mend-for-github-com[bot]
commented
1 year ago :heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
Blazing fast modern site generator for React
Library home page: https://registry.npmjs.org/gatsby/-/gatsby-2.18.18.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-2216
### Vulnerable Library - parse-url-5.0.1.tgzAn advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-5.0.1.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - gatsby-telemetry-1.1.46.tgz - git-up-4.0.1.tgz - :x: **parse-url-5.0.1.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsServer-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Publish Date: 2022-06-27
URL: CVE-2022-2216
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://huntr.dev/bounties/505a3d39-2723-4a06-b1f7-9b2d133c92e1/
Release Date: 2022-06-27
Fix Resolution (parse-url): parse-url - 6.0.1
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-15256
### Vulnerable Library - object-path-0.11.4.tgzAccess deep object properties using a path
Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - graphql-compose-6.3.8.tgz - :x: **object-path-0.11.4.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsA prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.
Publish Date: 2020-10-19
URL: CVE-2020-15256
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/mariocasciaro/object-path/security/advisories/GHSA-cwx2-736x-mf6w
Release Date: 2020-10-19
Fix Resolution (object-path): 0.11.5
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-36632
### Vulnerable Library - flat-4.1.0.tgzTake a nested Javascript object and flatten it, or unflatten an object with delimited keys
Library home page: https://registry.npmjs.org/flat/-/flat-4.1.0.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - :x: **flat-4.1.0.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsA vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability.
Publish Date: 2022-12-25
URL: CVE-2020-36632
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-2j2x-2gpw-g8fm
Release Date: 2022-12-25
Fix Resolution (flat): flat - 1.6.2,2.0.2,3.0.1,4.1.1,5.0.1
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-7774
### Vulnerable Library - y18n-4.0.0.tgzthe bare-bones internationalization library used by yargs
Library home page: https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - copyfiles-2.1.1.tgz - yargs-13.3.0.tgz - :x: **y18n-4.0.0.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsThe package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
Publish Date: 2020-11-17
URL: CVE-2020-7774
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.npmjs.com/advisories/1654
Release Date: 2020-11-17
Fix Resolution (y18n): 3.2.2, 4.0.1, 5.0.5
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-44906
### Vulnerable Libraries - minimist-0.0.8.tgz, minimist-1.2.0.tgz### minimist-0.0.8.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - webpack-dev-server-3.10.1.tgz - chokidar-2.1.8.tgz - fsevents-1.2.11.tgz - node-pre-gyp-0.14.0.tgz - mkdirp-0.5.1.tgz - :x: **minimist-0.0.8.tgz** (Vulnerable Library) ### minimist-1.2.0.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - file-loader-1.1.11.tgz - loader-utils-1.2.3.tgz - json5-1.0.1.tgz - :x: **minimist-1.2.0.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsMinimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Publish Date: 2022-03-17
URL: CVE-2021-44906
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-03-17
Fix Resolution (minimist): minimist - 1.2.6
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
Fix Resolution (minimist): minimist - 1.2.6
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-7788
### Vulnerable Library - ini-1.3.5.tgzAn ini encoder/decoder for node
Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - react-dev-utils-4.2.3.tgz - global-modules-1.0.0.tgz - global-prefix-1.0.2.tgz - :x: **ini-1.3.5.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsThis affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Publish Date: 2020-12-11
URL: CVE-2020-7788
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
Release Date: 2020-12-11
Fix Resolution (ini): v1.3.6
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-0691
### Vulnerable Library - url-parse-1.4.7.tgzSmall footprint URL parser that works seamlessly across Node.js and browser environments
Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - react-dev-utils-4.2.3.tgz - sockjs-client-1.1.4.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsAuthorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
Publish Date: 2022-02-21
URL: CVE-2022-0691
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691
Release Date: 2022-02-21
Fix Resolution (url-parse): url-parse - 1.5.9
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-37601
### Vulnerable Library - loader-utils-1.2.3.tgzutils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - file-loader-1.1.11.tgz - :x: **loader-utils-1.2.3.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsPrototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.
