GithubHelp home page GithubHelp logo

interserver / mailbaby-mail-api-old Goto Github PK

View Code? Open in Web Editor NEW
1.0 3.0 0.0 7.92 MB

API Server for the MailBaby Email Services

License: GNU Lesser General Public License v2.1

Shell 0.74% PHP 91.00% HTML 7.22% JavaScript 0.83% CSS 0.21%
openapi workerman webman-framework email

mailbaby-mail-api-old's Introduction

MailBaby API

API service for accessing the Mail.Baby services.

API Sample Clients

Sample clients for the API are available in many languages

Development

This is built on top of Webman, a high performance HTTP Service Framework for PHP based on Workerman.

API Specification

We are utilizing the OpenAPI (formerly known as Swagger) spec for this API. It is basically the next evolution of SOAP API's with well defined functions, parameters, and responses. While there are many editors out there I'm currently using SwaggerHub to do most of the editing of the spec.

Webman Framework

After testing every PHP library out there dealing with concurrent/asynchronous processing many times over the years I've found Workerman to be the overall best. It has proven more stable and by far faster than the alternatives with the one big downside being that its documentation and code comments are all in Chinese. Webman is a fairly recently created web framework on top of Workerman. There had been many previously created frameworks based on workerman and while some were good Webman seemed to hit that perfect balance between ease-of-use and power.

The Chinese documentation is easily readable Using either the auto translate in Chrome or an addon like Translate Web Pages for Firefox.

Documentation

Building Elements:

git clone [email protected]:stoplightio/elements.git
cd elements
sed s#"\"httpsnippet\".*$"#"\"httpsnippet\": \"detain/httpsnippet\#master\","#g -i packages/elements-core/package.json
src="https://raw.githubusercontent.com/stoplightio/Public-APIs/master/reference/zoom/openapi.yaml"
dst="https://raw.githubusercontent.com/interserver/mailbaby-mail-api/master/public/spec/openapi.yaml"
for i in examples/angular/src/app/api/api.component.ts examples/react-gatsby/src/pages/zoom-api.tsx examples/react-cra/src/components/API.tsx; do
  sed s#"${src}"#"${dst}"#g -i $i
done
sed s#"https://api.apis.guru/v2/specs/github.com/1.1.4/openapi.yaml"#"${dst}"#g -i examples/bootstrap/index.html
yarn
yarn build
yarn build:angular
yarn build:react-gatsby
yarn build:react-cra

Code Samples

TODO

  • Customize 404 Page
  • Testing
  • Additional error checking and handling
  • Auto Updates
  • Placing Orders

URLs of interest in this project

Benchmarks

https://www.techempower.com/benchmarks/#section=test&runid=9716e3cd-9e53-433c-b6c5-d2c48c9593c1&hw=ph&test=db&l=zg24n3-1r&a=2 image

mailbaby-mail-api-old's People

Contributors

detain avatar mend-bolt-for-github[bot] avatar

Stargazers

 avatar

Watchers

 avatar  avatar  avatar

mailbaby-mail-api-old's Issues

CVE-2021-32640 (Medium) detected in multiple libraries - autoclosed

CVE-2021-32640 - Medium Severity Vulnerability

Vulnerable Libraries - ws-5.2.2.tgz, ws-7.4.5.tgz, ws-6.2.1.tgz

ws-5.2.2.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-5.2.2.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/ws/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • jest-enzyme-7.1.2.tgz
      • jest-environment-enzyme-7.1.2.tgz
        • jest-environment-jsdom-24.9.0.tgz
          • jsdom-11.12.0.tgz
            • ws-5.2.2.tgz (Vulnerable Library)
ws-7.4.5.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.4.5.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/jsdom/node_modules/ws/package.json

Dependency Hierarchy:

  • jest-environment-jsdom-26.6.2.tgz (Root Library)
    • jsdom-16.5.3.tgz
      • ws-7.4.5.tgz (Vulnerable Library)
ws-6.2.1.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-6.2.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/ws/package.json

Dependency Hierarchy:

  • @stoplight/elements-demo-7.0.0-beta.1.tgz (Root Library)
    • webpack-dev-server-3.11.2.tgz
      • ws-6.2.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected] (websockets/ws@00c425e). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Publish Date: 2021-05-25

URL: CVE-2021-32640

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6fc8-4gx4-v693

Release Date: 2021-05-25

Fix Resolution (ws): 5.2.3

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (ws): 7.4.6

Direct dependency fix Resolution (jest-environment-jsdom): 27.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-37713 (High) detected in multiple libraries - autoclosed

CVE-2021-37713 - High Severity Vulnerability

Vulnerable Libraries - tar-6.1.0.tgz, tar-4.4.13.tgz, tar-2.2.2.tgz

tar-6.1.0.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.1.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • semantic-release-17.0.3.tgz
        • npm-7.1.3.tgz
          • npm-7.13.0.tgz
            • tar-6.1.0.tgz (Vulnerable Library)
tar-4.4.13.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • npm-7.0.3.tgz
        • npm-6.14.13.tgz
          • tar-4.4.13.tgz (Vulnerable Library)
tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz
      • node-gyp-3.8.0.tgz
        • tar-2.2.2.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain .. path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory. Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path. This only affects users of node-tar on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

Publish Date: 2021-08-31

URL: CVE-2021-37713

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5955-9wpr-37jh

Release Date: 2021-08-31

Fix Resolution (tar): 6.1.9

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (tar): 4.4.18

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (tar): 4.4.18

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-28500 (Medium) detected in lodash-4.17.15.tgz - autoclosed

CVE-2020-28500 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/lodash/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • cli-8.3.5.tgz
        • lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-23424 (High) detected in ansi-html-0.0.7.tgz - autoclosed

CVE-2021-23424 - High Severity Vulnerability

Vulnerable Library - ansi-html-0.0.7.tgz

An elegant lib that converts the chalked (ANSI) text to HTML.

Library home page: https://registry.npmjs.org/ansi-html/-/ansi-html-0.0.7.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/ansi-html/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • addon-docs-6.2.9.tgz
      • builder-webpack4-6.2.9.tgz
        • webpack-hot-middleware-2.25.0.tgz
          • ansi-html-0.0.7.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.

Publish Date: 2021-08-18

URL: CVE-2021-23424

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-23424

Release Date: 2021-08-18

Fix Resolution (ansi-html): 0.0.8

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-43616 (High) detected in npm-7.13.0.tgz - autoclosed

CVE-2021-43616 - High Severity Vulnerability

Vulnerable Library - npm-7.13.0.tgz

a package manager for JavaScript

Library home page: https://registry.npmjs.org/npm/-/npm-7.13.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/npm/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • semantic-release-17.0.3.tgz
        • npm-7.1.3.tgz
          • npm-7.13.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json.

Publish Date: 2021-11-13

URL: CVE-2021-43616

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43616

Release Date: 2021-11-13

Fix Resolution (npm): 8.1.4

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-8116 (High) detected in dot-prop-3.0.0.tgz - autoclosed

CVE-2020-8116 - High Severity Vulnerability

Vulnerable Library - dot-prop-3.0.0.tgz

Get, set, or delete a property from a nested object using a dot path

Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-3.0.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/dot-prop/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • config-conventional-8.3.4.tgz
        • conventional-changelog-conventionalcommits-4.2.1.tgz
          • compare-func-1.3.4.tgz
            • dot-prop-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Publish Date: 2020-02-04

URL: CVE-2020-8116

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116

Release Date: 2020-02-04

Fix Resolution (dot-prop): 4.2.1

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-32803 (High) detected in multiple libraries - autoclosed

CVE-2021-32803 - High Severity Vulnerability

Vulnerable Libraries - tar-4.4.13.tgz, tar-2.2.2.tgz, tar-6.1.0.tgz

tar-4.4.13.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • npm-7.0.3.tgz
        • npm-6.14.13.tgz
          • tar-4.4.13.tgz (Vulnerable Library)
tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz
      • node-gyp-3.8.0.tgz
        • tar-2.2.2.tgz (Vulnerable Library)
tar-6.1.0.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.1.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • semantic-release-17.0.3.tgz
        • npm-7.1.3.tgz
          • npm-7.13.0.tgz
            • tar-6.1.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

Publish Date: 2021-08-03

URL: CVE-2021-32803

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r628-mhmh-qjhw

Release Date: 2021-08-03

Fix Resolution (tar): 4.4.15

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (tar): 3.2.3

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (tar): 6.1.2

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-32804 (High) detected in multiple libraries - autoclosed

CVE-2021-32804 - High Severity Vulnerability

Vulnerable Libraries - tar-6.1.0.tgz, tar-2.2.2.tgz, tar-4.4.13.tgz

tar-6.1.0.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.1.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • semantic-release-17.0.3.tgz
        • npm-7.1.3.tgz
          • npm-7.13.0.tgz
            • tar-6.1.0.tgz (Vulnerable Library)
tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz
      • node-gyp-3.8.0.tgz
        • tar-2.2.2.tgz (Vulnerable Library)
tar-4.4.13.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • npm-7.0.3.tgz
        • npm-6.14.13.tgz
          • tar-4.4.13.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Publish Date: 2021-08-03

URL: CVE-2021-32804

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3jfq-g458-7qm9

Release Date: 2021-08-03

Fix Resolution (tar): 6.1.1

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (tar): 3.2.2

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (tar): 4.4.14

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-3647 (Medium) detected in urijs-1.19.6.tgz - autoclosed

CVE-2021-3647 - Medium Severity Vulnerability

Vulnerable Library - urijs-1.19.6.tgz

URI.js is a Javascript library for working with URLs.

Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.6.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/urijs/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • urijs-1.19.6.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

URI.js is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2021-07-16

URL: CVE-2021-3647

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-89gv-h8wf-cg8r

Release Date: 2021-07-16

Fix Resolution (urijs): 1.19.7

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-8203 (High) detected in lodash-4.17.15.tgz - autoclosed

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/lodash/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • cli-8.3.5.tgz
        • lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.19

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2018-19827 (High) detected in node-sass-4.14.1.tgz - autoclosed

CVE-2018-19827 - High Severity Vulnerability

Vulnerable Library - node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/node-sass/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.

Publish Date: 2018-12-03

URL: CVE-2018-19827

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-12-03

Fix Resolution (node-sass): 5.0.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-37701 (High) detected in multiple libraries - autoclosed

CVE-2021-37701 - High Severity Vulnerability

Vulnerable Libraries - tar-6.1.0.tgz, tar-4.4.13.tgz, tar-2.2.2.tgz

tar-6.1.0.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.1.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • semantic-release-17.0.3.tgz
        • npm-7.1.3.tgz
          • npm-7.13.0.tgz
            • tar-6.1.0.tgz (Vulnerable Library)
tar-4.4.13.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • npm-7.0.3.tgz
        • npm-6.14.13.tgz
          • tar-4.4.13.tgz (Vulnerable Library)
tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz
      • node-gyp-3.8.0.tgz
        • tar-2.2.2.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Publish Date: 2021-08-31

URL: CVE-2021-37701

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9r2w-394v-53qc

Release Date: 2021-08-31

Fix Resolution (tar): 6.1.7

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (tar): 4.4.16

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (tar): 4.4.16

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-3801 (Medium) detected in prismjs-1.23.0.tgz - autoclosed

CVE-2021-3801 - Medium Severity Vulnerability

Vulnerable Library - prismjs-1.23.0.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.23.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/prismjs/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • ui-kit-3.0.0-beta.39.tgz
      • prismjs-1.23.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

prism is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-15

URL: CVE-2021-3801

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3801

Release Date: 2021-09-15

Fix Resolution (prismjs): 1.25.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-23386 (Medium) detected in dns-packet-1.3.1.tgz - autoclosed

CVE-2021-23386 - Medium Severity Vulnerability

Vulnerable Library - dns-packet-1.3.1.tgz

An abstract-encoding compliant module for encoding / decoding DNS packets

Library home page: https://registry.npmjs.org/dns-packet/-/dns-packet-1.3.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/dns-packet/package.json

Dependency Hierarchy:

  • @stoplight/elements-demo-7.0.0-beta.1.tgz (Root Library)
    • webpack-dev-server-3.11.2.tgz
      • bonjour-3.5.0.tgz
        • multicast-dns-6.2.3.tgz
          • dns-packet-1.3.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.

Publish Date: 2021-05-20

URL: CVE-2021-23386

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23386

Release Date: 2021-05-20

Fix Resolution: dns-packet - 5.2.2


Step up your Open Source Security Game with Mend here

CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz - autoclosed

CVE-2018-19839 - Medium Severity Vulnerability

Vulnerable Library - node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/node-sass/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

In LibSass prior to 3.5.5, the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file.

Publish Date: 2018-12-04

URL: CVE-2018-19839

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-12-04

Fix Resolution (node-sass): 5.0.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-23820 (High) detected in json-pointer-0.6.1.tgz - autoclosed

CVE-2021-23820 - High Severity Vulnerability

Vulnerable Library - json-pointer-0.6.1.tgz

Some utilities for JSON pointers described by RFC 6901

Library home page: https://registry.npmjs.org/json-pointer/-/json-pointer-0.6.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/json-pointer/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • json-schema-sampler-0.2.0.tgz
      • json-pointer-0.6.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays.

Publish Date: 2021-11-03

URL: CVE-2021-23820

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-23820

Release Date: 2021-11-03

Fix Resolution (json-pointer): 0.6.2

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-3795 (High) detected in semver-regex-2.0.0.tgz - autoclosed

CVE-2021-3795 - High Severity Vulnerability

Vulnerable Library - semver-regex-2.0.0.tgz

Regular expression for matching semver versions

Library home page: https://registry.npmjs.org/semver-regex/-/semver-regex-2.0.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/semver-regex/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • semantic-release-17.0.3.tgz
        • find-versions-3.2.0.tgz
          • semver-regex-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

semver-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-15

URL: CVE-2021-3795

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-15

Fix Resolution (semver-regex): 3.1.3

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2018-20821 (Medium) detected in node-sass-4.14.1.tgz - autoclosed

CVE-2018-20821 - Medium Severity Vulnerability

Vulnerable Library - node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/node-sass/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp).

Publish Date: 2019-04-23

URL: CVE-2018-20821

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-04-23

Fix Resolution (node-sass): 5.0.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-39135 (High) detected in arborist-2.5.0.tgz - autoclosed

CVE-2021-39135 - High Severity Vulnerability

Vulnerable Library - arborist-2.5.0.tgz

Manage node_modules trees

Library home page: https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.5.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/@npmcli/arborist/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • semantic-release-17.0.3.tgz
        • npm-7.1.3.tgz
          • npm-7.13.0.tgz
            • arborist-2.5.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

@npmcli/arborist, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project's node_modules folder. If the node_modules folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a node_modules symbolic link would have to be employed. 1. A preinstall script could replace node_modules with a symlink. (This is prevented by using --ignore-scripts.) 2. An attacker could supply the target with a git repository, instructing them to run npm install --ignore-scripts in the root. This may be successful, because npm install --ignore-scripts is typically not capable of making changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see the referenced GHSA-gmw6-94gg-2rc2.

Publish Date: 2021-08-31

URL: CVE-2021-39135

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gmw6-94gg-2rc2

Release Date: 2021-08-31

Fix Resolution (@npmcli/arborist): 2.8.2

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-23343 (High) detected in path-parse-1.0.6.tgz - autoclosed

CVE-2021-23343 - High Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/path-parse/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz
      • meow-3.7.0.tgz
        • normalize-package-data-2.5.0.tgz
          • resolve-1.20.0.tgz
            • path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution (path-parse): 1.0.7

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-26226 (High) detected in semantic-release-17.0.3.tgz - autoclosed

CVE-2020-26226 - High Severity Vulnerability

Vulnerable Library - semantic-release-17.0.3.tgz

Automated semver compliant package publishing

Library home page: https://registry.npmjs.org/semantic-release/-/semantic-release-17.0.3.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/semantic-release/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • semantic-release-17.0.3.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3.

Publish Date: 2020-11-18

URL: CVE-2020-26226

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r2j6-p67h-q639

Release Date: 2020-11-18

Fix Resolution (semantic-release): 17.2.3

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-23382 (Medium) detected in multiple libraries - autoclosed

CVE-2021-23382 - Medium Severity Vulnerability

Vulnerable Libraries - postcss-7.0.21.tgz, postcss-6.0.23.tgz, postcss-7.0.35.tgz

postcss-7.0.21.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.21.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/postcss/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • resolve-url-loader-3.1.3.tgz
      • postcss-7.0.21.tgz (Vulnerable Library)
postcss-6.0.23.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/css-node-extract/node_modules/postcss/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-package-importer-5.3.2.tgz
      • node-sass-magic-importer-5.3.2.tgz
        • css-node-extract-2.1.3.tgz
          • postcss-6.0.23.tgz (Vulnerable Library)
postcss-7.0.35.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/postcss/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • http-spec-4.2.0.tgz
      • postman-collection-3.6.11.tgz
        • sanitize-html-1.20.1.tgz
          • postcss-7.0.35.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution (postcss): 7.0.36

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (postcss): 7.0.36

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (postcss): 7.0.36

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2019-6286 (Medium) detected in node-sass-4.14.1.tgz - autoclosed

CVE-2019-6286 - Medium Severity Vulnerability

Vulnerable Library - node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/node-sass/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::parse_import(), a similar issue to CVE-2018-11693.

Publish Date: 2019-01-14

URL: CVE-2019-6286

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-07-23

Fix Resolution (node-sass): 5.0.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-32723 (Medium) detected in prismjs-1.23.0.tgz - autoclosed

CVE-2021-32723 - Medium Severity Vulnerability

Vulnerable Library - prismjs-1.23.0.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.23.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/prismjs/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • ui-kit-3.0.0-beta.39.tgz
      • prismjs-1.23.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.

Publish Date: 2021-06-28

URL: CVE-2021-32723

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gj77-59wh-66hg

Release Date: 2021-06-28

Fix Resolution (prismjs): 1.24.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-7598 (Medium) detected in minimist-1.2.0.tgz, minimist-0.0.10.tgz - autoclosed

CVE-2020-7598 - Medium Severity Vulnerability

Vulnerable Libraries - minimist-1.2.0.tgz, minimist-0.0.10.tgz

minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/minimist/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • commitizen-4.0.3.tgz
        • minimist-1.2.0.tgz (Vulnerable Library)
minimist-0.0.10.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/minimist/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • http-spec-4.2.0.tgz
      • json-schema-generator-2.0.6.tgz
        • optimist-0.6.1.tgz
          • minimist-0.0.10.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-11

Fix Resolution (minimist): 1.2.3

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (minimist): 0.2.1

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-26539 (Medium) detected in sanitize-html-1.20.1.tgz - autoclosed

CVE-2021-26539 - Medium Severity Vulnerability

Vulnerable Library - sanitize-html-1.20.1.tgz

Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis

Library home page: https://registry.npmjs.org/sanitize-html/-/sanitize-html-1.20.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/sanitize-html/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • http-spec-4.2.0.tgz
      • postman-collection-3.6.11.tgz
        • sanitize-html-1.20.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.

Publish Date: 2021-02-08

URL: CVE-2021-26539

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26539

Release Date: 2021-02-08

Fix Resolution (sanitize-html): 2.3.1

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-28499 (High) detected in merge-1.2.1.tgz - autoclosed

CVE-2020-28499 - High Severity Vulnerability

Vulnerable Library - merge-1.2.1.tgz

Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.

Library home page: https://registry.npmjs.org/merge/-/merge-1.2.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/merge/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • commitizen-4.0.3.tgz
        • find-node-modules-2.0.0.tgz
          • merge-1.2.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .

Publish Date: 2021-02-18

URL: CVE-2020-28499

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-18

Fix Resolution (merge): 2.1.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-3807 (High) detected in ansi-regex-4.1.0.tgz, ansi-regex-5.0.0.tgz - autoclosed

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Libraries - ansi-regex-4.1.0.tgz, ansi-regex-5.0.0.tgz

ansi-regex-4.1.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/strip-ansi/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • cli-ux-5.4.4.tgz
        • strip-ansi-5.2.0.tgz
          • ansi-regex-4.1.0.tgz (Vulnerable Library)
ansi-regex-5.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • cypress-7.0.6.tgz (Root Library)
    • dom-7.31.0.tgz
      • pretty-format-26.6.2.tgz
        • ansi-regex-5.0.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 4.1.1

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (ansi-regex): 5.0.1

Direct dependency fix Resolution (@testing-library/cypress): 7.0.7


Step up your Open Source Security Game with Mend here

CVE-2021-37712 (High) detected in multiple libraries - autoclosed

CVE-2021-37712 - High Severity Vulnerability

Vulnerable Libraries - tar-2.2.2.tgz, tar-4.4.13.tgz, tar-6.1.0.tgz

tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz
      • node-gyp-3.8.0.tgz
        • tar-2.2.2.tgz (Vulnerable Library)
tar-4.4.13.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • npm-7.0.3.tgz
        • npm-6.14.13.tgz
          • tar-4.4.13.tgz (Vulnerable Library)
tar-6.1.0.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.1.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/tar/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • semantic-release-17.0.3.tgz
        • npm-7.1.3.tgz
          • npm-7.13.0.tgz
            • tar-6.1.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.

Publish Date: 2021-08-31

URL: CVE-2021-37712

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qq89-hq3f-393p

Release Date: 2021-08-31

Fix Resolution (tar): 4.4.18

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (tar): 4.4.18

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (tar): 6.1.9

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2019-6283 (Medium) detected in node-sass-4.14.1.tgz - autoclosed

CVE-2019-6283 - Medium Severity Vulnerability

Vulnerable Library - node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/node-sass/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp.

Publish Date: 2019-01-14

URL: CVE-2019-6283

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-08-24

Fix Resolution (node-sass): 5.0.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-3803 (High) detected in nth-check-1.0.2.tgz, nth-check-2.0.0.tgz - autoclosed

CVE-2021-3803 - High Severity Vulnerability

Vulnerable Libraries - nth-check-1.0.2.tgz, nth-check-2.0.0.tgz

nth-check-1.0.2.tgz

performant nth-check parser & compiler

Library home page: https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/nth-check/package.json

Dependency Hierarchy:

  • elements-dev-portal-1.0.0-alpha.2.tgz (Root Library)
    • sass-inline-svg-1.2.3.tgz
      • css-select-1.2.0.tgz
        • nth-check-1.0.2.tgz (Vulnerable Library)
nth-check-2.0.0.tgz

Parses and compiles CSS nth-checks to highly optimized functions.

Library home page: https://registry.npmjs.org/nth-check/-/nth-check-2.0.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/nth-check/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • enzyme-3.11.0.tgz
      • cheerio-1.0.0-rc.9.tgz
        • cheerio-select-1.4.0.tgz
          • css-select-4.1.2.tgz
            • nth-check-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

nth-check is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3803

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-17

Fix Resolution (nth-check): 2.0.1

Direct dependency fix Resolution (@stoplight/elements-dev-portal): 1.0.0

Fix Resolution (nth-check): 2.0.1

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-3749 (High) detected in axios-0.21.1.tgz - autoclosed

CVE-2021-3749 - High Severity Vulnerability

Vulnerable Library - axios-0.21.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/axios/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • axios-0.21.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

axios is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-08-31

URL: CVE-2021-3749

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31/

Release Date: 2021-08-31

Fix Resolution (axios): 0.21.2

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-23337 (High) detected in lodash-4.17.15.tgz - autoclosed

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/lodash/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • cli-8.3.5.tgz
        • lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-39134 (High) detected in arborist-2.5.0.tgz - autoclosed

CVE-2021-39134 - High Severity Vulnerability

Vulnerable Library - arborist-2.5.0.tgz

Manage node_modules trees

Library home page: https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.5.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/@npmcli/arborist/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • semantic-release-17.0.3.tgz
        • npm-7.1.3.tgz
          • npm-7.13.0.tgz
            • arborist-2.5.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

@npmcli/arborist, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is, in part, accomplished by resolving dependency specifiers defined in package.json manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies differ only in the case of their name, Arborist's internal data structure saw them as separate items that could coexist within the same level in the node_modules hierarchy. However, on case-insensitive file systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as file:/some/path, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem. For example, a package pwn-a could define a dependency in their package.json file such as "foo": "file:/some/path". Another package, pwn-b could define a dependency such as FOO: "file:foo.tgz". On case-insensitive file systems, if pwn-a was installed, and then pwn-b was installed afterwards, the contents of foo.tgz would be written to /some/path, and any existing contents of /some/path would be removed. Anyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above.

Publish Date: 2021-08-31

URL: CVE-2021-39134

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2h3h-q99f-3fhc

Release Date: 2021-08-31

Fix Resolution (@npmcli/arborist): 2.8.2

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

WS-2020-0163 (Medium) detected in marked-0.8.2.tgz - autoclosed

WS-2020-0163 - Medium Severity Vulnerability

Vulnerable Library - marked-0.8.2.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.8.2.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/marked/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • semantic-release-17.0.3.tgz
        • marked-0.8.2.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

marked before 1.1.1 is vulnerable to Regular Expression Denial of Service (REDoS). rules.js have multiple unused capture groups which can lead to a Denial of Service.

Publish Date: 2020-07-02

URL: WS-2020-0163

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-02

Fix Resolution (marked): 1.1.1

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-33502 (High) detected in multiple libraries - autoclosed

CVE-2021-33502 - High Severity Vulnerability

Vulnerable Libraries - normalize-url-2.0.1.tgz, normalize-url-5.3.0.tgz, normalize-url-3.3.0.tgz, normalize-url-6.0.0.tgz

normalize-url-2.0.1.tgz

Normalize a URL

Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-2.0.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/normalize-url/package.json

Dependency Hierarchy:

  • @stoplight/elements-demo-7.0.0-beta.1.tgz (Root Library)
    • image-webpack-loader-7.0.1.tgz
      • imagemin-gifsicle-7.0.0.tgz
        • gifsicle-5.2.0.tgz
          • bin-wrapper-4.1.0.tgz
            • download-7.1.0.tgz
              • got-8.3.2.tgz
                • cacheable-request-2.1.4.tgz
                  • normalize-url-2.0.1.tgz (Vulnerable Library)
normalize-url-5.3.0.tgz

Normalize a URL

Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-5.3.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/normalize-url/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • npm-7.0.3.tgz
        • normalize-url-5.3.0.tgz (Vulnerable Library)
normalize-url-3.3.0.tgz

Normalize a URL

Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-3.3.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/normalize-url/package.json

Dependency Hierarchy:

  • lerna-3.22.1.tgz (Root Library)
    • version-3.22.1.tgz
      • github-client-3.22.0.tgz
        • git-url-parse-11.4.4.tgz
          • git-up-4.0.2.tgz
            • parse-url-5.0.2.tgz
              • normalize-url-3.3.0.tgz (Vulnerable Library)
normalize-url-6.0.0.tgz

Normalize a URL

Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-6.0.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/normalize-url/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • semantic-release-17.0.3.tgz
        • npm-7.1.3.tgz
          • normalize-url-6.0.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Publish Date: 2021-05-24

URL: CVE-2021-33502

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502

Release Date: 2021-05-24

Fix Resolution (normalize-url): 5.3.1

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (normalize-url): 4.5.1

Direct dependency fix Resolution (lerna): 4.0.0

Fix Resolution (normalize-url): 6.0.1

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2018-11694 (High) detected in node-sass-4.14.1.tgz - autoclosed

CVE-2018-11694 - High Severity Vulnerability

Vulnerable Library - node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/node-sass/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions::selector_append which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.

Publish Date: 2018-06-04

URL: CVE-2018-11694

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-06-04

Fix Resolution (node-sass): 5.0.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-33587 (High) detected in css-what-5.0.0.tgz - autoclosed

CVE-2021-33587 - High Severity Vulnerability

Vulnerable Library - css-what-5.0.0.tgz

a CSS selector parser

Library home page: https://registry.npmjs.org/css-what/-/css-what-5.0.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/css-what/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • enzyme-3.11.0.tgz
      • cheerio-1.0.0-rc.9.tgz
        • cheerio-select-1.4.0.tgz
          • css-what-5.0.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Publish Date: 2021-05-28

URL: CVE-2021-33587

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587

Release Date: 2021-05-28

Fix Resolution (css-what): 5.0.1

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-26540 (Medium) detected in sanitize-html-1.20.1.tgz - autoclosed

CVE-2021-26540 - Medium Severity Vulnerability

Vulnerable Library - sanitize-html-1.20.1.tgz

Clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis

Library home page: https://registry.npmjs.org/sanitize-html/-/sanitize-html-1.20.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/sanitize-html/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • http-spec-4.2.0.tgz
      • postman-collection-3.6.11.tgz
        • sanitize-html-1.20.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\example.com".

Publish Date: 2021-02-08

URL: CVE-2021-26540

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26540

Release Date: 2021-02-08

Fix Resolution (sanitize-html): 2.3.2

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2019-6284 (Medium) detected in node-sass-4.14.1.tgz - autoclosed

CVE-2019-6284 - Medium Severity Vulnerability

Vulnerable Library - node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/node-sass/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp.

Publish Date: 2019-01-14

URL: CVE-2019-6284

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-08-24

Fix Resolution (node-sass): 5.0.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2018-19797 (Medium) detected in node-sass-4.14.1.tgz - autoclosed

CVE-2018-19797 - Medium Severity Vulnerability

Vulnerable Library - node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/node-sass/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.

Publish Date: 2018-12-03

URL: CVE-2018-19797

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-12-03

Fix Resolution (node-sass): 5.0.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-3664 (Medium) detected in url-parse-1.5.1.tgz - autoclosed

CVE-2021-3664 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.5.1.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.5.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/url-parse/package.json

Dependency Hierarchy:

  • @stoplight/elements-demo-7.0.0-beta.1.tgz (Root Library)
    • webpack-dev-server-3.11.2.tgz
      • sockjs-client-1.5.1.tgz
        • url-parse-1.5.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

url-parse is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2021-07-26

URL: CVE-2021-3664

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3664

Release Date: 2021-07-26

Fix Resolution: url-parse - 1.5.2


Step up your Open Source Security Game with Mend here

CVE-2018-19838 (Medium) detected in node-sass-4.14.1.tgz - autoclosed

CVE-2018-19838 - Medium Severity Vulnerability

Vulnerable Library - node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/node-sass/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy().

Publish Date: 2018-12-04

URL: CVE-2018-19838

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-12-04

Fix Resolution (node-sass): 5.0.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz - autoclosed

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/trim/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • markdown-2.11.0.tgz
      • remark-parse-8.0.3.tgz
        • trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-10-27

Fix Resolution (trim): 0.0.3

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-24025 (Medium) detected in node-sass-4.14.1.tgz - autoclosed

CVE-2020-24025 - Medium Severity Vulnerability

Vulnerable Library - node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/node-sass/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.

Publish Date: 2021-01-11

URL: CVE-2020-24025

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-24025

Release Date: 2021-01-11

Fix Resolution (node-sass): 5.0.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-28469 (High) detected in glob-parent-3.1.0.tgz - autoclosed

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Library - glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/glob-parent/package.json

Dependency Hierarchy:

  • @stoplight/elements-demo-7.0.0-beta.1.tgz (Root Library)
    • webpack-dev-server-3.11.2.tgz
      • chokidar-2.1.8.tgz
        • glob-parent-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution: glob-parent - 5.1.2


Step up your Open Source Security Game with Mend here

WS-2019-0307 (Medium) detected in mem-1.1.0.tgz - autoclosed

WS-2019-0307 - Medium Severity Vulnerability

Vulnerable Library - mem-1.1.0.tgz

Memoize functions - An optimization used to speed up consecutive function calls by caching the result of calls with identical input

Library home page: https://registry.npmjs.org/mem/-/mem-1.1.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/mem/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • npm-7.0.3.tgz
        • npm-6.14.13.tgz
          • lock-verify-2.2.1.tgz
            • cli-1.2.0.tgz
              • yargs-8.0.2.tgz
                • os-locale-2.1.0.tgz
                  • mem-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

In 'mem' before v4.0.0 there is a Denial of Service (DoS) vulnerability as a result of a failure in removal old values from the cache.

Publish Date: 2018-08-27

URL: WS-2019-0307

CVSS 3 Score Details (5.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1084

Release Date: 2018-08-27

Fix Resolution (mem): 4.0.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2018-11698 (High) detected in node-sass-4.14.1.tgz - autoclosed

CVE-2018-11698 - High Severity Vulnerability

Vulnerable Library - node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/node-sass/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handle_error which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.

Publish Date: 2018-06-04

URL: CVE-2018-11698

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-06-04

Fix Resolution (node-sass): 5.0.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-3918 (High) detected in json-schema-0.3.0.tgz - autoclosed

CVE-2021-3918 - High Severity Vulnerability

Vulnerable Library - json-schema-0.3.0.tgz

JSON Schema validation and specifications

Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.3.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/json-schema/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • http-spec-4.2.0.tgz
      • json-schema-0.3.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-11-13

URL: CVE-2021-3918

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918

Release Date: 2021-11-13

Fix Resolution (json-schema): 0.4.0

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-33623 (High) detected in trim-newlines-2.0.0.tgz, trim-newlines-1.0.0.tgz - autoclosed

CVE-2021-33623 - High Severity Vulnerability

Vulnerable Libraries - trim-newlines-2.0.0.tgz, trim-newlines-1.0.0.tgz

trim-newlines-2.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-2.0.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/trim-newlines/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • scripts-8.2.3.tgz
      • cli-8.3.5.tgz
        • meow-5.0.0.tgz
          • trim-newlines-2.0.0.tgz (Vulnerable Library)
trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: /public/elements/package.json

Path to vulnerable library: /public/elements/node_modules/trim-newlines/package.json

Dependency Hierarchy:

  • elements-core-7.0.0-beta.3.tgz (Root Library)
    • node-sass-4.14.1.tgz
      • meow-3.7.0.tgz
        • trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in HEAD commit: f27f03f1ab403aa46166f9c03a997576599a7c43

Found in base branch: master

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution (trim-newlines): 3.0.1

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0

Fix Resolution (trim-newlines): 3.0.1

Direct dependency fix Resolution (@stoplight/elements-core): 7.0.0


Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.