WS-2021-0129 (High) detected in json-ptr-1.3.2.tgz - autoclosed

[mend-bolt-for-github[bot]]

WS-2021-0129 - High Severity Vulnerability

Vulnerable Library - json-ptr-1.3.2.tgz

A complete implementation of JSON Pointer (RFC 6901) for nodejs and modern browsers.

Library home page: https://registry.npmjs.org/json-ptr/-/json-ptr-1.3.2.tgz

Path to dependency file: /aio/package.json

Path to vulnerable library: /aio/node_modules/json-ptr/package.json

Dependency Hierarchy: - firebase-tools-8.14.1.tgz (Root Library) - exegesis-express-2.0.0.tgz - exegesis-2.5.6.tgz - :x: **json-ptr-1.3.2.tgz** (Vulnerable Library)

Found in HEAD commit: 197549abaa597eeb2014ae339d9a65282dd76d17

Found in base branch: labs/router

Vulnerability Details

There is a security vulnerability in json-ptr versions prior to v2.1.0 in which an unscrupulous actor may execute arbitrary code. If your code sends un-sanitized user input to json-ptr's .get() method, your project is vulnerable to this injection-style vulnerability.

Publish Date: 2021-05-10

URL: WS-2021-0129

CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-rrqv-vjrw-hrcr

Release Date: 2021-05-10

Fix Resolution (json-ptr): 2.0.1-issue-28-and-30.f825bd7

Direct dependency fix Resolution (firebase-tools): 8.15.0

---

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.