vulnerabilities in npm dependencies

ugh, npm.

There are 92 npm security advisories affecting our repositories.

#1089042: property-expr

Severity: critical

Prototype Pollution in property-expr
Affected repositories (1)

#1089152: flat

Severity: critical

flat vulnerable to Prototype Pollution
Affected repositories (3)

#1089270: ejs

Severity: critical

ejs template injection vulnerability
Affected repositories (6)

#1089656: immer

Severity: critical

Prototype Pollution in immer
Affected repositories (3)

#1090178: @xmldom/xmldom

Severity: critical

xmldom allows multiple root nodes in a DOM
Affected repositories (1)

#1090484: simple-git

Severity: critical

Remote code execution in simple-git
Affected repositories (1)

#1091172: minimist

Severity: critical

Prototype Pollution in minimist
Affected repositories (1)

#1091173: minimist

Severity: critical

Prototype Pollution in minimist
Affected repositories (7)

#1091186: loader-utils

Severity: critical

Prototype pollution in webpack loader-utils
Affected repositories (3)

#1091187: loader-utils

Severity: critical

Prototype pollution in webpack loader-utils
Affected repositories (1)

#1091364: socket.io-parser

Severity: critical

Insufficient validation when decoding a Socket.IO packet
Affected repositories (1)

#1091418: shell-quote

Severity: critical

Improper Neutralization of Special Elements used in a Command in Shell-quote
Affected repositories (3)

#1091470: underscore

Severity: critical

Arbitrary Code Execution in underscore
Affected repositories (1)

#1091472: json-schema

Severity: critical

json-schema is vulnerable to Prototype Pollution
Affected repositories (3)

#1085700: diff

Severity: high

Regular Expression Denial of Service (ReDoS)
Affected repositories (1)

#1087445: prismjs

Severity: high

Cross-Site Scripting in Prism
Affected repositories (2)

#1088667: async

Severity: high

Prototype Pollution in async
Affected repositories (4)

#1088696: ua-parser-js

Severity: high

ReDoS Vulnerability in ua-parser-js version
Affected repositories (11)

#1088697: ua-parser-js

Severity: high

ReDoS Vulnerability in ua-parser-js version
Affected repositories (6)

#1088761: simple-git

Severity: high

Command injection in simple-git
Affected repositories (1)

#1088964: jpeg-js

Severity: high

Infinite loop in jpeg-js
Affected repositories (2)

#1089281: immer

Severity: high

Prototype Pollution in immer
Affected repositories (3)

#1089386: taffydb

Severity: high

TaffyDB can allow access to any data items in the DB
Affected repositories (10)

#1089485: marked

Severity: high

Inefficient Regular Expression Complexity in marked
Affected repositories (1)

#1089486: marked

Severity: high

Inefficient Regular Expression Complexity in marked
Affected repositories (1)

#1089511: simple-git

Severity: high

Command injection in simple-git
Affected repositories (1)

#1089524: simple-git

Severity: high

simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol
Affected repositories (1)

#1089539: grunt

Severity: high

Race Condition in Grunt
Affected repositories (57)

#1089589: graphiql

Severity: high

GraphiQL introspection schema template injection attack
Affected repositories (1)

#1089649: semver-regex

Severity: high

Regular Expression Denial of Service (ReDOS)
Affected repositories (1)

#1089685: tar

Severity: high

Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
Affected repositories (1)

#1089716: prismjs

Severity: high

Regular Expression Denial of Service (ReDoS) in Prism
Affected repositories (2)

#1089867: trim

Severity: high

Regular Expression Denial of Service in trim
Affected repositories (2)

#1090014: prismjs

Severity: high

Denial of service in prismjs
Affected repositories (2)

#1090038: immer

Severity: high

Prototype Pollution in immer
Affected repositories (2)

#1090135: qs

Severity: high

qs vulnerable to Prototype Pollution
Affected repositories (6)

#1090137: qs

Severity: high

qs vulnerable to Prototype Pollution
Affected repositories (3)

#1090140: qs

Severity: high

qs vulnerable to Prototype Pollution
Affected repositories (2)

#1090424: prismjs

Severity: high

Cross-site Scripting in Prism
Affected repositories (4)

#1090445: simple-get

Severity: high

Exposure of Sensitive Information in simple-get
Affected repositories (1)

#1090532: http-cache-semantics

Severity: high

http-cache-semantics vulnerable to Regular Expression Denial of Service
Affected repositories (17)

#1091147: json5

Severity: high

Prototype Pollution in JSON5 via Parse Method
Affected repositories (7)

#1091148: json5

Severity: high

Prototype Pollution in JSON5 via Parse Method
Affected repositories (15)

#1091174: minimatch

Severity: high

minimatch ReDoS vulnerability
Affected repositories (75)

#1091181: glob-parent

Severity: high

glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex
Affected repositories (6)

#1091189: ansi-regex

Severity: high

Inefficient Regular Expression Complexity in chalk/ansi-regex
Affected repositories (2)

