
a CSS selector parser
Library home page: https://registry.npmjs.org/css-what/-/css-what-3.4.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/css-what/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-4.1.0.tgz
- plugin-svgo-4.3.1.tgz
- svgo-1.3.2.tgz
- css-select-2.1.0.tgz
- ❌ css-what-3.4.2.tgz (Vulnerable Library)
- css-select-2.1.0.tgz
- svgo-1.3.2.tgz
- plugin-svgo-4.3.1.tgz
- webpack-4.1.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
Publish Date: 2021-05-28
URL: CVE-2021-33587
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587
Release Date: 2021-05-28
Fix Resolution (css-what): 5.0.1
Direct dependency fix Resolution (react-scripts): 5.0.1
⛑️ Automatic Remediation is available for this issue
CVE-2021-23382
Vulnerable Library - postcss-6.0.23.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/postcss-modules-extract-imports/node_modules/postcss/package.json,/node_modules/icss-utils/node_modules/postcss/package.json,/node_modules/postcss-modules-scope/node_modules/postcss/package.json,/node_modules/postcss-modules-values/node_modules/postcss/package.json,/node_modules/react-scripts/node_modules/postcss/package.json,/node_modules/postcss-modules-local-by-default/node_modules/postcss/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- css-loader-1.0.0.tgz
- ❌ postcss-6.0.23.tgz (Vulnerable Library)
- css-loader-1.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).
Publish Date: 2021-04-26
URL: CVE-2021-23382
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382
Release Date: 2021-04-26
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (react-scripts): 3.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2022-24772
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- selfsigned-1.10.14.tgz
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
- selfsigned-1.10.14.tgz
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo
ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24772
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (react-scripts): 5.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2022-24771
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- selfsigned-1.10.14.tgz
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
- selfsigned-1.10.14.tgz
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24771
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (react-scripts): 5.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2021-3803
Vulnerable Library - nth-check-1.0.2.tgz
performant nth-check parser & compiler
Library home page: https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nth-check/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-4.1.0.tgz
- plugin-svgo-4.3.1.tgz
- svgo-1.3.2.tgz
- css-select-2.1.0.tgz
- ❌ nth-check-1.0.2.tgz (Vulnerable Library)
- css-select-2.1.0.tgz
- svgo-1.3.2.tgz
- plugin-svgo-4.3.1.tgz
- webpack-4.1.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
nth-check is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3803
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-09-17
Fix Resolution (nth-check): 2.0.1
Direct dependency fix Resolution (react-scripts): 5.0.1
⛑️ Automatic Remediation is available for this issue
WS-2022-0008
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- selfsigned-1.10.14.tgz
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
- selfsigned-1.10.14.tgz
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.
Publish Date: 2022-01-08
URL: WS-2022-0008
CVSS 3 Score Details (6.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-5rrq-pxf6-6jx5
Release Date: 2022-01-08
Fix Resolution (node-forge): 1.0.0
Direct dependency fix Resolution (react-scripts): 5.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2022-0122
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- selfsigned-1.10.14.tgz
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
- selfsigned-1.10.14.tgz
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
forge is vulnerable to URL Redirection to Untrusted Site
Publish Date: 2022-01-06
URL: CVE-2022-0122
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-gf8q-jrpm-jvxq
Release Date: 2022-01-06
Fix Resolution (node-forge): 1.0.0
Direct dependency fix Resolution (react-scripts): 5.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2021-24033
Vulnerable Library - react-dev-utils-8.0.0.tgz
Webpack utilities used by Create React App
Library home page: https://registry.npmjs.org/react-dev-utils/-/react-dev-utils-8.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-dev-utils/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- ❌ react-dev-utils-8.0.0.tgz (Vulnerable Library)
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
Publish Date: 2021-03-09
URL: CVE-2021-24033
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://www.facebook.com/security/advisories/cve-2021-24033
Release Date: 2021-03-09
Fix Resolution (react-dev-utils): 11.0.4
Direct dependency fix Resolution (react-scripts): 4.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2019-16769
Vulnerable Library - serialize-javascript-1.9.1.tgz
Serialize JavaScript to a superset of JSON that includes regular expressions and functions.
Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.9.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-scripts/node_modules/serialize-javascript/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- terser-webpack-plugin-1.2.2.tgz
- ❌ serialize-javascript-1.9.1.tgz (Vulnerable Library)
- terser-webpack-plugin-1.2.2.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.
Publish Date: 2019-12-05
URL: CVE-2019-16769
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16769
Release Date: 2020-01-17
Fix Resolution (serialize-javascript): 2.1.1
Direct dependency fix Resolution (react-scripts): 3.3.0
⛑️ Automatic Remediation is available for this issue
CVE-2020-7693
Vulnerable Library - sockjs-0.3.19.tgz
SockJS-node is a server counterpart of SockJS-client a JavaScript library that provides a WebSocket-like object in the browser. SockJS gives you a coherent, cross-browser, Javascript API which creates a low latency, full duplex, cross-domain communication
Library home page: https://registry.npmjs.org/sockjs/-/sockjs-0.3.19.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/sockjs/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- ❌ sockjs-0.3.19.tgz (Vulnerable Library)
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
Publish Date: 2020-07-09
URL: CVE-2020-7693
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Release Date: 2020-07-14
Fix Resolution (sockjs): 0.3.20
Direct dependency fix Resolution (react-scripts): 3.4.2
⛑️ Automatic Remediation is available for this issue
CVE-2020-7608
Vulnerable Libraries - yargs-parser-9.0.2.tgz, yargs-parser-10.1.0.tgz
yargs-parser-9.0.2.tgz
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-9.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/yargs-parser/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- jest-23.6.0.tgz
- jest-cli-23.6.0.tgz
- yargs-11.1.1.tgz
- ❌ yargs-parser-9.0.2.tgz (Vulnerable Library)
- yargs-11.1.1.tgz
- jest-cli-23.6.0.tgz
- jest-23.6.0.tgz
yargs-parser-10.1.0.tgz
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-10.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-scripts/node_modules/yargs-parser/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- yargs-12.0.2.tgz
- ❌ yargs-parser-10.1.0.tgz (Vulnerable Library)
- yargs-12.0.2.tgz
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
Publish Date: 2020-03-16
URL: CVE-2020-7608
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Release Date: 2020-03-16
Fix Resolution (yargs-parser): 13.1.2
Direct dependency fix Resolution (react-scripts): 3.4.2
Fix Resolution (yargs-parser): 13.1.2
Direct dependency fix Resolution (react-scripts): 3.4.2
⛑️ Automatic Remediation is available for this issue
CVE-2022-24773
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- selfsigned-1.10.14.tgz
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
- selfsigned-1.10.14.tgz
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo
for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24773
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (react-scripts): 5.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2021-23364
Vulnerable Library - browserslist-4.4.1.tgz
Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset
Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.4.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-dev-utils/node_modules/browserslist/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- react-dev-utils-8.0.0.tgz
- ❌ browserslist-4.4.1.tgz (Vulnerable Library)
- react-dev-utils-8.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Publish Date: 2021-04-28
URL: CVE-2021-23364
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364
Release Date: 2021-04-28
Fix Resolution (browserslist): 4.16.5
Direct dependency fix Resolution (react-scripts): 3.0.0
⛑️ Automatic Remediation is available for this issue
⛑️ Automatic Remediation is available for this issue.
Action Required: Fix Mend Configuration File - .whitesource
There is an error with this repository's Mend configuration file that needs to be fixed. As a precaution, scans will stop until it is resolved.
Errors:
- "settingsInheritedFrom" attribute provided in H-459/Org_name_change/.whitesource points to a non-existent repository or branch: 'H-459/whitesource-config@main'
jest-dom-5.16.4.tgz: 1 vulnerabilities (highest severity is: 7.5)
Vulnerable Library - jest-dom-5.16.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/decode-uri-component/package.json
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in (jest-dom version) | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2022-38900 | 7.5 | decode-uri-component-0.2.0.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2022-38900
Vulnerable Library - decode-uri-component-0.2.0.tgz
A better decodeURIComponent
Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/decode-uri-component/package.json
Dependency Hierarchy:
- jest-dom-5.16.4.tgz (Root Library)
- css-3.0.0.tgz
- source-map-resolve-0.6.0.tgz
- ❌ decode-uri-component-0.2.0.tgz (Vulnerable Library)
- source-map-resolve-0.6.0.tgz
- css-3.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
Publish Date: 2022-11-28
URL: CVE-2022-38900
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-w573-4hg7-7wgq
Release Date: 2022-11-28
Fix Resolution: decode-uri-component - 0.2.1
react-scripts-2.1.8.tgz: 28 vulnerabilities (highest severity is: 9.8)
Vulnerable Library - react-scripts-2.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-dev-utils/node_modules/loader-utils/package.json
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in (react-scripts version) | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2022-37601 | 9.8 | loader-utils-1.2.3.tgz | Transitive | 4.0.0 | ✅ | |
CVE-2021-23436 | 9.8 | immer-1.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2020-28499 | 9.8 | merge-1.2.1.tgz | Transitive | 3.0.0 | ✅ | |
CVE-2022-37598 | 9.8 | uglify-js-3.4.10.tgz | Transitive | 3.3.1 | ✅ | |
CVE-2021-3757 | 9.8 | immer-1.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2021-23440 | 9.8 | set-value-2.0.1.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2021-42740 | 9.8 | shell-quote-1.6.1.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2022-46175 | 8.8 | detected in multiple dependencies | Transitive | 3.0.0 | ✅ | |
CVE-2020-7660 | 8.1 | serialize-javascript-1.9.1.tgz | Transitive | 3.4.3 | ✅ | |
CVE-2021-23424 | 7.5 | ansi-html-0.0.7.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2022-25858 | 7.5 | terser-3.17.0.tgz | Transitive | 3.1.0 | ✅ | |
CVE-2020-28469 | 7.5 | detected in multiple dependencies | Transitive | 5.0.0 | ✅ | |
CVE-2022-37620 | 7.5 | html-minifier-3.5.21.tgz | Transitive | N/A* | ❌ | |
CVE-2022-24772 | 7.5 | node-forge-0.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2022-24771 | 7.5 | node-forge-0.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2021-3803 | 7.5 | nth-check-1.0.2.tgz | Transitive | 5.0.1 | ✅ | |
CVE-2020-28477 | 7.5 | immer-1.10.0.tgz | Transitive | 4.0.0 | ✅ | |
CVE-2022-3517 | 7.5 | minimatch-3.0.4.tgz | Transitive | N/A* | ❌ | |
CVE-2021-23382 | 7.5 | postcss-6.0.23.tgz | Transitive | 3.0.0 | ✅ | |
CVE-2022-37603 | 7.5 | loader-utils-1.2.3.tgz | Transitive | 5.0.1 | ✅ | |
WS-2022-0008 | 6.6 | node-forge-0.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2022-0122 | 6.1 | node-forge-0.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2021-24033 | 5.6 | react-dev-utils-8.0.0.tgz | Transitive | 4.0.0 | ✅ | |
CVE-2019-16769 | 5.4 | serialize-javascript-1.9.1.tgz | Transitive | 3.3.0 | ✅ | |
CVE-2020-7693 | 5.3 | sockjs-0.3.19.tgz | Transitive | 3.4.2 | ✅ | |
CVE-2022-24773 | 5.3 | node-forge-0.10.0.tgz | Transitive | 5.0.0 | ✅ | |
CVE-2020-7608 | 5.3 | detected in multiple dependencies | Transitive | 3.4.2 | ✅ | |
CVE-2021-23364 | 5.3 | browserslist-4.4.1.tgz | Transitive | 5.0.0 | ✅ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
Partial details (22 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
CVE-2022-37601
Vulnerable Library - loader-utils-1.2.3.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-dev-utils/node_modules/loader-utils/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- react-dev-utils-8.0.0.tgz
- ❌ loader-utils-1.2.3.tgz (Vulnerable Library)
- react-dev-utils-8.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.
Publish Date: 2022-10-12
URL: CVE-2022-37601
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2022-10-12
Fix Resolution (loader-utils): 1.4.1
Direct dependency fix Resolution (react-scripts): 4.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-23436
Vulnerable Library - immer-1.10.0.tgz
Create your next immutable state by mutating the current one
Library home page: https://registry.npmjs.org/immer/-/immer-1.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/immer/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- react-dev-utils-8.0.0.tgz
- ❌ immer-1.10.0.tgz (Vulnerable Library)
- react-dev-utils-8.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "proto" || p === "constructor") in applyPatches_ returns false if p is ['proto'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.
Publish Date: 2021-09-01
URL: CVE-2021-23436
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23436
Release Date: 2021-09-01
Fix Resolution (immer): 9.0.6
Direct dependency fix Resolution (react-scripts): 5.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2020-28499
Vulnerable Library - merge-1.2.1.tgz
Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.
Library home page: https://registry.npmjs.org/merge/-/merge-1.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/merge/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- jest-23.6.0.tgz
- jest-cli-23.6.0.tgz
- jest-haste-map-23.6.0.tgz
- sane-2.5.2.tgz
- exec-sh-0.2.2.tgz
- ❌ merge-1.2.1.tgz (Vulnerable Library)
- exec-sh-0.2.2.tgz
- sane-2.5.2.tgz
- jest-haste-map-23.6.0.tgz
- jest-cli-23.6.0.tgz
- jest-23.6.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .
Publish Date: 2021-02-18
URL: CVE-2020-28499
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-02-18
Fix Resolution (merge): 2.1.0
Direct dependency fix Resolution (react-scripts): 3.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-37598
Vulnerable Library - uglify-js-3.4.10.tgz
JavaScript parser, mangler/compressor and beautifier toolkit
Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-3.4.10.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/html-minifier/node_modules/uglify-js/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- html-webpack-plugin-4.0.0-alpha.2.tgz
- html-minifier-3.5.21.tgz
- ❌ uglify-js-3.4.10.tgz (Vulnerable Library)
- html-minifier-3.5.21.tgz
- html-webpack-plugin-4.0.0-alpha.2.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
** DISPUTED ** Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.
Publish Date: 2022-10-20
URL: CVE-2022-37598
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2022-10-20
Fix Resolution (uglify-js): 3.13.10
Direct dependency fix Resolution (react-scripts): 3.3.1
In order to enable automatic remediation, please create workflow rules
CVE-2021-3757
Vulnerable Library - immer-1.10.0.tgz
Create your next immutable state by mutating the current one
Library home page: https://registry.npmjs.org/immer/-/immer-1.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/immer/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- react-dev-utils-8.0.0.tgz
- ❌ immer-1.10.0.tgz (Vulnerable Library)
- react-dev-utils-8.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Publish Date: 2021-09-02
URL: CVE-2021-3757
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa/
Release Date: 2021-09-02
Fix Resolution (immer): 9.0.6
Direct dependency fix Resolution (react-scripts): 5.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-23440
Vulnerable Library - set-value-2.0.1.tgz
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/set-value/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-4.28.3.tgz
- micromatch-3.1.10.tgz
- snapdragon-0.8.2.tgz
- base-0.11.2.tgz
- cache-base-1.0.1.tgz
- ❌ set-value-2.0.1.tgz (Vulnerable Library)
- cache-base-1.0.1.tgz
- base-0.11.2.tgz
- snapdragon-0.8.2.tgz
- micromatch-3.1.10.tgz
- webpack-4.28.3.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
Mend Note: After conducting further research, Mend has determined that all versions of set-value up to version 4.0.0 are vulnerable to CVE-2021-23440.
Publish Date: 2021-09-12
URL: CVE-2021-23440
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-09-12
Fix Resolution (set-value): 4.0.1
Direct dependency fix Resolution (react-scripts): 5.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-42740
Vulnerable Library - shell-quote-1.6.1.tgz
quote and parse shell commands
Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.6.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/shell-quote/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- react-dev-utils-8.0.0.tgz
- ❌ shell-quote-1.6.1.tgz (Vulnerable Library)
- react-dev-utils-8.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Publish Date: 2021-10-21
URL: CVE-2021-42740
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740
Release Date: 2021-10-21
Fix Resolution (shell-quote): 1.7.3
Direct dependency fix Resolution (react-scripts): 5.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-46175
Vulnerable Libraries - json5-0.5.1.tgz, json5-2.2.1.tgz
json5-0.5.1.tgz
JSON for the ES5 era.
Library home page: https://registry.npmjs.org/json5/-/json5-0.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/babel-register/node_modules/json5/package.json,/node_modules/jest-runtime/node_modules/json5/package.json,/node_modules/jest-config/node_modules/json5/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- jest-23.6.0.tgz
- jest-cli-23.6.0.tgz
- jest-runtime-23.6.0.tgz
- babel-core-6.26.3.tgz
- ❌ json5-0.5.1.tgz (Vulnerable Library)
- babel-core-6.26.3.tgz
- jest-runtime-23.6.0.tgz
- jest-cli-23.6.0.tgz
- jest-23.6.0.tgz
json5-2.2.1.tgz
JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-2.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/json5/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- core-7.2.2.tgz
- ❌ json5-2.2.1.tgz (Vulnerable Library)
- core-7.2.2.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse
method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__
, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse
and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse
. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse
should restrict parsing of __proto__
keys when parsing JSON strings to objects. As a point of reference, the JSON.parse
method included in JavaScript ignores __proto__
keys. Simply changing JSON5.parse
to JSON.parse
in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.
Publish Date: 2022-12-24
URL: CVE-2022-46175
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175
Release Date: 2022-12-24
Fix Resolution (json5): 1.0.2
Direct dependency fix Resolution (react-scripts): 3.0.0
Fix Resolution (json5): 2.2.2
Direct dependency fix Resolution (react-scripts): 3.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2020-7660
Vulnerable Library - serialize-javascript-1.9.1.tgz
Serialize JavaScript to a superset of JSON that includes regular expressions and functions.
Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.9.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-scripts/node_modules/serialize-javascript/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- terser-webpack-plugin-1.2.2.tgz
- ❌ serialize-javascript-1.9.1.tgz (Vulnerable Library)
- terser-webpack-plugin-1.2.2.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Publish Date: 2020-06-01
URL: CVE-2020-7660
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660
Release Date: 2020-06-08
Fix Resolution (serialize-javascript): 3.1.0
Direct dependency fix Resolution (react-scripts): 3.4.3
In order to enable automatic remediation, please create workflow rules
CVE-2021-23424
Vulnerable Library - ansi-html-0.0.7.tgz
An elegant lib that converts the chalked (ANSI) text to HTML.
Library home page: https://registry.npmjs.org/ansi-html/-/ansi-html-0.0.7.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ansi-html/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- ❌ ansi-html-0.0.7.tgz (Vulnerable Library)
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.
Publish Date: 2021-08-18
URL: CVE-2021-23424
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-23424
Release Date: 2021-08-18
Fix Resolution (ansi-html): 0.0.8
Direct dependency fix Resolution (react-scripts): 5.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-25858
Vulnerable Library - terser-3.17.0.tgz
JavaScript parser, mangler/compressor and beautifier toolkit for ES6+
Library home page: https://registry.npmjs.org/terser/-/terser-3.17.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-scripts/node_modules/terser/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- terser-webpack-plugin-1.2.2.tgz
- ❌ terser-3.17.0.tgz (Vulnerable Library)
- terser-webpack-plugin-1.2.2.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
Publish Date: 2022-07-15
URL: CVE-2022-25858
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25858
Release Date: 2022-07-15
Fix Resolution (terser): 4.8.1
Direct dependency fix Resolution (react-scripts): 3.1.0
In order to enable automatic remediation, please create workflow rules
CVE-2020-28469
Vulnerable Libraries - glob-parent-3.1.0.tgz, glob-parent-2.0.0.tgz
glob-parent-3.1.0.tgz
Strips glob magic from a string to provide the parent directory path
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/chokidar/node_modules/glob-parent/package.json,/node_modules/react-dev-utils/node_modules/glob-parent/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- chokidar-2.1.8.tgz
- ❌ glob-parent-3.1.0.tgz (Vulnerable Library)
- chokidar-2.1.8.tgz
- webpack-dev-server-3.1.14.tgz
glob-parent-2.0.0.tgz
Strips glob magic from a string to provide the parent path
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/glob-base/node_modules/glob-parent/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- jest-23.6.0.tgz
- jest-cli-23.6.0.tgz
- micromatch-2.3.11.tgz
- parse-glob-3.0.4.tgz
- glob-base-0.3.0.tgz
- ❌ glob-parent-2.0.0.tgz (Vulnerable Library)
- glob-base-0.3.0.tgz
- parse-glob-3.0.4.tgz
- micromatch-2.3.11.tgz
- jest-cli-23.6.0.tgz
- jest-23.6.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Publish Date: 2021-06-03
URL: CVE-2020-28469
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
Release Date: 2021-06-03
Fix Resolution (glob-parent): 5.1.2
Direct dependency fix Resolution (react-scripts): 5.0.0
Fix Resolution (glob-parent): 5.1.2
Direct dependency fix Resolution (react-scripts): 5.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-37620
Vulnerable Library - html-minifier-3.5.21.tgz
Highly configurable, well-tested, JavaScript-based HTML minifier.
Library home page: https://registry.npmjs.org/html-minifier/-/html-minifier-3.5.21.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/html-minifier/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- html-webpack-plugin-4.0.0-alpha.2.tgz
- ❌ html-minifier-3.5.21.tgz (Vulnerable Library)
- html-webpack-plugin-4.0.0-alpha.2.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 via the candidate variable in htmlminifier.js.
Publish Date: 2022-10-31
URL: CVE-2022-37620
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
CVE-2022-24772
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- selfsigned-1.10.14.tgz
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
- selfsigned-1.10.14.tgz
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo
ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24772
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (react-scripts): 5.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-24771
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- selfsigned-1.10.14.tgz
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
- selfsigned-1.10.14.tgz
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24771
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (react-scripts): 5.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-3803
Vulnerable Library - nth-check-1.0.2.tgz
performant nth-check parser & compiler
Library home page: https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nth-check/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-4.1.0.tgz
- plugin-svgo-4.3.1.tgz
- svgo-1.3.2.tgz
- css-select-2.1.0.tgz
- ❌ nth-check-1.0.2.tgz (Vulnerable Library)
- css-select-2.1.0.tgz
- svgo-1.3.2.tgz
- plugin-svgo-4.3.1.tgz
- webpack-4.1.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
nth-check is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3803
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-09-17
Fix Resolution (nth-check): 2.0.1
Direct dependency fix Resolution (react-scripts): 5.0.1
In order to enable automatic remediation, please create workflow rules
CVE-2020-28477
Vulnerable Library - immer-1.10.0.tgz
Create your next immutable state by mutating the current one
Library home page: https://registry.npmjs.org/immer/-/immer-1.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/immer/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- react-dev-utils-8.0.0.tgz
- ❌ immer-1.10.0.tgz (Vulnerable Library)
- react-dev-utils-8.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
This affects all versions of package immer.
Publish Date: 2021-01-19
URL: CVE-2020-28477
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-01-19
Fix Resolution (immer): 8.0.1
Direct dependency fix Resolution (react-scripts): 4.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-3517
Vulnerable Library - minimatch-3.0.4.tgz
a glob matcher in javascript
Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/recursive-readdir/node_modules/minimatch/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- react-dev-utils-8.0.0.tgz
- recursive-readdir-2.2.2.tgz
- ❌ minimatch-3.0.4.tgz (Vulnerable Library)
- recursive-readdir-2.2.2.tgz
- react-dev-utils-8.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Publish Date: 2022-10-17
URL: CVE-2022-3517
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2022-10-17
Fix Resolution: minimatch - 3.0.5
CVE-2021-23382
Vulnerable Library - postcss-6.0.23.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-scripts/node_modules/postcss/package.json,/node_modules/postcss-modules-local-by-default/node_modules/postcss/package.json,/node_modules/postcss-modules-values/node_modules/postcss/package.json,/node_modules/postcss-modules-extract-imports/node_modules/postcss/package.json,/node_modules/postcss-modules-scope/node_modules/postcss/package.json,/node_modules/icss-utils/node_modules/postcss/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- css-loader-1.0.0.tgz
- ❌ postcss-6.0.23.tgz (Vulnerable Library)
- css-loader-1.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).
Publish Date: 2021-04-26
URL: CVE-2021-23382
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382
Release Date: 2021-04-26
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (react-scripts): 3.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-37603
Vulnerable Library - loader-utils-1.2.3.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/react-dev-utils/node_modules/loader-utils/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- react-dev-utils-8.0.0.tgz
- ❌ loader-utils-1.2.3.tgz (Vulnerable Library)
- react-dev-utils-8.0.0.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
Publish Date: 2022-10-14
URL: CVE-2022-37603
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-3rfm-jhwj-7488
Release Date: 2022-10-14
Fix Resolution (loader-utils): 2.0.4
Direct dependency fix Resolution (react-scripts): 5.0.1
In order to enable automatic remediation, please create workflow rules
WS-2022-0008
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- selfsigned-1.10.14.tgz
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
- selfsigned-1.10.14.tgz
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.
Publish Date: 2022-01-08
URL: WS-2022-0008
CVSS 3 Score Details (6.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-5rrq-pxf6-6jx5
Release Date: 2022-01-08
Fix Resolution (node-forge): 1.0.0
Direct dependency fix Resolution (react-scripts): 5.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-0122
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- react-scripts-2.1.8.tgz (Root Library)
- webpack-dev-server-3.1.14.tgz
- selfsigned-1.10.14.tgz
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
- selfsigned-1.10.14.tgz
- webpack-dev-server-3.1.14.tgz
Found in HEAD commit: 0cecd5c687e0dea4a9fb6890f33c4f6ca81ec8f8
Found in base branch: main
Vulnerability Details
forge is vulnerable to URL Redirection to Untrusted Site
Publish Date: 2022-01-06
URL: CVE-2022-0122
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-gf8q-jrpm-jvxq
Release Date: 2022-01-06
Fix Resolution (node-forge): 1.0.0
Direct dependency fix Resolution (react-scripts): 5.0.0
In order to enable automatic remediation, please create workflow rules
In order to enable automatic remediation for this issue, please create workflow rules
package-list-0.0.3.tgz: 1 vulnerabilities (highest severity is: 7.5) - autoclosed
Vulnerable Library - package-list-0.0.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/read-installed/node_modules/semver/package.json
Found in HEAD commit: 93579a11236837cb74c2f23df20a2c82f3b3ad60
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2015-8855 | 7.5 | semver-3.0.1.tgz | Transitive | N/A | ❌ |
Details
CVE-2015-8855
Vulnerable Library - semver-3.0.1.tgz
The semantic version parser used by npm.
Library home page: https://registry.npmjs.org/semver/-/semver-3.0.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/read-installed/node_modules/semver/package.json
Dependency Hierarchy:
- package-list-0.0.3.tgz (Root Library)
- read-installed-3.1.1.tgz
- ❌ semver-3.0.1.tgz (Vulnerable Library)
- read-installed-3.1.1.tgz
Found in HEAD commit: 93579a11236837cb74c2f23df20a2c82f3b3ad60
Found in base branch: main
Vulnerability Details
The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
Publish Date: 2017-01-23
URL: CVE-2015-8855
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-8855
Release Date: 2017-01-23
Fix Resolution: semver (Npm package) - 4.3.2;Npm (NuGet package) - 2.14.14
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.