Git Product home page Git Product logo

atom-script's Introduction

Script

Build Status

Run code in Atom!

⚠️ We need maintainers and developers to keep atom script from growing stagnant! Please see #1550 for background ⚠️

Run scripts based on file name, a selection of code, or by line number.

Currently supported grammars are:

Grammar File Based Selection Based Required Package Required in PATH Notes
Assembly (NASM) Yes Yes language-x86-64-assembly nasm, binutils
1C (BSL) Yes language-1c-bsl oscript
Ansible Yes language-ansible ansible-playbook
AutoHotKey Yes Yes language-autohotkey AutoHotKey.exe
AppleScript Yes Yes language-applescript osascript
Babel ES6 JS Yes Yes language-babel node
Bash Yes Yes Runs if your SHELL or #! line is bash.
Bats (Bash Automated Test System) Yes Yes language-bats bats
Windows Batch (cmd.exe) Yes language-batch/file
Behat Yes behat-atom behat
BuckleScript Yes Yes bs-platform bsc
C Yes Yes xcrun clang/cc Available only on macOS and Linux.
C# Yes Yes csc.exe
C# Script Yes Yes scriptcs
C++ Yes Yes xcrun clang++/g++ Available only on macOS and Linux. Run with -std=c++14.
Clojure Yes Yes lein exec Requires Leiningen with the lein-exec plugin.
CoffeeScript (Literate) Yes Yes coffee
Crystal Yes Yes language-crystal-actual crystal
Cucumber (Gherkin) Yes language-gherkin cucumber
D Yes Yes language-d rdmd
Dart Yes Yes dartlang dart
DOT (Graphviz) Yes Yes language-dot dot
Elixir Yes Yes language-elixir elixir
Erlang Yes language-erlang erl Limited selection based runs only (see #70).
F* Yes atom-fstar fstar
F# Yes language-fsharp fsharpi/fsi.exe
Fish Yes Yes language-fish-shell fish
Forth Yes language-forth gforth
Fortran Yes language-fortran gfortran
Gnuplot Yes language-gnuplot-atom gnuplot
Go Yes go
Groovy Yes Yes language-groovy groovy
Haskell (Literate) Yes Yes language-haskell runhaskell/ghc
HTML Yes Opens the current HTML file in your default browser.
Hy Yes Yes language-hy hy.exe
IcedCoffeeScript Yes Yes language-iced-coffee-script iced
Inno Setup Yes language-innosetup ISCC.exe
Idris Yes language-idris idris
io Yes Yes atom-language-io io
Java Yes *\jdk1.x.x_xx\bin Project directory should be the source directory; subfolders imply packaging.
Javascript Yes Yes node
JavaScript for Automation (JXA) Yes Yes language-javascript-jxa osascript -l JavaScript Available on macOS only.
Jolie Yes language-jolie jolie
Julia Yes Yes language-julia julia
Kotlin Yes Yes language-kotlin kotlinc
LAMMPS Yes language-lammps lammps Available only on macOS and Linux.
LaTeX Yes language-latex latexmk
LilyPond Yes atlilypond lilypond
Lisp Yes Yes language-lisp sbcl Selection based runs are limited to a single line.
LiveScript Yes Yes language-livescript lsc
Lua Yes Yes language-lua[-wow] lua
Makefile Yes Yes
MATLAB Yes Yes language-matlab matlab
MIPS Yes language-mips spim
MongoDB Yes Yes language-mongodb mongo
MoonScript Yes Yes language-moonscript moon
NCL Yes Yes language-ncl ncl Scripts must end with an exit command for file based runs.
newLISP Yes Yes language-newlisp newlisp
Nim[Script] Yes language-nim nim
NSIS Yes Yes language-nsis makensis
Objective-C[++] Yes xcrun clang[++] Available on macOS only.
OCaml Yes language-ocaml ocaml
Octave Yes Yes language-matlab octave
Oz Yes Yes language-oz ozc
Pandoc Markdown Yes language-pfm panzer
Pascal Yes Yes language-pascal fpc
Perl Yes Yes
Perl 6 Yes Yes perl6
PHP Yes Yes
PostgreSQL Yes Yes language-pgsql psql Connects as user PGUSER to database PGDATABASE. Both default to your operating system's USERNAME, but can be set in the process environment or in Atom's init file: process.env.PGUSER = {user name} and process.env.PGDATABASE = {database name}
POV-Ray Yes atom-language-povray povengine/povray
PowerShell Yes Yes language-powershell powershell
Processing Yes processing-language processing-java
Prolog Yes language-prolog swipl Scripts must contain a rule with the head main (e.g.main:- parent(X,lucas),writeln(X).). The script is executed with the goal main and exits after the first result is found. The output is produced by the writeln/1 predicates.
PureScript Yes language-purescript pulp
Python Yes Yes
R Yes Yes language-r Rscript
Racket Yes Yes language-racket racket
Reason Yes Yes language-reason rebuild
Ren'Py Yes No language-renpy renpy Runs your project at the root of the current file.
Robot Framework Yes No language-robot-framework robot The output location depends on the CWD behaviour which can be altered in settings.
RSpec Yes Yes language-rspec rspec
Ruby Yes Yes
Ruby on Rails Yes Yes
Rust Yes language-rust rustc
Sage Yes Yes language-sage sage
Sass/SCSS Yes sass
Scala Yes Yes language-scala scala
Scheme Yes Yes langauge-scheme guile
Shell Script Yes Yes SHELL Runs according to your default SHELL, or #! line.
Standard ML Yes language-sml sml
Stata Yes Yes language-stata stata
Swift Yes language-swift swift
Tcl Yes Yes language-tcltk tclsh
TypeScript Yes Yes ts-node
VBScript Yes Yes language-vbscript cscript
Zsh Yes Yes Runs if your SHELL or #! line is zsh.

