Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
### Suggested Fix
Type: Upgrade version
Release Date: 2021-01-22
Fix Resolution (ejs): 3.1.6
Direct dependency fix Resolution (vue-cli-plugin-electron-builder): 2.0.0
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-29078
### Vulnerable Library - ejs-3.1.5.tgz
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Direct dependency fix Resolution (vue-cli-plugin-electron-builder): 2.0.0
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-23362
### Vulnerable Library - hosted-git-info-3.0.5.tgz
Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
Vulnerable Library - vue-cli-plugin-electron-builder-2.0.0-rc.4.tgz
Path to dependency file: /components/dashboard/node_modules/vue-cli-plugin-electron-builder/package.json
Path to vulnerable library: /components/dashboard/node_modules/ejs/package.json
Vulnerabilities
Details
WS-2021-0153
### Vulnerable Library - ejs-3.1.5.tgzEmbedded JavaScript templates
Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.5.tgz
Path to dependency file: /components/dashboard/node_modules/ejs/package.json
Path to vulnerable library: /components/dashboard/node_modules/ejs/package.json
Dependency Hierarchy: - vue-cli-plugin-electron-builder-2.0.0-rc.4.tgz (Root Library) - electron-builder-22.8.1.tgz - app-builder-lib-22.8.1.tgz - :x: **ejs-3.1.5.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsArbitrary Code Injection vulnerability was found in ejs before 3.1.6. Caused by filename which isn't sanitized for display.
Publish Date: 2021-01-22
URL: WS-2021-0153
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2021-01-22
Fix Resolution (ejs): 3.1.6
Direct dependency fix Resolution (vue-cli-plugin-electron-builder): 2.0.0
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)CVE-2022-29078
### Vulnerable Library - ejs-3.1.5.tgzEmbedded JavaScript templates
Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.5.tgz
Path to dependency file: /components/dashboard/node_modules/ejs/package.json
Path to vulnerable library: /components/dashboard/node_modules/ejs/package.json
Dependency Hierarchy: - vue-cli-plugin-electron-builder-2.0.0-rc.4.tgz (Root Library) - electron-builder-22.8.1.tgz - app-builder-lib-22.8.1.tgz - :x: **ejs-3.1.5.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Publish Date: 2022-04-25
URL: CVE-2022-29078
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29078~
Release Date: 2022-04-25
Fix Resolution (ejs): 3.1.7
Direct dependency fix Resolution (vue-cli-plugin-electron-builder): 2.0.0
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)CVE-2021-23362
### Vulnerable Library - hosted-git-info-3.0.5.tgzProvides metadata and conversions from repository urls for Github, Bitbucket and Gitlab
Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-3.0.5.tgz
Path to dependency file: /components/dashboard/node_modules/hosted-git-info/package.json
Path to vulnerable library: /components/dashboard/node_modules/hosted-git-info/package.json
Dependency Hierarchy: - vue-cli-plugin-electron-builder-2.0.0-rc.4.tgz (Root Library) - electron-builder-22.8.1.tgz - app-builder-lib-22.8.1.tgz - :x: **hosted-git-info-3.0.5.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
Publish Date: 2021-03-23
URL: CVE-2021-23362
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-43f8-2h32-f4cj
Release Date: 2021-03-23
Fix Resolution (hosted-git-info): 3.0.8
Direct dependency fix Resolution (vue-cli-plugin-electron-builder): 2.0.0
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)