You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Partial details (17 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
gatsby-2.18.18.tgz (Root Library)
graphql-compose-6.3.8.tgz
❌ object-path-0.11.4.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
A prototype pollution vulnerability has been found in object-path <= 0.11.4 affecting the set() method. The vulnerability is limited to the includeInheritedProps mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of set() in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the includeInheritedProps: true options or the withInheritedProps instance if using a version >= 0.11.0.
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
gatsby-2.18.18.tgz (Root Library)
❌ flat-4.1.0.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability.
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
gatsby-2.18.18.tgz (Root Library)
react-dev-utils-4.2.3.tgz
global-modules-1.0.0.tgz
global-prefix-1.0.2.tgz
❌ ini-1.3.5.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
gatsby-2.18.18.tgz (Root Library)
react-dev-utils-4.2.3.tgz
❌ shell-quote-1.6.1.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
gatsby-2.18.18.tgz (Root Library)
file-loader-1.1.11.tgz
loader-utils-1.2.3.tgz
❌ json5-1.0.1.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
gatsby-2.18.18.tgz (Root Library)
graphql-compose-6.3.8.tgz
❌ object-path-0.11.4.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === 'proto' returns false if currentPath is ['proto']. This is because the === operator returns always false when the type of the operands is different.
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.
mend-for-github-combot
changed the title
gatsby-2.18.18.tgz: 87 vulnerabilities (highest severity is: 9.8)
gatsby-2.18.18.tgz: 87 vulnerabilities (highest severity is: 9.8) - autoclosed
Nov 22, 2023
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
Vulnerable Library - gatsby-2.18.18.tgz
Blazing fast modern site generator for React
Library home page: https://registry.npmjs.org/gatsby/-/gatsby-2.18.18.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-2216
Vulnerable Library - parse-url-5.0.1.tgz
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-5.0.1.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Publish Date: 2022-06-27
URL: CVE-2022-2216
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://huntr.dev/bounties/505a3d39-2723-4a06-b1f7-9b2d133c92e1/
Release Date: 2022-06-27
Fix Resolution (parse-url): parse-url - 6.0.1
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-15256
Vulnerable Library - object-path-0.11.4.tgz
Access deep object properties using a path
Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
A prototype pollution vulnerability has been found in
object-path
<= 0.11.4 affecting theset()
method. The vulnerability is limited to theincludeInheritedProps
mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance ofobject-path
and setting the optionincludeInheritedProps: true
, or by using the defaultwithInheritedProps
instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage ofset()
in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use theincludeInheritedProps: true
options or thewithInheritedProps
instance if using a version >= 0.11.0.Publish Date: 2020-10-19
URL: CVE-2020-15256
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-cwx2-736x-mf6w
Release Date: 2020-10-19
Fix Resolution (object-path): 0.11.5
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-36632
Vulnerable Library - flat-4.1.0.tgz
Take a nested Javascript object and flatten it, or unflatten an object with delimited keys
Library home page: https://registry.npmjs.org/flat/-/flat-4.1.0.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability.
Publish Date: 2022-12-25
URL: CVE-2020-36632
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-2j2x-2gpw-g8fm
Release Date: 2022-12-25
Fix Resolution (flat): flat - 1.6.2,2.0.2,3.0.1,4.1.1,5.0.1
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-7774
Vulnerable Library - y18n-4.0.0.tgz
the bare-bones internationalization library used by yargs
Library home page: https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
Publish Date: 2020-11-17
URL: CVE-2020-7774
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1654
Release Date: 2020-11-17
Fix Resolution (y18n): 3.2.2, 4.0.1, 5.0.5
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2021-44906
Vulnerable Libraries - minimist-0.0.8.tgz, minimist-1.2.0.tgz
minimist-0.0.8.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
minimist-1.2.0.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Publish Date: 2022-03-17
URL: CVE-2021-44906
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2022-03-17
Fix Resolution (minimist): minimist - 1.2.6
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
Fix Resolution (minimist): minimist - 1.2.6
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-7788
Vulnerable Library - ini-1.3.5.tgz
An ini encoder/decoder for node
Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Publish Date: 2020-12-11
URL: CVE-2020-7788
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
Release Date: 2020-12-11
Fix Resolution (ini): v1.3.6
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2022-0691
Vulnerable Library - url-parse-1.4.7.tgz
Small footprint URL parser that works seamlessly across Node.js and browser environments
Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
Publish Date: 2022-02-21
URL: CVE-2022-0691
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691
Release Date: 2022-02-21
Fix Resolution (url-parse): url-parse - 1.5.9
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2022-37601
Vulnerable Library - loader-utils-1.2.3.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.