#1091190: ansi-regex

Severity: high

Inefficient Regular Expression Complexity in chalk/ansi-regex
Affected repositories (1)

#1091236: nth-check

Severity: high

Inefficient Regular Expression Complexity in nth-check
Affected repositories (1)

#1091238: follow-redirects

Severity: high

Exposure of sensitive information in follow-redirects
Affected repositories (1)

#1091239: node-fetch

Severity: high

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Affected repositories (3)

#1091247: loader-utils

Severity: high

loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable
Affected repositories (1)

#1091248: loader-utils

Severity: high

loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable
Affected repositories (3)

#1091250: loader-utils

Severity: high

loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)
Affected repositories (1)

#1091251: loader-utils

Severity: high

loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)
Affected repositories (3)

#1091314: tar

Severity: high

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
Affected repositories (1)

#1091343: tar

Severity: high

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
Affected repositories (1)

#1091346: tar

Severity: high

Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
Affected repositories (1)

#1091349: tar

Severity: high

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
Affected repositories (1)

#1091357: terser

Severity: high

Terser insecure use of regular expressions leads to ReDoS
Affected repositories (1)

#1091360: trim-newlines

Severity: high

Uncontrolled Resource Consumption in trim-newlines
Affected repositories (3)

#1091429: scss-tokenizer

Severity: high

Regular expression denial of service in scss-tokenizer
Affected repositories (1)

#1091453: shelljs

Severity: high

Improper Privilege Management in shelljs
Affected repositories (1)

#1086450: highlight.js

Severity: moderate

ReDOS vulnerabities: multiple grammars
Affected repositories (2)

#1087458: jpeg-js

Severity: moderate

Uncontrolled resource consumption in jpeg-js
Affected repositories (1)

#1088208: shelljs

Severity: moderate

Improper Privilege Management in shelljs
Affected repositories (1)

#1088241: validator

Severity: moderate

Inefficient Regular Expression Complexity in Validator.js
Affected repositories (1)

#1088659: cookiejar

Severity: moderate

cookiejar Regular Expression Denial of Service via Cookie.parse function
Affected repositories (4)

#1088709: cross-fetch

Severity: moderate

Incorrect Authorization in cross-fetch
Affected repositories (1)

#1088711: grunt

Severity: moderate

Path Traversal in Grunt
Affected repositories (3)

#1088948: got

Severity: moderate

Got allows a redirect to a UNIX socket
Affected repositories (15)

#1089011: nanoid

Severity: moderate

Exposure of Sensitive Information to an Unauthorized Actor in nanoid
Affected repositories (7)

#1089034: ajv

Severity: moderate

Prototype Pollution in Ajv
Affected repositories (4)

#1089062: react-dev-utils

Severity: moderate

react-dev-utils OS Command Injection in function `getProcessForPort`
Affected repositories (2)

#1089070: jquery

Severity: moderate

Potential XSS vulnerability in jQuery
Affected repositories (1)

#1089071: jquery

Severity: moderate

Potential XSS vulnerability in jQuery
Affected repositories (1)

#1089185: jsdom

Severity: moderate

Insufficient Granularity of Access Control in JSDom
Affected repositories (4)

#1089189: prismjs

Severity: moderate

prismjs Regular Expression Denial of Service vulnerability
Affected repositories (2)

#1089525: engine.io

Severity: moderate

Uncaught exception in engine.io
Affected repositories (1)

#1089551: postcss

Severity: moderate

Regular Expression Denial of Service in postcss
Affected repositories (1)

#1089554: node-sass

Severity: moderate

Improper Certificate Validation in node-sass
Affected repositories (1)

#1089600: validator

Severity: moderate

Inefficient Regular Expression Complexity in validator.js
Affected repositories (1)

#1089762: browserslist

Severity: moderate

Regular Expression Denial of Service in browserslist
Affected repositories (3)

#1090060: highlight.js

Severity: moderate

Prototype Pollution in highlight.js
Affected repositories (2)

#1090098: minimist

Severity: moderate

Prototype Pollution in minimist
Affected repositories (1)

#1090418: karma

Severity: moderate

Open redirect in karma
Affected repositories (1)

#1090431: follow-redirects

Severity: moderate

Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
Affected repositories (1)

#1090439: karma

Severity: moderate

Cross-site Scripting in karma
Affected repositories (1)

#1090461: markdown-it

Severity: moderate

Uncontrolled Resource Consumption in markdown-it
Affected repositories (2)

#1091459: request

Severity: moderate

Server-Side Request Forgery in Request
Affected repositories (34)

#1086487: node-fetch

Severity: low

The `size` option isn't honored after following a redirect in node-fetch
Affected repositories (1)

#1088828: decode-uri-component

Severity: low

decode-uri-component vulnerable to Denial of Service (DoS)
Affected repositories (7)

#1089093: semver-regex

Severity: low

Regular expression denial of service in semver-regex
Affected repositories (1)
Source code is licensed under the AGPL.