NOTE: Some grammars may require you to install a custom language package.

You only have to add a few lines in a PR to support another.

Installation

apm install script

or

Search for script within package search in the Settings View.

Atom can't find node | ruby | python | my socks

Make sure to launch Atom from the console/terminal. This gives atom all your useful environment variables. Additionally, make sure to run it with the project path you need. For example, use

atom .

to get it to run with the current directory as the default place to run scripts from.

If you really wish to open atom from a launcher/icon, see this issue for a variety of workarounds that have been suggested.

Usage

Make sure to run atom from the command line to get full access to your environment variables. Running Atom from the icon will launch using launchctl's environment.

Script: Run will perform a "File Based" run when no text is selected (default).

Script: Run while text is selected will perform a "Selection Based" run executing just the highlighted code.

Script: Run by Line Number to run using the specified line number. Note that if you select an entire line this number could be off by one due to the way Atom detects numbers while text is selected.

Script: Configure Script should be used to configure command options, program arguments, and environment variables overrides. Environment variables may be input into the options view in the form VARIABLE_NAME_ONE=value;VARIABLE_NAME_TWO="other value";VARIABLE_NAME_3='test'.

Also, in this dialog you can save options as a profile for future use. For example, you can add two profiles, one for python2.7 and another for python3 and run scripts with a specified profile, which will be more convinient than entering options every time you want to switch python versions.

If you want to use Python3 by default, you can open Atom Settings, Atom→Preferences→Open Config Folder, and open.atom/packages/script/lib/grammars/python.coffee, Changing python to python3 under 'Selection Based' and 'File Based', saving it.

Script: Run with profile allows you to run scripts with saved profiles. Profiles can be added in Script: Run Options dialog.

Script: Kill Process will kill the process but leaves the pane open.

Script: Close View closes the pane and kills the process.

To kill everything, click the close icon in the upper right and just go back to coding.

Script: Copy Run Results copies everything written to the output pane to the clipboard, allowing you to paste it into the editor.

Command and shortcut reference

Command macOS Linux/Windows Notes
Script: Run cmd-i shift-ctrl-b If text is selected a "Selection Based" is used instead of a "File Based" run
Script: Run by Line Number shift-cmd-j shift-ctrl-j If text is selected the line number will be the last
Script: Run Options shift-cmd-i shift-ctrl-alt-o Runs the selection or whole file with the given options
Script: Run with profile shift-cmd-k shift-ctrl-alt-b Runs the selection or whole file with the specified profile
Script: Close View esc or ctrl-w esc Closes the script view window
Script: Kill Process ctrl-c ctrl-q Kills the current script process

Replacements

The following parameters will be replaced in any entry in args (command and program arguments). They should all be enclosed in curly brackets {}

  • {FILE_ACTIVE} - Full path to the currently active file in Atom. E.g. /home/rgbkrk/atom-script/lib/script.coffee
  • {FILE_ACTIVE_PATH} - Full path to the folder where the currently active file is. E.g. /home/rgbkrk/atom-script/lib
  • {FILE_ACTIVE_NAME} - Full name and extension of active file. E.g., script.coffee
  • {FILE_ACTIVE_NAME_BASE} - Name of active file WITHOUT extension. E.g., script
  • {PROJECT_PATH} - Full path to the root of the project. This is normally the path Atom has as root. E.g /home/rgbkrk/atom-script

Parameters are compatible with atom-build package.

Development

This is an Open Open Source Project, which means:

Individuals making significant and valuable contributions are given commit-access to the project to contribute as they see fit.

As for coding and contributing, rely on the atom contributing guidelines. They're pretty solid.

Quick and dirty setup

apm develop script

This will clone the script repository to ~/github unless you set the ATOM_REPOS_HOME environment variable.

I already cloned it!

If you cloned it somewhere else, you'll want to use apm link --dev within the package directory, followed by apm install to get dependencies.

Workflow

After pulling upstream changes, make sure to run apm update.

To start hacking, make sure to run atom --dev from the package directory. Cut a branch while you're working then either submit a Pull Request when done or when you want some feedback!

atom-script's People

Contributors

a-manning avatar adampohl avatar andyrichardson avatar avonmoll avatar calyhre avatar chosko avatar danielbayley avatar dependabot[bot] avatar entilzha avatar erip avatar erran avatar fscherwi avatar hansrodtang avatar iamolivinius avatar idleberg avatar jparet avatar lbatson avatar lgeiger avatar liamdawson avatar mattddowney avatar nixel2007 avatar oderwat avatar pardom avatar rgbkrk avatar smashwilson avatar snyk-bot avatar stormherz avatar teggy avatar thebrenny avatar xsstudio avatar

Stargazers

 avatar

Watchers

 avatar

atom-script's Issues

CVE-2021-37713 (High) detected in tar-4.4.8.tgz

CVE-2021-37713 - High Severity Vulnerability

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: 705fa8690303588211f0501137f92f116f272f1a

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain .. path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory. Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path. This only affects users of node-tar on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