Publish Date: 2022-10-12
URL: CVE-2022-37601
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-76p3-8jx3-jpfq
Release Date: 2022-10-12
Fix Resolution (loader-utils): loader-utils - 1.4.1,2.0.3
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2021-42740
Vulnerable Library - shell-quote-1.6.1.tgz
quote and parse shell commands
Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.6.1.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Publish Date: 2021-10-21
URL: CVE-2021-42740
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740
Release Date: 2021-10-21
Fix Resolution: shell-quote - 1.7.3
CVE-2021-31597
Vulnerable Library - xmlhttprequest-ssl-1.5.5.tgz
XMLHttpRequest for Node
Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Publish Date: 2021-04-23
URL: CVE-2021-31597
CVSS 3 Score Details (9.4)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31597
Release Date: 2021-04-23
Fix Resolution (xmlhttprequest-ssl): xmlhttprequest-ssl - 1.6.1
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2022-1650
Vulnerable Libraries - eventsource-0.1.6.tgz, eventsource-1.0.7.tgz
eventsource-0.1.6.tgz
W3C compliant EventSource client for Node.js
Library home page: https://registry.npmjs.org/eventsource/-/eventsource-0.1.6.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
eventsource-1.0.7.tgz
W3C compliant EventSource client for Node.js and browser (polyfill)
Library home page: https://registry.npmjs.org/eventsource/-/eventsource-1.0.7.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.
Publish Date: 2022-05-12
URL: CVE-2022-1650
CVSS 3 Score Details (9.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2022-05-12
Fix Resolution: eventsource - 1.1.1,2.0.2
CVE-2022-2900
Vulnerable Library - parse-url-5.0.1.tgz
An advanced url parser supporting git urls too.
Library home page: https://registry.npmjs.org/parse-url/-/parse-url-5.0.1.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
Publish Date: 2022-09-14
URL: CVE-2022-2900
CVSS 3 Score Details (9.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2022-09-14
Fix Resolution (parse-url): parse-url - 8.0.0
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2022-0686
Vulnerable Library - url-parse-1.4.7.tgz
Small footprint URL parser that works seamlessly across Node.js and browser environments
Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.
Publish Date: 2022-02-20
URL: CVE-2022-0686
CVSS 3 Score Details (9.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686
Release Date: 2022-02-20
Fix Resolution (url-parse): url-parse - 1.5.8
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2022-46175
Vulnerable Libraries - json5-2.1.1.tgz, json5-1.0.1.tgz
json5-2.1.1.tgz
JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-2.1.1.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
json5-1.0.1.tgz
JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-1.0.1.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The
parse
method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named__proto__
, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned byJSON5.parse
and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned fromJSON5.parse
. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution.JSON5.parse
should restrict parsing of__proto__
keys when parsing JSON strings to objects. As a point of reference, theJSON.parse
method included in JavaScript ignores__proto__
keys. Simply changingJSON5.parse
toJSON.parse
in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.Publish Date: 2022-12-24
URL: CVE-2022-46175
CVSS 3 Score Details (8.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175
Release Date: 2022-12-24
Fix Resolution (json5): json5 - 2.2.2
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
Fix Resolution (json5): json5 - 2.2.2
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2021-23434
Vulnerable Library - object-path-0.11.4.tgz
Access deep object properties using a path
Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === 'proto' returns false if currentPath is ['proto']. This is because the === operator returns always false when the type of the operands is different.
Publish Date: 2021-08-27
URL: CVE-2021-23434
CVSS 3 Score Details (8.6)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23434
Release Date: 2021-08-27
Fix Resolution (object-path): object-path - 0.11.6
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-7660
Vulnerable Library - serialize-javascript-2.1.2.tgz
Serialize JavaScript to a superset of JSON that includes regular expressions and functions.
Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-2.1.2.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Publish Date: 2020-06-01
URL: CVE-2020-7660
CVSS 3 Score Details (8.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660
Release Date: 2020-06-08
Fix Resolution (serialize-javascript): serialize-javascript - 3.1.0
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-28502
Vulnerable Library - xmlhttprequest-ssl-1.5.5.tgz
XMLHttpRequest for Node
Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz
Path to dependency file: /SingularityUI/node/npm/docs/package.json
Path to vulnerable library: /SingularityUI/node/npm/docs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.
Publish Date: 2021-03-05
URL: CVE-2020-28502
CVSS 3 Score Details (8.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-h4j5-c7cj-74xg
Release Date: 2021-03-05
Fix Resolution (xmlhttprequest-ssl): xmlhttprequest - 1.7.0,xmlhttprequest-ssl - 1.6.2
Direct dependency fix Resolution (gatsby): 2.18.23-berry-mdx.26
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: