*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
Partial details (19 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2022-37601
### Vulnerable Libraries - loader-utils-1.2.3.tgz, loader-utils-1.4.0.tgz
Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/frontend/node_modules/react-dev-utils/node_modules/loader-utils/package.json,/frontend/node_modules/adjust-sourcemap-loader/node_modules/loader-utils/package.json
This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.
The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
Mend Note: After conducting further research, Mend has determined that all versions of set-value up to version 4.0.0 are vulnerable to CVE-2021-23440.
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/json5/package.json,/frontend/node_modules/adjust-sourcemap-loader/node_modules/json5/package.json,/frontend/node_modules/react-dev-utils/node_modules/json5/package.json,/frontend/node_modules/loader-utils/node_modules/json5/package.json
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.
This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
Direct dependency fix Resolution (react-scripts): 3.4.4
Fix Resolution (ssri): ssri - 6.0.2,7.1.1,8.0.1
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-23382
### Vulnerable Libraries - postcss-7.0.21.tgz, postcss-7.0.32.tgz
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/frontend/node_modules/react-dev-utils/node_modules/loader-utils/package.json,/frontend/node_modules/adjust-sourcemap-loader/node_modules/loader-utils/package.json
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/loader-utils/package.json
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2020-15256
### Vulnerable Library - object-path-0.11.4.tgzAccess deep object properties using a path
Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/object-path/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - resolve-url-loader-3.1.1.tgz - adjust-sourcemap-loader-2.0.0.tgz - :x: **object-path-0.11.4.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsA prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.
Publish Date: 2020-10-19
URL: CVE-2020-15256
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/mariocasciaro/object-path/security/advisories/GHSA-cwx2-736x-mf6w
Release Date: 2020-10-19
Fix Resolution (object-path): 0.11.5
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-7788
### Vulnerable Library - ini-1.3.5.tgzAn ini encoder/decoder for node
Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/ini/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - react-dev-utils-10.2.1.tgz - global-modules-2.0.0.tgz - global-prefix-3.0.0.tgz - :x: **ini-1.3.5.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsThis affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Publish Date: 2020-12-11
URL: CVE-2020-7788
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
Release Date: 2020-12-11
Fix Resolution (ini): v1.3.6
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-3757
### Vulnerable Library - immer-1.10.0.tgzCreate your next immutable state by mutating the current one
Library home page: https://registry.npmjs.org/immer/-/immer-1.10.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/immer/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - react-dev-utils-10.2.1.tgz - :x: **immer-1.10.0.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability Detailsimmer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Publish Date: 2021-09-02
URL: CVE-2021-3757
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa/
Release Date: 2021-09-02
Fix Resolution: immer - 9.0.6
CVE-2022-0691
### Vulnerable Library - url-parse-1.4.7.tgzSmall footprint URL parser that works seamlessly across Node.js and browser environments
Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/url-parse/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-dev-server-3.10.3.tgz - sockjs-client-1.4.0.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsAuthorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
Publish Date: 2022-02-21
URL: CVE-2022-0691
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691
Release Date: 2022-02-21
Fix Resolution (url-parse): url-parse - 1.5.9
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2022-37601
### Vulnerable Libraries - loader-utils-1.2.3.tgz, loader-utils-1.4.0.tgz### loader-utils-1.2.3.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/frontend/node_modules/react-dev-utils/node_modules/loader-utils/package.json,/frontend/node_modules/adjust-sourcemap-loader/node_modules/loader-utils/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - resolve-url-loader-3.1.1.tgz - :x: **loader-utils-1.2.3.tgz** (Vulnerable Library) ### loader-utils-1.4.0.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/loader-utils/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.3.3.tgz - :x: **loader-utils-1.4.0.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsPrototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.
Publish Date: 2022-10-12
URL: CVE-2022-37601
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-10-12
Fix Resolution: loader-utils - v2.0.0
CVE-2021-23436
### Vulnerable Library - immer-1.10.0.tgzCreate your next immutable state by mutating the current one
Library home page: https://registry.npmjs.org/immer/-/immer-1.10.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/immer/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - react-dev-utils-10.2.1.tgz - :x: **immer-1.10.0.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsThis affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.
Publish Date: 2021-09-01
URL: CVE-2021-23436
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23436
Release Date: 2021-09-01
Fix Resolution: immer - 9.0.6
CVE-2021-26707
### Vulnerable Library - merge-deep-3.0.2.tgzRecursively merge values in a javascript object.
Library home page: https://registry.npmjs.org/merge-deep/-/merge-deep-3.0.2.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/merge-deep/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.3.3.tgz - plugin-svgo-4.3.1.tgz - :x: **merge-deep-3.0.2.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsThe merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
Publish Date: 2021-06-02
URL: CVE-2021-26707
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1922259
Release Date: 2021-06-02
Fix Resolution (merge-deep): 3.0.3
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-23440
### Vulnerable Library - set-value-2.0.1.tgzCreate nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.1.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/set-value/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.42.0.tgz - micromatch-3.1.10.tgz - snapdragon-0.8.2.tgz - base-0.11.2.tgz - cache-base-1.0.1.tgz - :x: **set-value-2.0.1.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsThis affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays. Mend Note: After conducting further research, Mend has determined that all versions of set-value up to version 4.0.0 are vulnerable to CVE-2021-23440.
Publish Date: 2021-09-12
URL: CVE-2021-23440
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2021-09-12
Fix Resolution: set-value - 4.0.1
CVE-2021-42740
### Vulnerable Library - shell-quote-1.7.2.tgzquote and parse shell commands
Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.7.2.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/shell-quote/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - react-dev-utils-10.2.1.tgz - :x: **shell-quote-1.7.2.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsThe shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Publish Date: 2021-10-21
URL: CVE-2021-42740
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740
Release Date: 2021-10-21
Fix Resolution: shell-quote - 1.7.3
CVE-2022-1650
### Vulnerable Library - eventsource-1.0.7.tgzW3C compliant EventSource client for Node.js and browser (polyfill)
Library home page: https://registry.npmjs.org/eventsource/-/eventsource-1.0.7.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/eventsource/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-dev-server-3.10.3.tgz - sockjs-client-1.4.0.tgz - :x: **eventsource-1.0.7.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsExposure of Sensitive Information to an Unauthorized Actor in GitHub repository eventsource/eventsource prior to v2.0.2.
Publish Date: 2022-05-12
URL: CVE-2022-1650
### CVSS 3 Score Details (9.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-05-12
Fix Resolution (eventsource): eventsource - 1.1.1,2.0.2
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2022-0686
### Vulnerable Library - url-parse-1.4.7.tgzSmall footprint URL parser that works seamlessly across Node.js and browser environments
Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/url-parse/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-dev-server-3.10.3.tgz - sockjs-client-1.4.0.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsAuthorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.
Publish Date: 2022-02-20
URL: CVE-2022-0686
### CVSS 3 Score Details (9.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686
Release Date: 2022-02-20
Fix Resolution (url-parse): url-parse - 1.5.8
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2022-46175
### Vulnerable Libraries - json5-2.1.3.tgz, json5-1.0.1.tgz### json5-2.1.3.tgz
JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-2.1.3.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/json5/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - core-7.9.0.tgz - :x: **json5-2.1.3.tgz** (Vulnerable Library) ### json5-1.0.1.tgz
JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-1.0.1.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/json5/package.json,/frontend/node_modules/adjust-sourcemap-loader/node_modules/json5/package.json,/frontend/node_modules/react-dev-utils/node_modules/json5/package.json,/frontend/node_modules/loader-utils/node_modules/json5/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.3.3.tgz - loader-utils-1.4.0.tgz - :x: **json5-1.0.1.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsJSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.
Publish Date: 2022-12-24
URL: CVE-2022-46175
### CVSS 3 Score Details (8.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175
Release Date: 2022-12-24
Fix Resolution (json5): json5 - 2.2.2
Direct dependency fix Resolution (react-scripts): 3.4.4
Fix Resolution (json5): json5 - 2.2.2
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-23434
### Vulnerable Library - object-path-0.11.4.tgzAccess deep object properties using a path
Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/object-path/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - resolve-url-loader-3.1.1.tgz - adjust-sourcemap-loader-2.0.0.tgz - :x: **object-path-0.11.4.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsThis affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.
Publish Date: 2021-08-27
URL: CVE-2021-23434
### CVSS 3 Score Details (8.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23434
Release Date: 2021-08-27
Fix Resolution (object-path): object-path - 0.11.6
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-7660
### Vulnerable Library - serialize-javascript-2.1.2.tgzSerialize JavaScript to a superset of JSON that includes regular expressions and functions.
Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-2.1.2.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/serialize-javascript/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - terser-webpack-plugin-2.3.5.tgz - :x: **serialize-javascript-2.1.2.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability Detailsserialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Publish Date: 2020-06-01
URL: CVE-2020-7660
### CVSS 3 Score Details (8.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660
Release Date: 2020-06-08
Fix Resolution (serialize-javascript): serialize-javascript - 3.1.0
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-43138
### Vulnerable Library - async-2.6.3.tgzHigher-order functions and common patterns for asynchronous code
Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/async/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-dev-server-3.10.3.tgz - portfinder-1.0.26.tgz - :x: **async-2.6.3.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsIn Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
Publish Date: 2022-04-06
URL: CVE-2021-43138
### CVSS 3 Score Details (7.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138
Release Date: 2022-04-06
Fix Resolution (async): async - 2.6.4,3.2.2
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-13822
### Vulnerable Library - elliptic-6.5.2.tgzEC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.2.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/elliptic/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.42.0.tgz - node-libs-browser-2.2.1.tgz - crypto-browserify-3.12.0.tgz - browserify-sign-4.2.0.tgz - :x: **elliptic-6.5.2.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsThe Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Publish Date: 2020-06-04
URL: CVE-2020-13822
### CVSS 3 Score Details (7.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-07-02
Fix Resolution (elliptic): v6.5.3
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-27290
### Vulnerable Libraries - ssri-7.1.0.tgz, ssri-6.0.1.tgz### ssri-7.1.0.tgz
Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.
Library home page: https://registry.npmjs.org/ssri/-/ssri-7.1.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/ssri/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - terser-webpack-plugin-2.3.5.tgz - cacache-13.0.1.tgz - :x: **ssri-7.1.0.tgz** (Vulnerable Library) ### ssri-6.0.1.tgz
Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.
Library home page: https://registry.npmjs.org/ssri/-/ssri-6.0.1.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/webpack/node_modules/ssri/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.42.0.tgz - terser-webpack-plugin-1.4.4.tgz - cacache-12.0.4.tgz - :x: **ssri-6.0.1.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability Detailsssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
Publish Date: 2021-03-12
URL: CVE-2021-27290
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-vx3p-948g-6vhq
Release Date: 2021-03-12
Fix Resolution (ssri): ssri - 6.0.2,7.1.1,8.0.1
Direct dependency fix Resolution (react-scripts): 3.4.4
Fix Resolution (ssri): ssri - 6.0.2,7.1.1,8.0.1
Direct dependency fix Resolution (react-scripts): 3.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-23382
### Vulnerable Libraries - postcss-7.0.21.tgz, postcss-7.0.32.tgz### postcss-7.0.21.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.21.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/postcss/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - resolve-url-loader-3.1.1.tgz - :x: **postcss-7.0.21.tgz** (Vulnerable Library) ### postcss-7.0.32.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.32.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/postcss/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - css-loader-3.4.2.tgz - :x: **postcss-7.0.32.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsThe package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
Publish Date: 2021-04-26
URL: CVE-2021-23382
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382
Release Date: 2021-04-26
Fix Resolution: postcss - 8.2.13
CVE-2022-37603
### Vulnerable Libraries - loader-utils-1.2.3.tgz, loader-utils-1.4.0.tgz### loader-utils-1.2.3.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/frontend/node_modules/react-dev-utils/node_modules/loader-utils/package.json,/frontend/node_modules/adjust-sourcemap-loader/node_modules/loader-utils/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - resolve-url-loader-3.1.1.tgz - :x: **loader-utils-1.2.3.tgz** (Vulnerable Library) ### loader-utils-1.4.0.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/loader-utils/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.3.3.tgz - :x: **loader-utils-1.4.0.tgz** (Vulnerable Library)
Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b
Found in base branch: main
### Vulnerability DetailsA Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
Publish Date: 2022-10-14
URL: CVE-2022-37603
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-3rfm-jhwj-7488
Release Date: 2022-10-14
Fix Resolution: loader-utils - 1.4.2,2.0.4,3.2.1
:rescue_worker_helmet: Automatic Remediation is available for this issue.