Publish Date: 2021-08-31

URL: CVE-2021-37713

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5955-9wpr-37jh

Release Date: 2021-08-31

Fix Resolution: tar - 4.4.18,5.0.10,6.1.9


Step up your Open Source Security Game with Mend here

CVE-2020-8203 (High) detected in lodash-4.17.15.tgz - autoclosed

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: atom-script/package.json

Path to vulnerable library: atom-script/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: 705fa8690303588211f0501137f92f116f272f1a

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-23

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 8.8) Vulnerability due to usage of minimist:1.2.0

Vulnerabilities

DepShield reports that this application's usage of minimist:1.2.0 results in the following vulnerability(s):


Occurrences

minimist:1.2.0 is a transitive dependency introduced by the following direct dependency(s):

babel-cli:6.26.0
        └─ chokidar:1.7.0
              └─ fsevents:1.2.9
                    └─ node-pre-gyp:0.12.0
                          └─ rc:1.2.8
                                └─ minimist:1.2.0

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2021-37701 (High) detected in tar-4.4.8.tgz

CVE-2021-37701 - High Severity Vulnerability

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • tar-4.4.8.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Publish Date: 2021-08-31

URL: CVE-2021-37701

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9r2w-394v-53qc

Release Date: 2021-08-31

Fix Resolution: tar - 4.4.16,5.0.8,6.1.7


Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 7.5) Vulnerability due to usage of braces:1.8.5

Vulnerabilities

DepShield reports that this application's usage of braces:1.8.5 results in the following vulnerability(s):


Occurrences

braces:1.8.5 is a transitive dependency introduced by the following direct dependency(s):

babel-cli:6.26.0
        └─ chokidar:1.7.0
              └─ anymatch:1.3.2
                    └─ micromatch:2.3.11
                          └─ braces:1.8.5

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2021-32803 (High) detected in tar-4.4.8.tgz

CVE-2021-32803 - High Severity Vulnerability

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: 705fa8690303588211f0501137f92f116f272f1a

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

Publish Date: 2021-08-03

URL: CVE-2021-32803

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r628-mhmh-qjhw

Release Date: 2021-08-03

Fix Resolution: tar - 3.2.3, 4.4.15, 5.0.7, 6.1.2


Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 7.4) Vulnerability due to usage of ini:1.3.5

Vulnerabilities

DepShield reports that this application's usage of ini:1.3.5 results in the following vulnerability(s):


Occurrences

ini:1.3.5 is a transitive dependency introduced by the following direct dependency(s):

babel-cli:6.26.0
        └─ chokidar:1.7.0
              └─ fsevents:1.2.9
                    └─ node-pre-gyp:0.12.0
                          └─ rc:1.2.8
                                └─ ini:1.3.5

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2015-9251 (Medium) detected in jquery-2.1.4.tgz

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Library - jquery-2.1.4.tgz

JavaScript library for DOM operations

Library home page: https://registry.npmjs.org/jquery/-/jquery-2.1.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jquery/package.json

Dependency Hierarchy:

  • atom-space-pen-views-2.2.0.tgz (Root Library)
    • space-pen-5.1.2.tgz
      • jquery-2.1.4.tgz (Vulnerable Library)

Found in HEAD commit: 705fa8690303588211f0501137f92f116f272f1a

Found in base branch: master

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - 3.0.0


Step up your Open Source Security Game with Mend here

CVE-2021-44906 (High) detected in minimist-0.0.8.tgz, minimist-1.2.0.tgz - autoclosed

CVE-2021-44906 - High Severity Vulnerability

Vulnerable Libraries - minimist-0.0.8.tgz, minimist-1.2.0.tgz

minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • mkdirp-0.5.1.tgz
            • minimist-0.0.8.tgz (Vulnerable Library)
minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • rc-1.2.8.tgz
            • minimist-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: c4f9d120793513de8f80f58f67498e7ed83fae33

Found in base branch: master

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-03-17

Fix Resolution: minimist - 1.2.6


Step up your Open Source Security Game with Mend here

CVE-2024-27088 (Low) detected in es5-ext-0.10.52.tgz

CVE-2024-27088 - Low Severity Vulnerability

Vulnerable Library - es5-ext-0.10.52.tgz

ECMAScript extensions and shims

Library home page: https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.52.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/es5-ext/package.json

Dependency Hierarchy:

  • atom-space-pen-views-2.2.0.tgz (Root Library)
    • space-pen-5.1.2.tgz
      • grim-1.5.0.tgz
        • emissary-1.3.3.tgz
          • es6-weak-map-0.1.4.tgz
            • es5-ext-0.10.52.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into function#copy or function#toStringTokens may cause the script to stall. The vulnerability is patched in v0.10.63.

Publish Date: 2024-02-26

URL: CVE-2024-27088

CVSS 3 Score Details (0.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-27088

Release Date: 2024-02-26

Fix Resolution: es5-ext - 0.10.63


Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:3.2.2

Vulnerabilities

DepShield reports that this application's usage of kind-of:3.2.2 results in the following vulnerability(s):


Occurrences

kind-of:3.2.2 is a transitive dependency introduced by the following direct dependency(s):

babel-cli:6.26.0
        └─ chokidar:1.7.0
              └─ anymatch:1.3.2
                    └─ micromatch:2.3.11
                          └─ braces:1.8.5
                                └─ expand-range:1.8.2
                                      └─ fill-range:2.2.4
                                            └─ is-number:2.1.0
                                                  └─ kind-of:3.2.2
                          └─ kind-of:3.2.2
              └─ readdirp:2.2.1
                    └─ micromatch:3.1.10
                          └─ braces:2.3.2
                                └─ fill-range:4.0.0
                                      └─ is-number:3.0.0
                                            └─ kind-of:3.2.2
                                      └─ to-regex-range:2.1.1
                                            └─ is-number:3.0.0
                                                  └─ kind-of:3.2.2
                                └─ snapdragon-node:2.1.1
                                      └─ snapdragon-util:3.0.1
                                            └─ kind-of:3.2.2
                          └─ extglob:2.0.4
                                └─ expand-brackets:2.1.4
                                      └─ define-property:0.2.5
                                            └─ is-descriptor:0.1.6
                                                  └─ is-accessor-descriptor:0.1.6
                                                        └─ kind-of:3.2.2
                                                  └─ is-data-descriptor:0.1.4
                                                        └─ kind-of:3.2.2
                          └─ snapdragon:0.8.2
                                └─ base:0.11.2
                                      └─ cache-base:1.0.1
                                            └─ has-value:1.0.0
                                                  └─ has-values:1.0.0
                                                        └─ is-number:3.0.0
                                                              └─ kind-of:3.2.2
                                            └─ to-object-path:0.3.0
                                                  └─ kind-of:3.2.2
                                      └─ class-utils:0.3.6
                                            └─ static-extend:0.1.2
                                                  └─ object-copy:0.1.0
                                                        └─ kind-of:3.2.2
                                └─ define-property:0.2.5
                                      └─ is-descriptor:0.1.6
                                            └─ is-accessor-descriptor:0.1.6
                                                  └─ kind-of:3.2.2
                                            └─ is-data-descriptor:0.1.4
                                                  └─ kind-of:3.2.2

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2020-11023 (Medium) detected in jquery-2.1.4.tgz

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Library - jquery-2.1.4.tgz

JavaScript library for DOM operations

Library home page: https://registry.npmjs.org/jquery/-/jquery-2.1.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jquery/package.json

Dependency Hierarchy:

  • atom-space-pen-views-2.2.0.tgz (Root Library)
    • space-pen-5.1.2.tgz
      • jquery-2.1.4.tgz (Vulnerable Library)

Found in HEAD commit: 705fa8690303588211f0501137f92f116f272f1a

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0


Step up your Open Source Security Game with Mend here

CVE-2020-7788 (High) detected in ini-1.3.5.tgz

CVE-2020-7788 - High Severity Vulnerability

Vulnerable Library - ini-1.3.5.tgz

An ini encoder/decoder for node

Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • rc-1.2.8.tgz
            • ini-1.3.5.tgz (Vulnerable Library)

Found in HEAD commit: 34103a8e1d6b2c1bd8df82efb5f968255c161843

Found in base branch: master

Vulnerability Details

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Publish Date: 2020-12-11

URL: CVE-2020-7788

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788

Release Date: 2020-12-11

Fix Resolution: v1.3.6


Step up your Open Source Security Game with Mend here

CVE-2021-23440 (High) detected in set-value-2.0.1.tgz

CVE-2021-23440 - High Severity Vulnerability

Vulnerable Library - set-value-2.0.1.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/set-value/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • readdirp-2.2.1.tgz
        • micromatch-3.1.10.tgz
          • snapdragon-0.8.2.tgz
            • base-0.11.2.tgz
              • cache-base-1.0.1.tgz
                • set-value-2.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 34103a8e1d6b2c1bd8df82efb5f968255c161843

Found in base branch: master

Vulnerability Details

This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
Mend Note: After conducting further research, Mend has determined that all versions of set-value up to version 4.0.0 are vulnerable to CVE-2021-23440.

Publish Date: 2021-09-12

URL: CVE-2021-23440

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-12

Fix Resolution: set-value - 4.0.1


Step up your Open Source Security Game with Mend here

CVE-2021-37712 (High) detected in tar-4.4.8.tgz

CVE-2021-37712 - High Severity Vulnerability

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: 705fa8690303588211f0501137f92f116f272f1a

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.

Publish Date: 2021-08-31

URL: CVE-2021-37712

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qq89-hq3f-393p

Release Date: 2021-08-31

Fix Resolution: tar - 4.4.18,5.0.10,6.1.9


Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash:4.17.15

Vulnerabilities

DepShield reports that this application's usage of lodash:4.17.15 results in the following vulnerability(s):


Occurrences

lodash:4.17.15 is a transitive dependency introduced by the following direct dependency(s):

babel-cli:6.26.0
        └─ babel-core:6.26.3
              └─ babel-generator:6.26.1
                    └─ lodash:4.17.15
              └─ babel-template:6.26.0
                    └─ lodash:4.17.15
              └─ lodash:4.17.15
        └─ babel-register:6.26.0
              └─ lodash:4.17.15
        └─ lodash:4.17.15

babel-eslint:7.2.3
        └─ babel-traverse:6.26.0
              └─ lodash:4.17.15
        └─ babel-types:6.26.0
              └─ lodash:4.17.15

babel-preset-env:1.7.0
        └─ babel-plugin-transform-es2015-block-scoping:6.26.0
              └─ lodash:4.17.15
        └─ babel-plugin-transform-es2015-classes:6.24.1
              └─ babel-helper-define-map:6.26.0
                    └─ lodash:4.17.15
        └─ babel-plugin-transform-es2015-sticky-regex:6.24.1
              └─ babel-helper-regex:6.26.0
                    └─ lodash:4.17.15

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2019-11358 (Medium) detected in jquery-2.1.4.tgz

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Library - jquery-2.1.4.tgz

JavaScript library for DOM operations

Library home page: https://registry.npmjs.org/jquery/-/jquery-2.1.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jquery/package.json

Dependency Hierarchy:

  • atom-space-pen-views-2.2.0.tgz (Root Library)
    • space-pen-5.1.2.tgz
      • jquery-2.1.4.tgz (Vulnerable Library)

Found in HEAD commit: 705fa8690303588211f0501137f92f116f272f1a

Found in base branch: master

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: jquery - 3.4.0


Step up your Open Source Security Game with Mend here

CVE-2021-35065 (High) detected in glob-parent-2.0.0.tgz - autoclosed

CVE-2021-35065 - High Severity Vulnerability

Vulnerable Library - glob-parent-2.0.0.tgz

Strips glob magic from a string to provide the parent path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • glob-parent-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: c4f9d120793513de8f80f58f67498e7ed83fae33

Found in base branch: master

Vulnerability Details

The package glob-parent before 6.0.1 are vulnerable to Regular Expression Denial of Service (ReDoS)

Publish Date: 2021-06-22

URL: CVE-2021-35065

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cj88-88mr-972w

Release Date: 2021-06-22

Fix Resolution: glob-parent - 6.0.1


Step up your Open Source Security Game with Mend here

DepShield encountered errors while building your project

The project could not be analyzed because of build errors. Please review the error messages here. Another build will be scheduled when a change to a manifest file* occurs. If the build is successful this issue will be closed, otherwise the error message will be updated.

This is an automated GitHub Issue created by Sonatype DepShield. GitHub Apps, including DepShield, can be managed from the Developer settings of the repository administrators.

* Supported manifest files are: pom.xml, package.json, package-lock.json, npm-shrinkwrap.json, Cargo.lock, Cargo.toml, main.rs, lib.rs, build.gradle, build.gradle.kts, settings.gradle, settings.gradle.kts, gradle.properties, gradle-wrapper.properties, go.mod, go.sum

CVE-2020-28469 (High) detected in glob-parent-2.0.0.tgz

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Library - glob-parent-2.0.0.tgz

Strips glob magic from a string to provide the parent path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • glob-parent-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: c4f9d120793513de8f80f58f67498e7ed83fae33

Found in base branch: master

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution: glob-parent - 5.1.2


Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 8.8) Vulnerability due to usage of minimist:0.0.8

Vulnerabilities

DepShield reports that this application's usage of minimist:0.0.8 results in the following vulnerability(s):


Occurrences

minimist:0.0.8 is a transitive dependency introduced by the following direct dependency(s):

babel-cli:6.26.0
        └─ chokidar:1.7.0
              └─ fsevents:1.2.9
                    └─ node-pre-gyp:0.12.0
                          └─ mkdirp:0.5.1
                                └─ minimist:0.0.8

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2020-28500 (Medium) detected in lodash-4.17.20.tgz - autoclosed

CVE-2020-28500 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.17.20.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz

Path to dependency file: atom-script/package.json

Path to vulnerable library: atom-script/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • lodash-4.17.20.tgz (Vulnerable Library)

Found in HEAD commit: 34103a8e1d6b2c1bd8df82efb5f968255c161843

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@02906b8

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.6.9

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):


Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

babel-cli:6.26.0
        └─ babel-core:6.26.3
              └─ debug:2.6.9
        └─ chokidar:1.7.0
              └─ readdirp:2.2.1
                    └─ micromatch:3.1.10
                          └─ extglob:2.0.4
                                └─ expand-brackets:2.1.4
                                      └─ debug:2.6.9
                          └─ snapdragon:0.8.2
                                └─ debug:2.6.9

babel-eslint:7.2.3
        └─ babel-traverse:6.26.0
              └─ debug:2.6.9

eslint-plugin-import:2.22.1
        └─ debug:2.6.9
        └─ eslint-import-resolver-node:0.3.4
              └─ debug:2.6.9
        └─ eslint-module-utils:2.6.0
              └─ debug:2.6.9

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2021-32804 (High) detected in tar-4.4.8.tgz

CVE-2021-32804 - High Severity Vulnerability

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: 705fa8690303588211f0501137f92f116f272f1a

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Publish Date: 2021-08-03

URL: CVE-2021-32804

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3jfq-g458-7qm9

Release Date: 2021-08-03

Fix Resolution: tar - 3.2.2, 4.4.14, 5.0.6, 6.1.1


Step up your Open Source Security Game with Mend here

CVE-2021-32803 (High) detected in tar-4.4.8.tgz

CVE-2021-32803 - High Severity Vulnerability

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • tar-4.4.8.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

Publish Date: 2021-08-03

URL: CVE-2021-32803

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r628-mhmh-qjhw

Release Date: 2021-08-03

Fix Resolution: tar - 3.2.3, 4.4.15, 5.0.7, 6.1.2


Step up your Open Source Security Game with Mend here

CVE-2022-46175 (High) detected in json5-0.5.1.tgz

CVE-2022-46175 - High Severity Vulnerability

Vulnerable Library - json5-0.5.1.tgz

JSON for the ES5 era.

