tap-11.1.5.tgz: 30 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com]

Vulnerable Library - tap-11.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Mend has checked all newer package trees, and you are on the least vulnerable package!

Please note: There might be a version that explicitly solves one or more of the vulnerabilities listed below, but we do not recommend it. For more info about the optional fixes, check the section “Details” below.

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (tap version)	Fix PR available
CVE-2021-23369	High	9.8	handlebars-4.0.11.tgz	Transitive	N/A*	❌
CVE-2019-19919	High	9.8	handlebars-4.0.11.tgz	Transitive	N/A*	❌
CVE-2019-10747	High	9.8	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2019-10746	High	9.8	mixin-deep-1.3.1.tgz	Transitive	N/A*	❌
CVE-2020-7774	High	9.8	y18n-3.2.1.tgz	Transitive	N/A*	❌
CVE-2021-44906	High	9.8	minimist-0.0.8.tgz	Transitive	N/A*	❌
CVE-2021-23383	High	9.8	handlebars-4.0.11.tgz	Transitive	N/A*	❌
CVE-2021-23440	High	9.8	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2019-10744	High	9.1	lodash-4.17.10.tgz	Transitive	N/A*	❌
CVE-2019-20920	High	8.1	handlebars-4.0.11.tgz	Transitive	N/A*	❌
CVE-2019-20922	High	7.5	handlebars-4.0.11.tgz	Transitive	N/A*	❌
CVE-2019-20149	High	7.5	kind-of-6.0.2.tgz	Transitive	N/A*	❌
CVE-2022-38900	High	7.5	decode-uri-component-0.2.0.tgz	Transitive	N/A*	❌
CVE-2021-3807	High	7.5	ansi-regex-3.0.0.tgz	Transitive	N/A*	❌
WS-2020-0450	High	7.5	handlebars-4.0.11.tgz	Transitive	N/A*	❌
CVE-2022-3517	High	7.5	minimatch-3.0.4.tgz	Transitive	N/A*	❌
CVE-2021-23343	High	7.5	path-parse-1.0.5.tgz	Transitive	N/A*	❌
CVE-2020-8203	High	7.4	lodash-4.17.10.tgz	Transitive	N/A*	❌
WS-2019-0064	High	7.3	handlebars-4.0.11.tgz	Transitive	N/A*	❌
CVE-2021-23337	High	7.2	lodash-4.17.10.tgz	Transitive	N/A*	❌
WS-2018-0590	High	7.1	diff-1.4.0.tgz	Transitive	N/A*	❌
CVE-2019-1010266	Medium	6.5	lodash-4.17.10.tgz	Transitive	N/A*	❌
CVE-2023-28155	Medium	6.5	request-2.88.2.tgz	Transitive	N/A*	❌
CVE-2020-7598	Medium	5.6	minimist-0.0.8.tgz	Transitive	N/A*	❌
CVE-2018-16487	Medium	5.6	lodash-4.17.10.tgz	Transitive	N/A*	❌
WS-2019-0103	Medium	5.6	handlebars-4.0.11.tgz	Transitive	N/A*	❌
CVE-2020-28500	Medium	5.3	lodash-4.17.10.tgz	Transitive	N/A*	❌
CVE-2020-7608	Medium	5.3	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2021-23362	Medium	5.3	hosted-git-info-2.6.0.tgz	Transitive	N/A*	❌
WS-2019-0307	Medium	5.1	mem-1.1.0.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

Partial details (26 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2021-23369

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-reports-1.4.0.tgz
      • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Publish Date: 2021-04-12

URL: CVE-2021-23369

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-04-12

Fix Resolution: com.github.jknack:handlebars:4.2.0, handlebars - 4.7.7

CVE-2019-19919

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-reports-1.4.0.tgz
      • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Publish Date: 2019-12-20