Publish Date: 2022-10-12
URL: CVE-2022-37601
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-76p3-8jx3-jpfq
Release Date: 2022-10-12
Fix Resolution (loader-utils): loader-utils - 1.4.1,2.0.3
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-42740
### Vulnerable Library - shell-quote-1.6.1.tgzquote and parse shell commands
Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.6.1.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - react-dev-utils-4.2.3.tgz - :x: **shell-quote-1.6.1.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsThe shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Publish Date: 2021-10-21
URL: CVE-2021-42740
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740
Release Date: 2021-10-21
Fix Resolution: shell-quote - 1.7.3
CVE-2021-31597
### Vulnerable Library - xmlhttprequest-ssl-1.5.5.tgzXMLHttpRequest for Node
Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - socket.io-2.3.0.tgz - socket.io-client-2.3.0.tgz - engine.io-client-3.4.0.tgz - :x: **xmlhttprequest-ssl-1.5.5.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsThe xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Publish Date: 2021-04-23
URL: CVE-2021-31597
### CVSS 3 Score Details (9.4)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31597
Release Date: 2021-04-23
Fix Resolution (xmlhttprequest-ssl): xmlhttprequest-ssl - 1.6.1
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-1650
### Vulnerable Libraries - eventsource-0.1.6.tgz, eventsource-1.0.7.tgz### eventsource-0.1.6.tgz
W3C compliant EventSource client for Node.js
Library home page: https://registry.npmjs.org/eventsource/-/eventsource-0.1.6.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - react-dev-utils-4.2.3.tgz - sockjs-client-1.1.4.tgz - :x: **eventsource-0.1.6.tgz** (Vulnerable Library) ### eventsource-1.0.7.tgz
W3C compliant EventSource client for Node.js and browser (polyfill)
Library home page: https://registry.npmjs.org/eventsource/-/eventsource-1.0.7.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - webpack-dev-server-3.10.1.tgz - sockjs-client-1.4.0.tgz - :x: **eventsource-1.0.7.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsImproper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.
Publish Date: 2022-05-12
URL: CVE-2022-1650
### CVSS 3 Score Details (9.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-05-12
Fix Resolution: eventsource - 1.1.1,2.0.2
CVE-2022-2900
### Vulnerable Library - parse-url-5.0.1.tgzAn advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-5.0.1.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - gatsby-telemetry-1.1.46.tgz - git-up-4.0.1.tgz - :x: **parse-url-5.0.1.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsServer-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
Publish Date: 2022-09-14
URL: CVE-2022-2900
### CVSS 3 Score Details (9.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-09-14
Fix Resolution (parse-url): parse-url - 8.0.0
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-0686
### Vulnerable Library - url-parse-1.4.7.tgzSmall footprint URL parser that works seamlessly across Node.js and browser environments
Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - react-dev-utils-4.2.3.tgz - sockjs-client-1.1.4.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsAuthorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.
Publish Date: 2022-02-20
URL: CVE-2022-0686
### CVSS 3 Score Details (9.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686
Release Date: 2022-02-20
Fix Resolution (url-parse): url-parse - 1.5.8
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-46175
### Vulnerable Libraries - json5-2.1.1.tgz, json5-1.0.1.tgz### json5-2.1.1.tgz
JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-2.1.1.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - core-7.7.7.tgz - :x: **json5-2.1.1.tgz** (Vulnerable Library) ### json5-1.0.1.tgz
JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-1.0.1.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - file-loader-1.1.11.tgz - loader-utils-1.2.3.tgz - :x: **json5-1.0.1.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsJSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.
Publish Date: 2022-12-24
URL: CVE-2022-46175
### CVSS 3 Score Details (8.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175
Release Date: 2022-12-24
Fix Resolution (json5): json5 - 2.2.2
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
Fix Resolution (json5): json5 - 2.2.2
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-23434
### Vulnerable Library - object-path-0.11.4.tgzAccess deep object properties using a path
Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - graphql-compose-6.3.8.tgz - :x: **object-path-0.11.4.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsThis affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.
Publish Date: 2021-08-27
URL: CVE-2021-23434
### CVSS 3 Score Details (8.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23434
Release Date: 2021-08-27
Fix Resolution (object-path): object-path - 0.11.6
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-7660
### Vulnerable Library - serialize-javascript-2.1.2.tgzSerialize JavaScript to a superset of JSON that includes regular expressions and functions.
Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-2.1.2.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - terser-webpack-plugin-1.4.3.tgz - :x: **serialize-javascript-2.1.2.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability Detailsserialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Publish Date: 2020-06-01
URL: CVE-2020-7660
### CVSS 3 Score Details (8.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660
Release Date: 2020-06-08
Fix Resolution (serialize-javascript): serialize-javascript - 3.1.0
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-28502
### Vulnerable Library - xmlhttprequest-ssl-1.5.5.tgzXMLHttpRequest for Node
Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy: - gatsby-2.18.18.tgz (Root Library) - socket.io-2.3.0.tgz - socket.io-client-2.3.0.tgz - engine.io-client-3.4.0.tgz - :x: **xmlhttprequest-ssl-1.5.5.tgz** (Vulnerable Library)
Found in base branch: master
### Vulnerability DetailsThis affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.
Publish Date: 2021-03-05
URL: CVE-2020-28502
### CVSS 3 Score Details (8.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-h4j5-c7cj-74xg
Release Date: 2021-03-05
Fix Resolution (xmlhttprequest-ssl): xmlhttprequest - 1.7.0,xmlhttprequest-ssl - 1.6.2
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.