Library home page: https://registry.npmjs.org/json5/-/json5-0.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json5/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • babel-core-6.26.3.tgz
      • json5-0.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 34103a8e1d6b2c1bd8df82efb5f968255c161843

Found in base branch: master

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution: json5 - 2.2.2


Step up your Open Source Security Game with Mend here

CVE-2021-23358 (High) detected in underscore-1.12.0.tgz - autoclosed

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.12.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.12.0.tgz

Path to dependency file: atom-script/package.json

Path to vulnerable library: atom-script/node_modules/underscore/package.json

Dependency Hierarchy:

  • underscore-1.12.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:5.1.0

Vulnerabilities

DepShield reports that this application's usage of kind-of:5.1.0 results in the following vulnerability(s):


Occurrences

kind-of:5.1.0 is a transitive dependency introduced by the following direct dependency(s):

babel-cli:6.26.0
        └─ chokidar:1.7.0
              └─ readdirp:2.2.1
                    └─ micromatch:3.1.10
                          └─ extglob:2.0.4
                                └─ expand-brackets:2.1.4
                                      └─ define-property:0.2.5
                                            └─ is-descriptor:0.1.6
                                                  └─ kind-of:5.1.0
                          └─ snapdragon:0.8.2
                                └─ define-property:0.2.5
                                      └─ is-descriptor:0.1.6
                                            └─ kind-of:5.1.0

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2021-23337 (High) detected in lodash-4.17.20.tgz - autoclosed

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.20.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz

Path to dependency file: atom-script/package.json

Path to vulnerable library: atom-script/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • lodash-4.17.20.tgz (Vulnerable Library)

Found in HEAD commit: 34103a8e1d6b2c1bd8df82efb5f968255c161843

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.5) Vulnerability due to usage of kind-of:6.0.2

Vulnerabilities

DepShield reports that this application's usage of kind-of:6.0.2 results in the following vulnerability(s):


Occurrences

kind-of:6.0.2 is a transitive dependency introduced by the following direct dependency(s):

babel-cli:6.26.0
        └─ chokidar:1.7.0
              └─ anymatch:1.3.2
                    └─ micromatch:2.3.11
                          └─ braces:1.8.5
                                └─ expand-range:1.8.2
                                      └─ fill-range:2.2.4
                                            └─ randomatic:3.1.1
                                                  └─ kind-of:6.0.2
              └─ readdirp:2.2.1
                    └─ micromatch:3.1.10
                          └─ define-property:2.0.2
                                └─ is-descriptor:1.0.2
                                      └─ is-accessor-descriptor:1.0.0
                                            └─ kind-of:6.0.2
                                      └─ is-data-descriptor:1.0.0
                                            └─ kind-of:6.0.2
                                      └─ kind-of:6.0.2
                          └─ nanomatch:1.2.13
                                └─ kind-of:6.0.2
                          └─ braces:2.3.2
                                └─ snapdragon-node:2.1.1
                                      └─ define-property:1.0.0
                                            └─ is-descriptor:1.0.2
                                                  └─ is-accessor-descriptor:1.0.0
                                                        └─ kind-of:6.0.2
                                                  └─ is-data-descriptor:1.0.0
                                                        └─ kind-of:6.0.2
                                                  └─ kind-of:6.0.2
                          └─ extglob:2.0.4
                                └─ define-property:1.0.0
                                      └─ is-descriptor:1.0.2
                                            └─ is-accessor-descriptor:1.0.0
                                                  └─ kind-of:6.0.2
                                            └─ is-data-descriptor:1.0.0
                                                  └─ kind-of:6.0.2
                                            └─ kind-of:6.0.2
                          └─ kind-of:6.0.2
                          └─ snapdragon:0.8.2
                                └─ base:0.11.2
                                      └─ define-property:1.0.0
                                            └─ is-descriptor:1.0.2
                                                  └─ is-accessor-descriptor:1.0.0
                                                        └─ kind-of:6.0.2
                                                  └─ is-data-descriptor:1.0.0
                                                        └─ kind-of:6.0.2
                                                  └─ kind-of:6.0.2

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

[DepShield] (CVSS 7.5) Vulnerability due to usage of d:0.1.1

Vulnerabilities

DepShield reports that this application's usage of d:0.1.1 results in the following vulnerability(s):


Occurrences

d:0.1.1 is a transitive dependency introduced by the following direct dependency(s):

atom-space-pen-views:2.2.0
        └─ space-pen:5.1.2
              └─ grim:1.5.0
                    └─ emissary:1.3.3
                          └─ es6-weak-map:0.1.4
                                └─ d:0.1.1
                                └─ es6-iterator:0.1.3
                                      └─ d:0.1.1
                                └─ es6-symbol:2.0.1
                                      └─ d:0.1.1

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2020-11022 (Medium) detected in jquery-2.1.4.tgz

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Library - jquery-2.1.4.tgz

JavaScript library for DOM operations

Library home page: https://registry.npmjs.org/jquery/-/jquery-2.1.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jquery/package.json

Dependency Hierarchy:

  • atom-space-pen-views-2.2.0.tgz (Root Library)
    • space-pen-5.1.2.tgz
      • jquery-2.1.4.tgz (Vulnerable Library)

Found in HEAD commit: 705fa8690303588211f0501137f92f116f272f1a

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0


Step up your Open Source Security Game with Mend here

CVE-2022-3517 (High) detected in minimatch-3.0.4.tgz - autoclosed

CVE-2022-3517 - High Severity Vulnerability

Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimatch/package.json

Dependency Hierarchy:

  • eslint-5.16.0.tgz (Root Library)
    • minimatch-3.0.4.tgz (Vulnerable Library)

Found in HEAD commit: 34103a8e1d6b2c1bd8df82efb5f968255c161843

Found in base branch: master

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5


Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 7.2) Vulnerability due to usage of jquery:2.1.4

