ugh, npm.
There are 50 npm security advisories affecting our repositories.
Severity: critical
handlebarsbefore 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
Severity: critical
The
xmlhttprequest-sslpackage before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Severity: high
Versions of
markdown-to-jsxprior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containingdataor VBScript URIs and a base64-encoded payload.
Severity: high
Versions of
cryptilesprior to 4.1.2 are vulnerable to Insufficient Entropy. TherandomDigits()method does not provide sufficient entropy and its generates digits that are not evenly distributed.
Severity: high
The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Severity: high
serialize-javascriptprior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".An object such as
{"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"}was serialized as{"foo": /1"/, "bar": "a\/1"/}, which allows an attacker to escape the bar key. This requires the attacker to control the values of both foo and bar and guess the value of. The UID has a keyspace of approximately 4 billion making it a realistic network attack. The following proof-of-concept calls console.log() when the running eval():
eval('('+ serialize({"foo": /1" + console.log(1)/i, "bar": '"@__R-<UID>-0__@'}) + ')');
Severity: high
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1 <2.2.1 and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Severity: high
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
Severity: high
The
axiosNPM package before 0.21.1 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
Severity: high
Overview
Affected versions of
immerare vulnerable to Prototype Pollution.Proof of exploit
const {applyPatches, enablePatches} = require("immer"); enablePatches(); let obj = {}; console.log("Before : " + obj.polluted); applyPatches({}, [ { op: 'add', path: [ "__proto__", "polluted" ], value: "yes" } ]); // applyPatches({}, [ { op: 'replace', path: [ "__proto__", "polluted" ], value: "yes" } ]); console.log("After : " + obj.polluted);Remediation
Version 8.0.1 contains a fix for this vulnerability, updating is recommended.
Severity: high
Affected versions of
diffare vulnerable to Regular Expression Denial of Service (ReDoS). This can cause an impact of about 10 seconds matching time for data 48K characters long.
Severity: high
y18nbefore versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to prototype pollution.POC
``` const y18n = require('y18n')();
y18n.setLocale('proto'); y18n.updateLocale({polluted: true});
console.log(polluted); // true ```
Severity: high
In
xmlhttprequest-sslbefore 1.6.2 when requests are sent synchronously (async=Falseonxhr.open), malicious user input flowing intoxhr.sendcould result in arbitrary code being injected and run.
Severity: high
Versions of
mergebefore 2.1.1 are vulnerable to Prototype Pollution via _recursiveMerge .
Severity: high
lodashversions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Severity: high
The package
underscorefrom 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Severity: high
url-parsebefore 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Severity: high
ua-parser-js>= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
Severity: high
property-exprbefore 2.0.3 are vulnerable to Prototype Pollution via the setter function.
Severity: high
Versions of
gruntbefore 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the functionload()instead of its secure replacementsafeLoad()of the package js-yaml inside grunt.file.readYAML.
Severity: high
Versions of
trimlower than 0.0.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
Severity: high
trim-newlinesbefore 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Severity: high
normalize-urlpackage before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
Severity: high
In
prismjsbefore 1.24.0 some languages are vulnerable to Regular Expression Denial of Service (ReDoS).Impact
When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. Do not use the following languages to highlight untrusted text.
- ASCIIDoc
- ERB
Other languages are not affected and can be used to highlight untrusted text.
Patches
This problem has been fixed in Prism v1.24.
References
- PrismJS/prism#2774
- PrismJS/prism#2688
Severity: high
The
socket.io-parsernpm package before versions 3.3.2 and 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
Severity: moderate
Versions of
serialize-javascriptprior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.
Severity: moderate
Affected versions of
acornare vulnerable to Regular Expression Denial of Service. A regex in the form of/[x-\ud800]/ucauses the parser to enter an infinite loop. The string is not valid UTF16 which usually results in it being sanitized before reaching the parser. If an application processes untrusted input and passes it directly toacorn, attackers may leverage the vulnerability leading to Denial of Service.
Severity: moderate
Versions of
jqueryprior to 3.5.0 are vulnerable to Cross-Site Scripting. Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute arbitrary JavaScript in a victim's browser.
Severity: moderate
Affected versions of
socket.ioare vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
Severity: moderate
prismjsversions before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.
Severity: moderate
ellipticbefore version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation inelliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.
Severity: moderate
Impact
When
msgpack5decodes a map containing a key"__proto__", it assigns the decoded value to__proto__. As you are no doubt aware,Object.prototype.__proto__is an accessor property for the receiver's prototype. If the value corresponding to the key__proto__decodes to an object ornull,msgpack5sets the decoded object's prototype to that value.An attacker who can submit crafted MessagePack data to a service can use this to produce values that appear to be of other types; may have unexpected prototype properties and methods (for example
length, numeric properties, andpushet al if__proto__'s value decodes to anArray); and/or may throw unexpected exceptions when used (for example if the__proto__value decodes to aMaporDate). Other unexpected behavior might be produced for other types.There is no effect on the global prototype.
An example:
```js const msgpack5 = require('msgpack5')();
const payload = {}; Object.defineProperty(payload, 'proto', { value: new Map().set(1, 2), enumerable: true });
const encoded = msgpack5.encode(payload); console.log(encoded); //
const decoded = msgpack5.decode(encoded);
// decoded's prototype has been overwritten console.log(Object.getPrototypeOf(decoded)); // Map(1) { 1 => 2 } console.log(decoded.get); // [Function: get]
// decoded appears to most common typechecks to be a Map console.log(decoded instanceof Map); // true console.log(decoded.toString()); // [object Map] console.log(Object.prototype.toString.call(decoded)); // [object Map] console.log(decoded.constructor.name); // Map console.log(Object.getPrototypeOf(decoded).constructor.name); // Map
// decoded is not, however, a Map console.log(Object.getPrototypeOf(decoded) === Map.prototype); // false
// using decoded as though it were a Map throws try { decoded.get(1); } catch (error) { console.log(error); // TypeError: Method Map.prototype.get called // on incompatible receiver #
// re-encoding the decoded value throws try { msgpack5.encode(decoded); } catch (error) { console.log(error); // TypeError: Method Map.prototype.entries // called on incompatible receiver #
This "prototype poisoning" is sort of a very limited inversion of a prototype pollution attack. Only the decoded value's prototype is affected, and it can only be set to
msgpack5values (though if the victim makes use of custom codecs, anything could be amsgpack5value). We have not found a way to escalate this to true prototype pollution (absent other bugs in the consumer's code).Workarounds
Always validate incoming data after parsing before doing any processing.
Severity: moderate
hosted-git-infobefore versions 2.8.9 and 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity
Severity: moderate
postcssfrom 7.0.0 and before version 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
Severity: moderate
codemirrorbefore 5.58.2 is vulnerable to a regular expression denial of service. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/.?/)
Severity: moderate
In
websocket-extensionsbefore version 0.1.4, there is a vulnerability which allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request containing a header of the following form:`Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...`That is, a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. The parser takes exponential time to reject this header as invalid, and this will block the processing of any other work on the same thread. Thus if you are running a single-threaded server, such a request can render your service completely unavailable.
Severity: moderate
The package
browserslistfrom 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Severity: moderate
In
wsbefore versions 5.2.3, 6.2.2 and 7.4.6 there is a ReDOS vulnerability.Impact
A specially crafted value of the
Sec-Websocket-Protocolheader can be used to significantly slow down a ws server.Proof of concept
```js for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) { const value = 'b' + ' '.repeat(length) + 'x'; const start = process.hrtime.bigint();
value.trim().split(/ , /);
const end = process.hrtime.bigint();
console.log('length = %d, time = %f ns', length, end - start); } ```
Patches
The vulnerability was fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff).
Workarounds
In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the
--max-http-header-size=sizeand/or themaxHeaderSizeoptions.Credits
The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.
Severity: moderate
glob-parentbefore 5.1.2 has a regular expression denial of service vulnerability. The enclosure regex used to check for strings ending in enclosure containing path separator.
Severity: moderate
Affected versions of
static-evalpass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.Proof of concept
var evaluate = require('static-eval'); var parse = require('esprima').parse; var src = '(function(){console.log(process.pid)})()'; var ast = parse(src).body[0].expression; var res = evaluate(ast, {}); // Will print the process id
Severity: moderate
ssri5.2.2-6.0.1 and 7.0.0-7.1.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
Severity: moderate
Versions of
static-evalprior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.Proof of concept
``` var evaluate = require('static-eval'); var parse = require('esprima').parse;
var src = process.argv[2]; var payload = '(function({x}){return x.constructor})({x:"".sub})("console.log(process.env)")()' var ast = parse(payload).body[0].expression; console.log(evaluate(ast, {x:1})); ```
Severity: moderate
Versions of
jqueryprior to 3.4.0 are vulnerable to Prototype Pollution. The extend() method allows an attacker to modify the prototype forObjectcausing changes in properties that will exist on all objects.
Severity: low
Affected versions of
minimistare vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype ofObject, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument--__proto__.y=Pollutedadds ayproperty with valuePollutedto all objects. The argument--__proto__=Pollutedraises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed tominimist.
Severity: low
Versions of
kind-of6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.
Severity: low
Affected versions of
yargs-parserare vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype ofObject, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument--foo.__proto__.bar baz'adds abarproperty with valuebazto all objects. This is only exploitable if attackers have control over the arguments being passed toyargs-parser.
Severity: low
Versions of
lodashprior to 4.17.19 are vulnerable to Prototype Pollution. The functionzipObjectDeepallows a malicious user to modify the prototype ofObjectif the property identifiers are user-supplied. Being affected by this issue requires zipping objects based on user-provided property arrays.This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.
Severity: low
Node Fetch did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure.
For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.
Severity: low
inibefore version 1.3.6 has a Prototype Pollution vulnerability.Impact
If an attacker submits a malicious INI file to an application that parses it with
ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.Patches
This has been patched in 1.3.6
Steps to reproduce
payload.ini
[__proto__] polluted = "polluted"poc.js: ``` var fs = require('fs') var ini = require('ini')
var parsed = ini.parse(fs.readFileSync('./payload.ini', 'utf-8')) console.log(parsed) console.log(parsed.proto) console.log(polluted) ```
```
node poc.js {} { polluted: 'polluted' } { polluted: 'polluted' } polluted
```
Severity: low
Impact
xmldomversions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents.This may lead to unexpected syntactic changes during XML processing in some downstream applications.
Workarounds
Downstream applications can validate the input and reject the maliciously crafted documents.