scriptex / create-pwa

Easily create a progressive web app

Hi, I'm Atanas 👋

• Javascript/Typescript engineer doing Web and Mobile front-end development since 2011
• Lead front-end developer at dmarcian
• Former senior software developer and mentor at Three11
• Former lead front-end engineer in the E.ON Home project
• Former senior web and desktop applications developer at Kinetik Automotive
• Former senior front-end engineer and mentor at 2create
• Former senior front-end developer at htmlBurger
• Former senior front-end developer at htmlBoutique
• Former front-end developer at HTML Lab
• Part of "the top 3% in the world" at Toptal
• Founding talent member at Braintrust
• Senior front-end engineer at Andela
• Freelance Javascript/Typescript Engineer at Upwork
• Freelance Javascript/Typescript Engineer at Freelancer
• Freelance front-end engineer at 9am
• Freelance front-end developer at Wellfound
• Senior front-end engineer at People Per Hour
• Freelance front-end developer at FlexWork
• Freelance front-end developer at Arc.dev
• Freelance front-end developer at Codementor
• Open source software maintainer - check my projects.
• Author of web components at WebComponents.org
• Author of browser extensions for Google Chrome and Mozilla Firefox
• Google developer

My open source software is published on NPM and has been downloaded this many times in the past year:

Here is a bit more detailed graph showing my open source contributions in the past year:

Wondering how to pronounce my name? Not anymore!

---

Connect with me:

                     

---

Support and sponsor my work:

create-pwa's Issues

CVE-2020-11022 (Medium) detected in jquery-1.9.1.js

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: /tmp/ws-scm/create-pwa/node_modules/tinycolor2/index.html

Path to vulnerable library: /create-pwa/node_modules/tinycolor2/demo/jquery-1.9.1.js,/create-pwa/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js

Dependency Hierarchy:

• ❌ jquery-1.9.1.js (Vulnerable Library)

Found in HEAD commit: 3e50b007a17f17a6cf482c7156c2bac0c972306e

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

---

Step up your Open Source Security Game with WhiteSource here

manifest.appcache

Even though the appcache is deprecated in favor of service workers, some browsers still lack support for sw, while appcache support is pretty wide. In order to make a web app offline ready, an appcache manifest can be created and linked. Both technologies (sw and appcache) can work together: https://bugs.chromium.org/p/chromium/issues/detail?id=410665

CVE-2015-9251 (Medium) detected in jquery-1.9.1.js

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: /tmp/ws-scm/create-pwa/node_modules/tinycolor2/test/index.html

Path to vulnerable library: /create-pwa/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js,/create-pwa/node_modules/tinycolor2/demo/jquery-1.9.1.js

Dependency Hierarchy:

• ❌ jquery-1.9.1.js (Vulnerable Library)

Found in HEAD commit: 4399c30697426b3c53c30963110c43a3a9122ba3

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

---

Step up your Open Source Security Game with WhiteSource here

Missing module service-worker

I have installed by NPM, it missed service-worker module

Action Required: Fix Renovate Configuration

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

Error type: undefined. Note: this is a nested preset so please contact the preset author if you are unable to fix it yourself.

CVE-2020-11023 (Medium) detected in jquery-1.9.1.js

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: /tmp/ws-scm/create-pwa/node_modules/tinycolor2/test/index.html

Path to vulnerable library: /create-pwa/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js,/create-pwa/node_modules/tinycolor2/demo/jquery-1.9.1.js

Dependency Hierarchy:

• ❌ jquery-1.9.1.js (Vulnerable Library)

Found in HEAD commit: a8f4cac5dad8d0f2fe1db8ddee31976674b97a34

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0

---

Step up your Open Source Security Game with WhiteSource here

Dependency Dashboard

This issue provides visibility into Renovate updates and their statuses. Learn more

This repository currently has no open or pending branches.

---

• Check this box to trigger a request for Renovate to run again on this repository

Dist folder option

Thanks for this piece of code - very helfpul.

Enhancement:

Would be helpful to specify in the CLI call the dist folder where all files and folders are generated.
Today, they are all created in the main folder.

Appcache documentation in README

CVE-2015-9521 (Medium) detected in jquery-1.9.1.js

CVE-2015-9521 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: /tmp/ws-scm/create-pwa/node_modules/tinycolor2/index.html

Path to vulnerable library: /create-pwa/node_modules/tinycolor2/demo/jquery-1.9.1.js,/create-pwa/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js

Dependency Hierarchy:

• ❌ jquery-1.9.1.js (Vulnerable Library)

Found in HEAD commit: 53ee91df1258d6ad44b8729260339e5d241d6550

Vulnerability Details

The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Publish Date: 2019-10-23

URL: CVE-2015-9521

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: jquery/jquery@b078a62

Release Date: 2019-10-23

Fix Resolution: 2.2.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2022-0355 (High) detected in simple-get-4.0.0.tgz

CVE-2022-0355 - High Severity Vulnerability

Vulnerable Library - simple-get-4.0.0.tgz

Simplest way to make http get requests. Supports HTTPS, redirects, gzip/deflate, streams in < 100 lines.

Library home page: https://registry.npmjs.org/simple-get/-/simple-get-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/simple-get/package.json

Dependency Hierarchy:

• sharp-0.29.3.tgz (Root Library)
  • ❌ simple-get-4.0.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in NPM simple-get prior to 4.0.1.

Publish Date: 2022-01-26

URL: CVE-2022-0355

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0355

Release Date: 2022-01-26

Fix Resolution: simple-get - 4.0.1

---

Step up your Open Source Security Game with WhiteSource here

WS-2016-0090 (Medium) detected in jquery-1.9.1.js

WS-2016-0090 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: /tmp/ws-scm/create-pwa/node_modules/tinycolor2/test/index.html

Path to vulnerable library: /create-pwa/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js,/create-pwa/node_modules/tinycolor2/demo/jquery-1.9.1.js

Dependency Hierarchy:

• ❌ jquery-1.9.1.js (Vulnerable Library)

Found in HEAD commit: 4399c30697426b3c53c30963110c43a3a9122ba3

Vulnerability Details

JQuery, before 2.2.0, is vulnerable to Cross-site Scripting (XSS) attacks via text/javascript response with arbitrary code execution.

Publish Date: 2016-11-27

URL: WS-2016-0090

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: jquery/jquery@b078a62

Release Date: 2019-04-08

Fix Resolution: 2.2.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2022-25851 (High) detected in jpeg-js-0.4.2.tgz

CVE-2022-25851 - High Severity Vulnerability

Vulnerable Library - jpeg-js-0.4.2.tgz

A pure javascript JPEG encoder and decoder

Library home page: https://registry.npmjs.org/jpeg-js/-/jpeg-js-0.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jpeg-js/package.json

Dependency Hierarchy:

• png-to-ico-2.1.4.tgz (Root Library)
  • jimp-0.16.1.tgz
    • types-0.16.1.tgz
      • jpeg-0.16.1.tgz
        • ❌ jpeg-js-0.4.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return.

Publish Date: 2022-06-10

URL: CVE-2022-25851

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-06-10

Fix Resolution: jpeg-js - 0.4.4

---

Step up your Open Source Security Game with Mend here

Make separate components optional

Introduce flags to disable each component: manifest, service-worker, icon, splash, favicon, etc

CVE-2020-8175 (Medium) detected in jpeg-js-0.3.7.tgz

CVE-2020-8175 - Medium Severity Vulnerability

Vulnerable Library - jpeg-js-0.3.7.tgz

A pure javascript JPEG encoder and decoder

Library home page: https://registry.npmjs.org/jpeg-js/-/jpeg-js-0.3.7.tgz

Path to dependency file: /tmp/ws-scm/create-pwa/package.json

Path to vulnerable library: /tmp/ws-scm/create-pwa/node_modules/jpeg-js/package.json

Dependency Hierarchy:

• png-to-ico-2.1.0.tgz (Root Library)
  • jimp-0.9.8.tgz
    • types-0.9.8.tgz
      • jpeg-0.9.8.tgz
        • ❌ jpeg-js-0.3.7.tgz (Vulnerable Library)

Found in HEAD commit: a8f4cac5dad8d0f2fe1db8ddee31976674b97a34

Vulnerability Details

Uncontrolled resource consumption in jpeg-js before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image.

Publish Date: 2020-07-24

URL: CVE-2020-8175

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8175

Release Date: 2020-07-21

Fix Resolution: 0.4.0

---

Step up your Open Source Security Game with WhiteSource here

ERR_INVALID_ARG_TYPE

When i run

create-pwa --icon="./icon.png" --launch="./launch.png"

I get this error:

internal/validators.js:120
    throw new ERR_INVALID_ARG_TYPE(name, 'string', value);
    ^

TypeError [ERR_INVALID_ARG_TYPE]: The "path" argument must be of type string. Received undefined
    at validateString (internal/validators.js:120:11)
    at resolve (path.js:139:9)
    at getAppName (C:\Users\szsob\AppData\Roaming\npm\node_modules\create-pwa\src\index.js:75:14)
    at create (C:\Users\szsob\AppData\Roaming\npm\node_modules\create-pwa\src\index.js:159:15)
    at Object.<anonymous> (C:\Users\szsob\AppData\Roaming\npm\node_modules\create-pwa\src\index.js:191:1)
    at Module._compile (internal/modules/cjs/loader.js:1147:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1167:10)
    at Module.load (internal/modules/cjs/loader.js:996:32)
    at Function.Module._load (internal/modules/cjs/loader.js:896:14)
    at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:71:12) {
  code: 'ERR_INVALID_ARG_TYPE'
}

What am i doing wrong? Im executing the command from the readme

Apple mobile web app

<meta name="apple-mobile-web-app-capable" content="yes" />
<meta name="mobile-web-app-capable" content="yes" />

Also, the documentation needs more love:

1. Wrong or missing file names
2. Wrong usage description
3. Wrong service worker list
4. Possibly more?

CVE-2020-0470 (Medium) detected in libaomandroid-11.0.0_r18

CVE-2020-0470 - Medium Severity Vulnerability

Vulnerable Library - libaomandroid-11.0.0_r18

Bug: 139309277

Library home page: https://android.googlesource.com/platform/external/libaom

Found in HEAD commit: 6ff7de1996dee59644e709e1ceda10940d8f3a84

Vulnerable Source Files (1)

create-pwa/node_modules/sharp/vendor/8.10.5/include/aom/aom_integer.h

Vulnerability Details

In extend_frame_highbd of restoration.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-10Android ID: A-166268541

Publish Date: 2020-12-14

URL: CVE-2020-0470

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23343 (Medium) detected in path-parse-1.0.6.tgz

CVE-2021-23343 - Medium Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: create-pwa/package.json

Path to vulnerable library: create-pwa/node_modules/path-parse

Dependency Hierarchy:

• tape-5.2.2.tgz (Root Library)
  • resolve-2.0.0-next.3.tgz
    • ❌ path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: 8e7757a349d7daec628b7b50362096cf5f734c2a

Found in base branch: master

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with WhiteSource here

Error with doubled file names

Default settings.

CVE-2019-11358 (Medium) detected in jquery-1.9.1.js

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: /tmp/ws-scm/create-pwa/node_modules/tinycolor2/test/index.html

Path to vulnerable library: /create-pwa/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js,/create-pwa/node_modules/tinycolor2/demo/jquery-1.9.1.js

Dependency Hierarchy:

• ❌ jquery-1.9.1.js (Vulnerable Library)

Found in HEAD commit: 4399c30697426b3c53c30963110c43a3a9122ba3

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: jquery/jquery@753d591

Release Date: 2019-03-25

Fix Resolution: Replace or update the following files: core.js, core.js

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-44906 (Medium) detected in minimist-1.2.5.tgz

CVE-2021-44906 - Medium Severity Vulnerability

Vulnerable Library - minimist-1.2.5.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Dependency Hierarchy:

• png-to-ico-2.1.3.tgz (Root Library)
  • ❌ minimist-1.2.5.tgz (Vulnerable Library)

Found in HEAD commit: 16721525f143570fc08a90f6ea0fac3e32523098

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-44906

Release Date: 2022-03-17

Fix Resolution: BumperLane.Public.Service.Contracts - 0.23.35.214-prerelease;cloudscribe.templates - 5.2.0;Virteom.Tenant.Mobile.Bluetooth - 0.21.29.159-prerelease;ShowingVault.DotNet.Sdk - 0.13.41.190-prerelease;Envisia.DotNet.Templates - 3.0.1;Yarnpkg.Yarn - 0.26.1;Virteom.Tenant.Mobile.Framework.UWP - 0.20.41.103-prerelease;Virteom.Tenant.Mobile.Framework.iOS - 0.20.41.103-prerelease;BumperLane.Public.Api.V2.ClientModule - 0.23.35.214-prerelease;VueJS.NetCore - 1.1.1;Dianoga - 4.0.0,3.0.0-RC02;Virteom.Tenant.Mobile.Bluetooth.iOS - 0.20.41.103-prerelease;Virteom.Public.Utilities - 0.23.37.212-prerelease;Indianadavy.VueJsWebAPITemplate.CSharp - 1.0.1;NorDroN.AngularTemplate - 0.1.6;Virteom.Tenant.Mobile.Framework - 0.21.29.159-prerelease;Virteom.Tenant.Mobile.Bluetooth.Android - 0.20.41.103-prerelease;z4a-dotnet-scaffold - 1.0.0.2;Raml.Parser - 1.0.7;CoreVueWebTest - 3.0.101;dotnetng.template - 1.0.0.4;SitecoreMaster.TrueDynamicPlaceholders - 1.0.3;Virteom.Tenant.Mobile.Framework.Android - 0.20.41.103-prerelease;Fable.Template.Elmish.React - 0.1.6;BlazorPolyfill.Build - 6.0.100.2;Fable.Snowpack.Template - 2.1.0;BumperLane.Public.Api.Client - 0.23.35.214-prerelease;Yarn.MSBuild - 0.22.0,0.24.6;Blazor.TailwindCSS.BUnit - 1.0.2;Bridge.AWS - 0.3.30.36;tslint - 5.6.0;SAFE.Template - 3.0.1;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-3807 (High) detected in ansi-regex-3.0.0.tgz, ansi-regex-5.0.0.tgz

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Libraries - ansi-regex-3.0.0.tgz, ansi-regex-5.0.0.tgz

ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: create-pwa/package.json

Path to vulnerable library: create-pwa/node_modules/ansi-regex/package.json

Dependency Hierarchy:

• sharp-0.29.1.tgz (Root Library)
  • prebuild-install-6.1.4.tgz
    • npmlog-4.1.2.tgz
      • gauge-2.7.4.tgz
        • wide-align-1.1.3.tgz
          • string-width-2.1.1.tgz
            • strip-ansi-4.0.0.tgz
              • ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)

ansi-regex-5.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz

Path to dependency file: create-pwa/package.json

Path to vulnerable library: create-pwa/node_modules/ansi-regex/package.json

Dependency Hierarchy:

• yargs-17.0.1.tgz (Root Library)
  • cliui-7.0.4.tgz
    • strip-ansi-6.0.0.tgz
      • ❌ ansi-regex-5.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 2fb8aaf3cf7cc30f93c0d45e33fcc4b1b708d3b1

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution: ansi-regex - 5.0.1,6.0.1

---

Step up your Open Source Security Game with WhiteSource here