Vulnerabilities

DepShield reports that this application's usage of jquery:2.1.4 results in the following vulnerability(s):


Occurrences

jquery:2.1.4 is a transitive dependency introduced by the following direct dependency(s):

atom-space-pen-views:2.2.0
        └─ space-pen:5.1.2
              └─ jquery:2.1.4

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2021-23343 (High) detected in path-parse-1.0.6.tgz - autoclosed

CVE-2021-23343 - High Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: atom-script/package.json

Path to vulnerable library: atom-script/node_modules/path-parse/package.json

Dependency Hierarchy:

  • eslint-plugin-import-2.22.1.tgz (Root Library)
    • resolve-1.18.1.tgz
      • path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: c4f9d120793513de8f80f58f67498e7ed83fae33

Found in base branch: master

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jbgutierrez/path-parse#8

Release Date: 2021-05-04

Fix Resolution: path-parse - 1.0.7


Step up your Open Source Security Game with WhiteSource here

CVE-2022-38900 (High) detected in decode-uri-component-0.2.0.tgz

CVE-2022-38900 - High Severity Vulnerability

Vulnerable Library - decode-uri-component-0.2.0.tgz

A better decodeURIComponent

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decode-uri-component/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • readdirp-2.2.1.tgz
        • micromatch-3.1.10.tgz
          • snapdragon-0.8.2.tgz
            • source-map-resolve-0.5.2.tgz
              • decode-uri-component-0.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 705fa8690303588211f0501137f92f116f272f1a

Found in base branch: master

Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w573-4hg7-7wgq

Release Date: 2022-11-28

Fix Resolution: decode-uri-component - 0.2.1


Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:4.0.0

Vulnerabilities

DepShield reports that this application's usage of kind-of:4.0.0 results in the following vulnerability(s):


Occurrences

kind-of:4.0.0 is a transitive dependency introduced by the following direct dependency(s):

babel-cli:6.26.0
        └─ chokidar:1.7.0
              └─ readdirp:2.2.1
                    └─ micromatch:3.1.10
                          └─ snapdragon:0.8.2
                                └─ base:0.11.2
                                      └─ cache-base:1.0.1
                                            └─ has-value:1.0.0
                                                  └─ has-values:1.0.0
                                                        └─ kind-of:4.0.0

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2021-32804 (High) detected in tar-4.4.8.tgz

CVE-2021-32804 - High Severity Vulnerability

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • tar-4.4.8.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Publish Date: 2021-08-03

URL: CVE-2021-32804

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3jfq-g458-7qm9

Release Date: 2021-08-03

Fix Resolution: tar - 3.2.2, 4.4.14, 5.0.6, 6.1.1


Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.6.9

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):


Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

babel-cli:6.26.0
        └─ babel-core:6.26.3
              └─ debug:2.6.9
        └─ chokidar:1.7.0
              └─ readdirp:2.2.1
                    └─ micromatch:3.1.10
                          └─ extglob:2.0.4
                                └─ expand-brackets:2.1.4
                                      └─ debug:2.6.9
                          └─ snapdragon:0.8.2
                                └─ debug:2.6.9

babel-eslint:7.2.3
        └─ babel-traverse:6.26.0
              └─ debug:2.6.9

eslint-plugin-import:2.22.1
        └─ debug:2.6.9
        └─ eslint-import-resolver-node:0.3.4
              └─ debug:2.6.9
        └─ eslint-module-utils:2.6.0
              └─ debug:2.6.9

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

[DepShield] (CVSS 7.5) Vulnerability due to usage of hosted-git-info:2.8.8

Vulnerabilities

DepShield reports that this application's usage of hosted-git-info:2.8.8 results in the following vulnerability(s):


Occurrences

hosted-git-info:2.8.8 is a transitive dependency introduced by the following direct dependency(s):

eslint-plugin-import:2.22.1
        └─ read-pkg-up:2.0.0
              └─ read-pkg:2.0.0
                    └─ normalize-package-data:2.5.0
                          └─ hosted-git-info:2.8.8

This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.

CVE-2020-28275 (High) detected in cache-base-1.0.1.tgz - autoclosed

CVE-2020-28275 - High Severity Vulnerability

Vulnerable Library - cache-base-1.0.1.tgz

Basic object cache with `get`, `set`, `del`, and `has` methods for node.js/javascript projects.

Library home page: https://registry.npmjs.org/cache-base/-/cache-base-1.0.1.tgz

Path to dependency file: atom-script/package.json

Path to vulnerable library: atom-script/node_modules/cache-base/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • readdirp-2.2.1.tgz
        • micromatch-3.1.10.tgz
          • snapdragon-0.8.2.tgz
            • base-0.11.2.tgz
              • cache-base-1.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 705fa8690303588211f0501137f92f116f272f1a

Found in base branch: master

Vulnerability Details

Prototype pollution vulnerability in 'cache-base' versions 0.7.0 through 4.0.0 allows attacker to cause a denial of service and may lead to remote code execution.

Publish Date: 2020-11-07

URL: CVE-2020-28275

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23362 (Medium) detected in hosted-git-info-2.8.8.tgz - autoclosed

CVE-2021-23362 - Medium Severity Vulnerability

Vulnerable Library - hosted-git-info-2.8.8.tgz

Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab

Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.8.tgz

Path to dependency file: atom-script/package.json

Path to vulnerable library: atom-script/node_modules/hosted-git-info/package.json

Dependency Hierarchy:

  • eslint-plugin-import-2.22.1.tgz (Root Library)
    • read-pkg-up-2.0.0.tgz
      • read-pkg-2.0.0.tgz
        • normalize-package-data-2.5.0.tgz
          • hosted-git-info-2.8.8.tgz (Vulnerable Library)

Found in HEAD commit: c4f9d120793513de8f80f58f67498e7ed83fae33

Found in base branch: master

Vulnerability Details

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Publish Date: 2021-03-23

URL: CVE-2021-23362

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-43f8-2h32-f4cj

Release Date: 2021-03-23

Fix Resolution: hosted-git-info - 2.8.9,3.0.8


Step up your Open Source Security Game with WhiteSource here

CVE-2020-28469 (High) detected in glob-parent-2.0.0.tgz

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Library - glob-parent-2.0.0.tgz

Strips glob magic from a string to provide the parent path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • glob-parent-2.0.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution: glob-parent - 5.1.2


Step up your Open Source Security Game with Mend here

MSC-2023-16609 (Critical) detected in fsevents-1.2.9.tgz

MSC-2023-16609 - Critical Severity Vulnerability

Vulnerable Library - fsevents-1.2.9.tgz

Native Access to Mac OS-X FSEvents

Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.2.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running (user's machine or backend server). The following risks were identified: Malware dropper – this package contains a Trojan horse, allowing the unauthorized installation of other potentially malicious software.

Publish Date: 2023-09-20

URL: MSC-2023-16609

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with Mend here

CVE-2019-11358 (Medium) detected in jquery-2.1.4.tgz

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Library - jquery-2.1.4.tgz

JavaScript library for DOM operations

Library home page: https://registry.npmjs.org/jquery/-/jquery-2.1.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jquery/package.json

Dependency Hierarchy:

  • atom-space-pen-views-2.2.0.tgz (Root Library)
    • space-pen-5.1.2.tgz
      • jquery-2.1.4.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: jquery - 3.4.0


Step up your Open Source Security Game with Mend here

CVE-2019-20149 (High) detected in kind-of-6.0.2.tgz

CVE-2019-20149 - High Severity Vulnerability

Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/randomatic/node_modules/kind-of/package.json,/node_modules/snapdragon-node/node_modules/kind-of/package.json,/node_modules/nanomatch/node_modules/kind-of/package.json,/node_modules/define-property/node_modules/kind-of/package.json,/node_modules/readdirp/node_modules/kind-of/package.json,/node_modules/base/node_modules/kind-of/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • readdirp-2.2.1.tgz
        • micromatch-3.1.10.tgz
          • kind-of-6.0.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149

Release Date: 2019-12-30

Fix Resolution: 6.0.3


Step up your Open Source Security Game with Mend here

CVE-2020-7598 (Medium) detected in minimist-0.0.8.tgz, minimist-1.2.0.tgz - autoclosed

CVE-2020-7598 - Medium Severity Vulnerability

Vulnerable Libraries - minimist-0.0.8.tgz, minimist-1.2.0.tgz

minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • mkdirp-0.5.1.tgz
            • minimist-0.0.8.tgz (Vulnerable Library)
minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • rc-1.2.8.tgz
            • minimist-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 34103a8e1d6b2c1bd8df82efb5f968255c161843

Found in base branch: master

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.3


Step up your Open Source Security Game with Mend here

CVE-2019-20149 (High) detected in kind-of-6.0.2.tgz

CVE-2019-20149 - High Severity Vulnerability

Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/randomatic/node_modules/kind-of/package.json,/node_modules/snapdragon-node/node_modules/kind-of/package.json,/node_modules/nanomatch/node_modules/kind-of/package.json,/node_modules/define-property/node_modules/kind-of/package.json,/node_modules/readdirp/node_modules/kind-of/package.json,/node_modules/base/node_modules/kind-of/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • readdirp-2.2.1.tgz
        • micromatch-3.1.10.tgz
          • kind-of-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 705fa8690303588211f0501137f92f116f272f1a

Found in base branch: master

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149

Release Date: 2019-12-30

Fix Resolution: 6.0.3


Step up your Open Source Security Game with Mend here

CVE-2021-37701 (High) detected in tar-4.4.8.tgz

CVE-2021-37701 - High Severity Vulnerability

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.2.9.tgz
        • node-pre-gyp-0.12.0.tgz
          • tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: 705fa8690303588211f0501137f92f116f272f1a

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Publish Date: 2021-08-31

URL: CVE-2021-37701

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9r2w-394v-53qc

Release Date: 2021-08-31

Fix Resolution: tar - 4.4.16,5.0.8,6.1.7


Step up your Open Source Security Game with Mend here

WS-2021-0154 (Medium) detected in glob-parent-2.0.0.tgz - autoclosed

WS-2021-0154 - Medium Severity Vulnerability

Vulnerable Library - glob-parent-2.0.0.tgz

Strips glob magic from a string to provide the parent path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz

Path to dependency file: atom-script/package.json

Path to vulnerable library: atom-script/node_modules/glob-parent/package.json

Dependency Hierarchy:

  • babel-cli-6.26.0.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • glob-parent-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: c4f9d120793513de8f80f58f67498e7ed83fae33

Found in base branch: master

Vulnerability Details

Regular Expression Denial of Service (ReDoS) vulnerability was found in glob-parent before 5.1.2.

Publish Date: 2021-01-27

URL: WS-2021-0154

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2

Release Date: 2021-01-27

Fix Resolution: glob-parent - 5.1.2


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.