URL: CVE-2019-19919

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19919

Release Date: 2019-12-20

Fix Resolution: handlebars - 4.3.0

CVE-2019-10747

Vulnerable Libraries - set-value-2.0.0.tgz, set-value-0.4.3.tgz

set-value-2.0.0.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/set-value/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • micromatch-3.1.10.tgz
      • snapdragon-0.8.2.tgz
        • base-0.11.2.tgz
          • cache-base-1.0.1.tgz
            • ❌ set-value-2.0.0.tgz (Vulnerable Library)

set-value-0.4.3.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/union-value/node_modules/set-value/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • micromatch-3.1.10.tgz
      • snapdragon-0.8.2.tgz
        • base-0.11.2.tgz
          • cache-base-1.0.1.tgz
            • union-value-1.0.0.tgz
              • ❌ set-value-0.4.3.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Publish Date: 2019-08-23

URL: CVE-2019-10747

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-10-29

Fix Resolution: 2.0.1,3.0.1

CVE-2019-10746

Vulnerable Library - mixin-deep-1.3.1.tgz

Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone.

Library home page: https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/mixin-deep/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • micromatch-3.1.10.tgz
      • snapdragon-0.8.2.tgz
        • base-0.11.2.tgz
          • ❌ mixin-deep-1.3.1.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-08-23

URL: CVE-2019-10746

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-08-23

Fix Resolution: 1.3.2,2.0.1

CVE-2020-7774

Vulnerable Library - y18n-3.2.1.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-3.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/y18n/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • yargs-11.1.0.tgz
      • ❌ y18n-3.2.1.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1654

Release Date: 2020-11-17

Fix Resolution: 3.2.2, 4.0.1, 5.0.5

CVE-2021-44906

Vulnerable Library - minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/minimist/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • mkdirp-0.5.1.tgz
      • ❌ minimist-0.0.8.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-03-17

Fix Resolution: minimist - 1.2.6

CVE-2021-23383

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-reports-1.4.0.tgz
      • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Publish Date: 2021-05-04

URL: CVE-2021-23383

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23383

Release Date: 2021-05-04

Fix Resolution: handlebars - 4.7.7

CVE-2021-23440

Vulnerable Libraries - set-value-2.0.0.tgz, set-value-0.4.3.tgz

set-value-2.0.0.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/set-value/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • micromatch-3.1.10.tgz
      • snapdragon-0.8.2.tgz
        • base-0.11.2.tgz
          • cache-base-1.0.1.tgz
            • ❌ set-value-2.0.0.tgz (Vulnerable Library)

set-value-0.4.3.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/union-value/node_modules/set-value/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • micromatch-3.1.10.tgz
      • snapdragon-0.8.2.tgz
        • base-0.11.2.tgz
          • cache-base-1.0.1.tgz
            • union-value-1.0.0.tgz
              • ❌ set-value-0.4.3.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
Mend Note: After conducting further research, Mend has determined that all versions of set-value up to version 4.0.0 are vulnerable to CVE-2021-23440.

Publish Date: 2021-09-12

URL: CVE-2021-23440

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-12

Fix Resolution: set-value - 4.0.1

CVE-2019-10744

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-lib-instrument-1.10.1.tgz
      • babel-generator-6.26.1.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0

CVE-2019-20920

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-reports-1.4.0.tgz
      • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

Publish Date: 2020-09-30

URL: CVE-2019-20920

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1316

Release Date: 2020-10-15

Fix Resolution: handlebars - 4.5.3

CVE-2019-20922

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-reports-1.4.0.tgz
      • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.

Publish Date: 2020-09-30

URL: CVE-2019-20922

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1300

Release Date: 2020-09-30

Fix Resolution: handlebars - 4.4.5

CVE-2019-20149

Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/micromatch/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/base/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/extglob/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/test-exclude/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/snapdragon-node/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/define-property/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/use/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/nanomatch/node_modules/kind-of/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • micromatch-3.1.10.tgz
      • ❌ kind-of-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149

Release Date: 2019-12-30

Fix Resolution: 6.0.3

CVE-2022-38900

Vulnerable Library - decode-uri-component-0.2.0.tgz

A better decodeURIComponent

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/decode-uri-component/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • micromatch-3.1.10.tgz
      • snapdragon-0.8.2.tgz
        • source-map-resolve-0.5.1.tgz
          • ❌ decode-uri-component-0.2.0.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w573-4hg7-7wgq

Release Date: 2022-11-28

Fix Resolution: decode-uri-component - 0.2.1

CVE-2021-3807

Vulnerable Library - ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/yargs/node_modules/ansi-regex/package.json,/node_modules/nyc/node_modules/string-width/node_modules/ansi-regex/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • yargs-11.1.0.tgz
      • cliui-4.1.0.tgz
        • strip-ansi-4.0.0.tgz
          • ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution: ansi-regex - 5.0.1,6.0.1

WS-2020-0450

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-reports-1.4.0.tgz
      • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

Handlebars before 4.6.0 vulnerable to Prototype Pollution. Prototype access to the template engine allows for potential code execution, which may lead to Denial Of Service (DoS).

Publish Date: 2020-01-09

URL: WS-2020-0450

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-01-09

Fix Resolution: handlebars - 4.6.0

CVE-2022-3517

Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/minimatch/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • glob-7.1.2.tgz
      • ❌ minimatch-3.0.4.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5

CVE-2021-23343

Vulnerable Library - path-parse-1.0.5.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/path-parse/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-lib-report-1.1.3.tgz
      • ❌ path-parse-1.0.5.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution: path-parse - 1.0.7

CVE-2020-8203

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-lib-instrument-1.10.1.tgz
      • babel-generator-6.26.1.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution: lodash - 4.17.19

WS-2019-0064

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-reports-1.4.0.tgz
      • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.

Publish Date: 2019-01-30

URL: WS-2019-0064

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/755/

Release Date: 2019-01-30

Fix Resolution: 3.0.7,4.0.14,4.1.2

CVE-2021-23337

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-lib-instrument-1.10.1.tgz
      • babel-generator-6.26.1.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21, lodash-es - 4.17.21

WS-2018-0590

Vulnerable Library - diff-1.4.0.tgz

A javascript text diff implementation.

Library home page: https://registry.npmjs.org/diff/-/diff-1.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/diff/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • tap-mocha-reporter-3.0.9.tgz
    • ❌ diff-1.4.0.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Publish Date: 2018-03-05

URL: WS-2018-0590

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-03-05

Fix Resolution: 3.5.0

CVE-2019-1010266

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-lib-instrument-1.10.1.tgz
      • babel-generator-6.26.1.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-07-17

Fix Resolution: lodash-4.17.11

CVE-2023-28155

Vulnerable Library - request-2.88.2.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • coveralls-3.1.1.tgz
    • ❌ request-2.88.2.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

** UNSUPPORTED WHEN ASSIGNED ** The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Publish Date: 2023-03-16

URL: CVE-2023-28155

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2020-7598

Vulnerable Library - minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/minimist/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • mkdirp-0.5.1.tgz
      • ❌ minimist-0.0.8.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.3

CVE-2018-16487

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-lib-instrument-1.10.1.tgz
      • babel-generator-6.26.1.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/380873

Release Date: 2019-02-01

Fix Resolution: lodash 4.17.11

WS-2019-0103

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy:

• tap-11.1.5.tgz (Root Library)
  • nyc-11.9.0.tgz
    • istanbul-reports-1.4.0.tgz
      • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: a1054901076ba8d51b417c27b922cc129f9747dd

Found in base branch: main

Vulnerability Details

Handlebars.js before 4.1.0 has Remote Code Execution (RCE)

Publish Date: 2019-01-30

URL: WS-2019-0103

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-01-30

Fix Resolution: 4.1.0