Mend has checked all newer package trees, and you are on the least vulnerable package!
Please note: There might be a version that explicitly solves one or more of the vulnerabilities listed below, but we do not recommend it. For more info about the optional fixes, check the "Details" section below.
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.
Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/frontend/node_modules/react-dev-utils/node_modules/loader-utils/package.json
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.
Path to vulnerable library: /frontend/node_modules/fast-glob/node_modules/glob-parent/package.json,/frontend/node_modules/webpack-dev-server/node_modules/glob-parent/package.json,/frontend/node_modules/watchpack-chokidar2/node_modules/glob-parent/package.json
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/frontend/node_modules/react-dev-utils/node_modules/loader-utils/package.json
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/immer/package.json
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Please note: There might be a version that explicitly solves one or more of the vulnerabilities listed below, but we do not recommend it. For more info about the optional fixes, check the "Details" section below.
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2021-23436
### Vulnerable Library - immer-1.10.0.tgzCreate your next immutable state by mutating the current one
Library home page: https://registry.npmjs.org/immer/-/immer-1.10.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/immer/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - react-dev-utils-10.2.1.tgz - :x: **immer-1.10.0.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsThis affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.
Publish Date: 2021-09-01
URL: CVE-2021-23436
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23436
Release Date: 2021-09-01
Fix Resolution: immer - 9.0.6
CVE-2022-37601
### Vulnerable Library - loader-utils-1.2.3.tgzutils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/frontend/node_modules/react-dev-utils/node_modules/loader-utils/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - resolve-url-loader-3.1.2.tgz - :x: **loader-utils-1.2.3.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsPrototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.
Publish Date: 2022-10-12
URL: CVE-2022-37601
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-76p3-8jx3-jpfq
Release Date: 2022-10-12
Fix Resolution: loader-utils - 1.4.1,2.0.3
CVE-2021-3757
### Vulnerable Library - immer-1.10.0.tgzCreate your next immutable state by mutating the current one
Library home page: https://registry.npmjs.org/immer/-/immer-1.10.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/immer/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - react-dev-utils-10.2.1.tgz - :x: **immer-1.10.0.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability Detailsimmer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Publish Date: 2021-09-02
URL: CVE-2021-3757
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa/
Release Date: 2021-09-02
Fix Resolution: immer - 9.0.6
CVE-2021-42740
### Vulnerable Library - shell-quote-1.7.2.tgzquote and parse shell commands
Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.7.2.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/shell-quote/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - react-dev-utils-10.2.1.tgz - :x: **shell-quote-1.7.2.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsThe shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Publish Date: 2021-10-21
URL: CVE-2021-42740
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740
Release Date: 2021-10-21
Fix Resolution: shell-quote - 1.7.3
CVE-2021-23424
### Vulnerable Library - ansi-html-0.0.7.tgzAn elegant lib that converts the chalked (ANSI) text to HTML.
Library home page: https://registry.npmjs.org/ansi-html/-/ansi-html-0.0.7.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/ansi-html/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - :x: **ansi-html-0.0.7.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsThis affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.
Publish Date: 2021-08-18
URL: CVE-2021-23424
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-23424
Release Date: 2021-08-18
Fix Resolution: VueJS.NetCore - 1.1.1;Indianadavy.VueJsWebAPITemplate.CSharp - 1.0.1;NorDroN.AngularTemplate - 0.1.6;CoreVueWebTest - 3.0.101;dotnetng.template - 1.0.0.4;Fable.Template.Elmish.React - 0.1.6;SAFE.Template - 3.0.1;GR.PageRender.Razor - 1.8.0;Envisia.DotNet.Templates - 3.0.1
CVE-2020-28477
### Vulnerable Library - immer-1.10.0.tgzCreate your next immutable state by mutating the current one
Library home page: https://registry.npmjs.org/immer/-/immer-1.10.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/immer/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - react-dev-utils-10.2.1.tgz - :x: **immer-1.10.0.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsThis affects all versions of package immer.
Publish Date: 2021-01-19
URL: CVE-2020-28477
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2021-01-19
Fix Resolution: v8.0.1
CVE-2020-28469
### Vulnerable Library - glob-parent-3.1.0.tgzStrips glob magic from a string to provide the parent directory path
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/fast-glob/node_modules/glob-parent/package.json,/frontend/node_modules/webpack-dev-server/node_modules/glob-parent/package.json,/frontend/node_modules/watchpack-chokidar2/node_modules/glob-parent/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - chokidar-2.1.8.tgz - :x: **glob-parent-3.1.0.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsThis affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Publish Date: 2021-06-03
URL: CVE-2020-28469
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
Release Date: 2021-06-03
Fix Resolution: glob-parent - 5.1.2
CVE-2021-23382
### Vulnerable Library - postcss-7.0.21.tgzTool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.21.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/postcss/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - resolve-url-loader-3.1.2.tgz - :x: **postcss-7.0.21.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsThe package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
Publish Date: 2021-04-26
URL: CVE-2021-23382
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382
Release Date: 2021-04-26
Fix Resolution: postcss - 8.2.13
CVE-2022-37603
### Vulnerable Library - loader-utils-1.2.3.tgzutils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/frontend/node_modules/react-dev-utils/node_modules/loader-utils/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - resolve-url-loader-3.1.2.tgz - :x: **loader-utils-1.2.3.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsA Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
Publish Date: 2022-10-14
URL: CVE-2022-37603
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-3rfm-jhwj-7488
Release Date: 2022-10-14
Fix Resolution: loader-utils - 1.4.2,2.0.4,3.2.1
CVE-2022-24772
### Vulnerable Library - node-forge-0.10.0.tgzJavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/node-forge/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - selfsigned-1.10.14.tgz - :x: **node-forge-0.10.0.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24772
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772
Release Date: 2022-03-18
Fix Resolution: node-forge - 1.3.0
CVE-2021-23343
### Vulnerable Library - path-parse-1.0.6.tgzNode.js path.parse() ponyfill
Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/path-parse/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - resolve-1.15.0.tgz - :x: **path-parse-1.0.6.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsAll versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
Publish Date: 2021-05-04
URL: CVE-2021-23343
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2021-05-04
Fix Resolution: path-parse - 1.0.7
CVE-2022-24771
### Vulnerable Library - node-forge-0.10.0.tgzJavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/node-forge/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - selfsigned-1.10.14.tgz - :x: **node-forge-0.10.0.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24771
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771
Release Date: 2022-03-18
Fix Resolution: node-forge - 1.3.0
CVE-2021-3803
### Vulnerable Library - nth-check-1.0.2.tgzperformant nth-check parser & compiler
Library home page: https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/nth-check/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - webpack-4.3.3.tgz - plugin-svgo-4.3.1.tgz - svgo-1.3.2.tgz - css-select-2.1.0.tgz - :x: **nth-check-1.0.2.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability Detailsnth-check is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3803
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2021-09-17
Fix Resolution: nth-check - v2.0.1
WS-2022-0008
### Vulnerable Library - node-forge-0.10.0.tgzJavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/node-forge/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - selfsigned-1.10.14.tgz - :x: **node-forge-0.10.0.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsThe forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.
Publish Date: 2022-01-08
URL: WS-2022-0008
### CVSS 3 Score Details (6.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: High - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-5rrq-pxf6-6jx5
Release Date: 2022-01-08
Fix Resolution: node-forge - 1.0.0
CVE-2022-0122
### Vulnerable Library - node-forge-0.10.0.tgzJavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/node-forge/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - selfsigned-1.10.14.tgz - :x: **node-forge-0.10.0.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability Detailsforge is vulnerable to URL Redirection to Untrusted Site Mend Note: Converted from WS-2022-0007, on 2022-11-07.
Publish Date: 2022-01-06
URL: CVE-2022-0122
### CVSS 3 Score Details (6.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-gf8q-jrpm-jvxq
Release Date: 2022-01-06
Fix Resolution: node-forge - 1.0.0
CVE-2020-15366
### Vulnerable Library - ajv-6.12.2.tgzAnother JSON Schema Validator
Library home page: https://registry.npmjs.org/ajv/-/ajv-6.12.2.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/ajv/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - eslint-6.8.0.tgz - :x: **ajv-6.12.2.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsAn issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Publish Date: 2020-07-15
URL: CVE-2020-15366
### CVSS 3 Score Details (5.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-07-15
Fix Resolution: ajv - 6.12.3
CVE-2021-24033
### Vulnerable Library - react-dev-utils-10.2.1.tgzwebpack utilities used by Create React App
Library home page: https://registry.npmjs.org/react-dev-utils/-/react-dev-utils-10.2.1.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/react-dev-utils/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - :x: **react-dev-utils-10.2.1.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability Detailsreact-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
Publish Date: 2021-03-09
URL: CVE-2021-24033
### CVSS 3 Score Details (5.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.facebook.com/security/advisories/cve-2021-24033
Release Date: 2021-03-09
Fix Resolution: react-dev-utils-11.0.4
CVE-2022-24773
### Vulnerable Library - node-forge-0.10.0.tgzJavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/node-forge/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - selfsigned-1.10.14.tgz - :x: **node-forge-0.10.0.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24773
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773
Release Date: 2022-03-18
Fix Resolution: node-forge - 1.3.0
CVE-2021-23364
### Vulnerable Library - browserslist-4.10.0.tgzShare target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset
Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.10.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/react-dev-utils/node_modules/browserslist/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - react-dev-utils-10.2.1.tgz - :x: **browserslist-4.10.0.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsThe package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Publish Date: 2021-04-28
URL: CVE-2021-23364
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364
Release Date: 2021-04-28
Fix Resolution: browserslist - 4.16.5
CVE-2021-23368
### Vulnerable Library - postcss-7.0.21.tgzTool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.21.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/postcss/package.json
Dependency Hierarchy: - react-scripts-3.4.4.tgz (Root Library) - resolve-url-loader-3.1.2.tgz - :x: **postcss-7.0.21.tgz** (Vulnerable Library)
Found in HEAD commit: 47c3f69f5fb2bf2f18d908d9a06013985b4b7742
Found in base branch: master
### Vulnerability DetailsThe package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
Publish Date: 2021-04-12
URL: CVE-2021-23368
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23368
Release Date: 2021-04-12
Fix Resolution: postcss -8.2.10