You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).NOTE: The request package is no longer supported by the maintainer.
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
mend-bolt-for-githubbot
changed the title
gitmoji-changelog-2.3.0.tgz: 3 vulnerabilities (highest severity is: 9.8)
gitmoji-changelog-2.3.0.tgz: 4 vulnerabilities (highest severity is: 9.8)
Jan 27, 2023
mend-bolt-for-githubbot
changed the title
gitmoji-changelog-2.3.0.tgz: 4 vulnerabilities (highest severity is: 9.8)
gitmoji-changelog-2.3.0.tgz: 5 vulnerabilities (highest severity is: 9.8)
Feb 1, 2023
mend-bolt-for-githubbot
changed the title
gitmoji-changelog-2.3.0.tgz: 5 vulnerabilities (highest severity is: 9.8)
gitmoji-changelog-2.3.0.tgz: 4 vulnerabilities (highest severity is: 9.8)
Feb 9, 2023
mend-bolt-for-githubbot
changed the title
gitmoji-changelog-2.3.0.tgz: 4 vulnerabilities (highest severity is: 9.8)
gitmoji-changelog-2.3.0.tgz: 5 vulnerabilities (highest severity is: 9.8)
Mar 17, 2023
mend-bolt-for-githubbot
changed the title
gitmoji-changelog-2.3.0.tgz: 5 vulnerabilities (highest severity is: 9.8)
gitmoji-changelog-2.3.0.tgz: 6 vulnerabilities (highest severity is: 9.8)
Apr 7, 2023
mend-bolt-for-githubbot
changed the title
gitmoji-changelog-2.3.0.tgz: 6 vulnerabilities (highest severity is: 9.8)
gitmoji-changelog-2.3.0.tgz: 7 vulnerabilities (highest severity is: 9.8)
Apr 26, 2023
mend-bolt-for-githubbot
changed the title
gitmoji-changelog-2.3.0.tgz: 7 vulnerabilities (highest severity is: 9.8)
gitmoji-changelog-2.3.0.tgz: 6 vulnerabilities (highest severity is: 9.8)
May 1, 2023
mend-bolt-for-githubbot
changed the title
gitmoji-changelog-2.3.0.tgz: 6 vulnerabilities (highest severity is: 9.8)
gitmoji-changelog-2.3.0.tgz: 8 vulnerabilities (highest severity is: 9.8)
Mar 13, 2024
mend-bolt-for-githubbot
changed the title
gitmoji-changelog-2.3.0.tgz: 8 vulnerabilities (highest severity is: 9.8)
gitmoji-changelog-2.3.0.tgz: 9 vulnerabilities (highest severity is: 9.8)
Apr 17, 2024
Vulnerable Library - gitmoji-changelog-2.3.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-42282
Vulnerable Library - ip-1.1.5.tgz
[![](https://badge.fury.io/js/ip.svg)](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
Vulnerability Details
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
Publish Date: 2024-02-08
URL: CVE-2023-42282
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-78xj-cgh5-2h22
Release Date: 2024-02-08
Fix Resolution: ip - 1.1.9,2.0.1
Step up your Open Source Security Game with Mend here
CVE-2023-26136
Vulnerable Library - tough-cookie-2.5.0.tgz
RFC6265 Cookies and Cookie Jar for node.js
Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
Vulnerability Details
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Publish Date: 2023-07-01
URL: CVE-2023-26136
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136
Release Date: 2023-07-01
Fix Resolution: tough-cookie - 4.1.3
Step up your Open Source Security Game with Mend here
CVE-2022-25912
Vulnerable Library - simple-git-1.132.0.tgz
Simple GIT interface for node.js
Library home page: https://registry.npmjs.org/simple-git/-/simple-git-1.132.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
Vulnerability Details
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.
Publish Date: 2022-12-06
URL: CVE-2022-25912
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-25912
Release Date: 2022-12-06
Fix Resolution: simple-git - 3.15.0
Step up your Open Source Security Game with Mend here
CVE-2022-24433
Vulnerable Library - simple-git-1.132.0.tgz
Simple GIT interface for node.js
Library home page: https://registry.npmjs.org/simple-git/-/simple-git-1.132.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
Vulnerability Details
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.
Publish Date: 2022-03-11
URL: CVE-2022-24433
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-3f95-r44v-8mrg
Release Date: 2022-03-11
Fix Resolution: simple-git - 3.3.0
Step up your Open Source Security Game with Mend here
CVE-2022-24066
Vulnerable Library - simple-git-1.132.0.tgz
Simple GIT interface for node.js
Library home page: https://registry.npmjs.org/simple-git/-/simple-git-1.132.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
Vulnerability Details
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover.
Publish Date: 2022-04-01
URL: CVE-2022-24066
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-28xr-mwxg-3qc8
Release Date: 2022-04-01
Fix Resolution: simple-git - 3.5.0
Step up your Open Source Security Game with Mend here
CVE-2022-25881
Vulnerable Library - http-cache-semantics-3.8.1.tgz
Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies
Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-3.8.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
Vulnerability Details
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
Publish Date: 2023-01-31
URL: CVE-2022-25881
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-rc47-6667-2j5j
Release Date: 2023-01-31
Fix Resolution: http-cache-semantics - 4.1.1;org.webjars.npm:http-cache-semantics:4.1.1
Step up your Open Source Security Game with Mend here
CVE-2024-28863
Vulnerable Library - tar-4.4.19.tgz
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.19.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
Vulnerability Details
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
Publish Date: 2024-03-21
URL: CVE-2024-28863
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-f5x3-32g6-xq36
Release Date: 2024-03-21
Fix Resolution: tar - 6.2.1
Step up your Open Source Security Game with Mend here
CVE-2023-28155
Vulnerable Library - request-2.88.2.tgz
Simplified HTTP request client.
Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
Vulnerability Details
The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).NOTE: The request package is no longer supported by the maintainer.
Publish Date: 2023-03-16
URL: CVE-2023-28155
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-p8p7-x288-28g6
Release Date: 2023-03-16
Fix Resolution: @cypress/request - 3.0.0
Step up your Open Source Security Game with Mend here
CVE-2023-0842
Vulnerable Library - xml2js-0.4.23.tgz
Simple XML to JavaScript object converter.
Library home page: https://registry.npmjs.org/xml2js/-/xml2js-0.4.23.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 834c8093a002fdc1cff9b1e8c2d3b293b9514fde
Found in base branch: develop
Vulnerability Details
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
Publish Date: 2023-04-05
URL: CVE-2023-0842
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-0842
Release Date: 2023-04-05
Fix Resolution: xml2js - 0.5.0
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: