View Code? Open in Web Editor
NEW
This project forked from gotwarlost /istanbul
Yet another JS code coverage tool that computes statement, line, function and branch coverage with module loader hooks to transparently add coverage when running tests. Supports all JS coverage use cases including unit tests, server side functional tests and browser tests. Built for scale.
License: Other
Shell 0.15%
JavaScript 97.90%
CSS 0.97%
HTML 0.98%
istanbul's Issues
CVE-2020-7608 - Medium Severity Vulnerability
Vulnerable Library - yargs-parser-2.4.1.tgz
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-2.4.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/yargs-parser/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
❌ yargs-parser-2.4.1.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto " payload.
Publish Date: 2020-03-16
URL: CVE-2020-7608
CVSS 3 Score Details (5.3 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: Low
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Release Date: 2020-03-16
Fix Resolution (yargs-parser): 5.0.0-security.0
Direct dependency fix Resolution (nodeunit): 0.11.0
Step up your Open Source Security Game with Mend here
CVE-2021-23383 - High Severity Vulnerability
Vulnerable Library - handlebars-4.0.5.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-reports-1.0.0-alpha.8.tgz
❌ handlebars-4.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
Publish Date: 2021-05-04
URL: CVE-2021-23383
CVSS 3 Score Details (9.8 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23383
Release Date: 2021-05-04
Fix Resolution (handlebars): 4.1.2-0
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
CVE-2021-23337 - High Severity Vulnerability
Vulnerable Library - lodash-4.13.1.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.13.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-lib-instrument-1.1.0-alpha.4.tgz
babel-types-6.11.1.tgz
❌ lodash-4.13.1.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Publish Date: 2021-02-15
URL: CVE-2021-23337
CVSS 3 Score Details (7.2 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: High
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
WS-2019-0032 - High Severity Vulnerability
Vulnerable Library - js-yaml-3.6.1.tgz
YAML 1.2 parser and serializer
Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.6.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/coveralls/node_modules/js-yaml/package.json
Dependency Hierarchy:
coveralls-2.13.3.tgz (Root Library)
❌ js-yaml-3.6.1.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.
Publish Date: 2019-03-20
URL: WS-2019-0032
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/788/versions
Release Date: 2019-03-20
Fix Resolution (js-yaml): 3.13.0
Direct dependency fix Resolution (coveralls): 3.0.0
Step up your Open Source Security Game with Mend here
CVE-2020-28500 - Medium Severity Vulnerability
Vulnerable Library - lodash-4.13.1.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.13.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-lib-instrument-1.1.0-alpha.4.tgz
babel-types-6.11.1.tgz
❌ lodash-4.13.1.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.
Publish Date: 2021-02-15
URL: CVE-2020-28500
CVSS 3 Score Details (5.3 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: Low
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
CVE-2019-20922 - High Severity Vulnerability
Vulnerable Library - handlebars-4.0.5.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-reports-1.0.0-alpha.8.tgz
❌ handlebars-4.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.
Publish Date: 2020-09-30
URL: CVE-2019-20922
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1300
Release Date: 2020-09-30
Fix Resolution (handlebars): 4.4.5
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
WS-2019-0318 - High Severity Vulnerability
Vulnerable Library - handlebars-4.0.5.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz
Path to dependency file: istanbul/package.json
Path to vulnerable library: istanbul/node_modules/nyc/node_modules/handlebars/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-reports-1.0.0-alpha.8.tgz
❌ handlebars-4.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
In "showdownjs/showdown", versions prior to v4.4.5 are vulnerable against Regular expression Denial of Service (ReDOS) once receiving specially-crafted templates.
Publish Date: 2019-10-20
URL: WS-2019-0318
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1300
Release Date: 2019-12-01
Fix Resolution: handlebars - 4.4.5
Step up your Open Source Security Game with WhiteSource here
Vulnerabilities
DepShield reports that this application's usage of js-yaml:3.6.1 results in the following vulnerability(s):
Occurrences
js-yaml:3.6.1 is a transitive dependency introduced by the following direct dependency(s):
• coveralls:2.13.3
└─ js-yaml:3.6.1
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community .
WS-2018-0590 - High Severity Vulnerability
Vulnerable Library - diff-1.4.0.tgz
A javascript text diff implementation.
Library home page: https://registry.npmjs.org/diff/-/diff-1.4.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/diff/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
tap-mocha-reporter-2.0.1.tgz
❌ diff-1.4.0.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Publish Date: 2018-03-05
URL: WS-2018-0590
CVSS 3 Score Details (7.1 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: Low
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Release Date: 2018-03-05
Fix Resolution: 3.5.0
Step up your Open Source Security Game with Mend here
CVE-2017-18077 - High Severity Vulnerability
Vulnerable Library - brace-expansion-1.1.6.tgz
Brace expansion as known from sh/bash
Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.6.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/brace-expansion/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
glob-7.0.5.tgz
minimatch-3.0.2.tgz
❌ brace-expansion-1.1.6.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.
Publish Date: 2018-01-27
URL: CVE-2017-18077
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-18077
Release Date: 2018-01-27
Fix Resolution (brace-expansion): 1.1.7
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
CVE-2018-16487 - Medium Severity Vulnerability
Vulnerable Library - lodash-4.13.1.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.13.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-lib-instrument-1.1.0-alpha.4.tgz
babel-types-6.11.1.tgz
❌ lodash-4.13.1.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
Publish Date: 2019-02-01
URL: CVE-2018-16487
CVSS 3 Score Details (5.6 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: Low
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487
Release Date: 2019-02-01
Fix Resolution (lodash): 4.17.11
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
CVE-2019-20920 - High Severity Vulnerability
Vulnerable Library - handlebars-4.0.5.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-reports-1.0.0-alpha.8.tgz
❌ handlebars-4.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
Publish Date: 2020-09-30
URL: CVE-2019-20920
CVSS 3 Score Details (8.1 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Changed
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: Low
Availability Impact: Low
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1324
Release Date: 2020-10-15
Fix Resolution (handlebars): 4.5.3
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
WS-2018-0076 - Medium Severity Vulnerability
Vulnerable Library - tunnel-agent-0.4.3.tgz
HTTP proxy tunneling agent. Formerly part of mikeal/request, now a standalone module.
Library home page: https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.4.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/tunnel-agent/package.json
Dependency Hierarchy:
coveralls-2.13.3.tgz (Root Library)
request-2.79.0.tgz
❌ tunnel-agent-0.4.3.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure. This is exploitable if user supplied input is provided to the auth value and is a number.
Publish Date: 2017-03-05
URL: WS-2018-0076
CVSS 3 Score Details (5.1 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Local
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: None
Availability Impact: None
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/598
Release Date: 2017-03-05
Fix Resolution (tunnel-agent): 0.6.0
Direct dependency fix Resolution (coveralls): 3.0.0
Step up your Open Source Security Game with Mend here
CVE-2020-7774 - High Severity Vulnerability
Vulnerable Library - y18n-3.2.1.tgz
the bare-bones internationalization library used by yargs
Library home page: https://registry.npmjs.org/y18n/-/y18n-3.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/y18n/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
yargs-4.8.1.tgz
❌ y18n-3.2.1.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('proto '); y18n.updateLocale({polluted: true}); console.log(polluted); // true
Publish Date: 2020-11-17
URL: CVE-2020-7774
CVSS 3 Score Details (9.8 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1654
Release Date: 2020-11-17
Fix Resolution (y18n): 3.2.2
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
WS-2017-0247 - Low Severity Vulnerability
Vulnerable Library - ms-0.7.1.tgz
Tiny ms conversion utility
Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz
Path to dependency file: istanbul/package.json
Path to vulnerable library: istanbul/node_modules/nyc/node_modules/ms/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-lib-instrument-1.1.0-alpha.4.tgz
babel-traverse-6.11.4.tgz
debug-2.2.0.tgz
❌ ms-0.7.1.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS).
Publish Date: 2017-04-12
URL: WS-2017-0247
CVSS 2 Score Details (3.4 )
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: vercel/ms#89
Release Date: 2017-04-12
Fix Resolution: 2.1.1
Step up your Open Source Security Game with WhiteSource here
WS-2019-0332 - Medium Severity Vulnerability
Vulnerable Library - handlebars-4.0.5.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz
Path to dependency file: istanbul/package.json
Path to vulnerable library: istanbul/node_modules/nyc/node_modules/handlebars/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-reports-1.0.0-alpha.8.tgz
❌ handlebars-4.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Arbitrary Code Execution vulnerability found in handlebars before 4.5.3. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.It is due to an incomplete fix for a WS-2019-0331.
Publish Date: 2019-11-17
URL: WS-2019-0332
CVSS 2 Score Details (5.0 )
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1324
Release Date: 2019-12-05
Fix Resolution: handlebars - 4.5.3
Step up your Open Source Security Game with WhiteSource here
CVE-2017-16137 - Medium Severity Vulnerability
Vulnerable Library - debug-2.2.0.tgz
small debugging utility
Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/debug/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-lib-instrument-1.1.0-alpha.4.tgz
babel-traverse-6.11.4.tgz
❌ debug-2.2.0.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
Publish Date: 2018-06-07
URL: CVE-2017-16137
CVSS 3 Score Details (5.3 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: Low
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16137
Release Date: 2018-06-07
Fix Resolution (debug): 2.6.9
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
CVE-2021-23362 - Medium Severity Vulnerability
Vulnerable Library - hosted-git-info-2.1.5.tgz
Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab
Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.1.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/hosted-git-info/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
yargs-4.8.1.tgz
read-pkg-up-1.0.1.tgz
read-pkg-1.1.0.tgz
normalize-package-data-2.3.5.tgz
❌ hosted-git-info-2.1.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
Publish Date: 2021-03-23
URL: CVE-2021-23362
CVSS 3 Score Details (5.3 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: Low
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: GHSA-43f8-2h32-f4cj
Release Date: 2021-03-23
Fix Resolution (hosted-git-info): 2.8.9
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
WS-2019-0333 - High Severity Vulnerability
Vulnerable Library - handlebars-4.0.5.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz
Path to dependency file: istanbul/package.json
Path to vulnerable library: istanbul/node_modules/nyc/node_modules/handlebars/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-reports-1.0.0-alpha.8.tgz
❌ handlebars-4.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
In handlebars, versions prior to v4.5.3 are vulnerable to prototype pollution. Using a malicious template it's possbile to add or modify properties to the Object prototype. This can also lead to DOS and RCE in certain conditions.
Publish Date: 2019-11-18
URL: WS-2019-0333
CVSS 3 Score Details (8.1 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1325
Release Date: 2019-12-05
Fix Resolution: handlebars - 4.5.3
Step up your Open Source Security Game with WhiteSource here
CVE-2020-7598 - Medium Severity Vulnerability
Vulnerable Libraries - minimist-0.0.8.tgz , minimist-1.2.0.tgz
minimist-0.0.8.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/minimist/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
mkdirp-0.5.1.tgz
❌ minimist-0.0.8.tgz (Vulnerable Library)
minimist-1.2.0.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/coveralls/node_modules/minimist/package.json,/node_modules/nyc/node_modules/detect-indent/node_modules/minimist/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-lib-instrument-1.1.0-alpha.4.tgz
babel-generator-6.11.4.tgz
detect-indent-3.0.1.tgz
❌ minimist-1.2.0.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto " payload.
Publish Date: 2020-03-11
URL: CVE-2020-7598
CVSS 3 Score Details (5.6 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: Low
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Release Date: 2020-03-11
Fix Resolution (minimist): 0.2.1
Direct dependency fix Resolution (nodeunit): 0.10.0
Fix Resolution (minimist): 1.2.3
Direct dependency fix Resolution (nodeunit): 0.11.3
Step up your Open Source Security Game with Mend here
Vulnerable Library - lodash-4.13.1.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.13.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-lib-instrument-1.1.0-alpha.4.tgz
babel-types-6.11.1.tgz
❌ lodash-4.13.1.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
Publish Date: 2019-07-17
URL: CVE-2019-1010266
CVSS 3 Score Details (6.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266
Release Date: 2020-09-30
Fix Resolution (lodash): 4.17.11
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - cryptiles-2.0.5.tgz
General purpose crypto utilities
Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-2.0.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/cryptiles/package.json
Dependency Hierarchy:
coveralls-2.13.3.tgz (Root Library)
request-2.79.0.tgz
hawk-3.1.3.tgz
❌ cryptiles-2.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.
Publish Date: 2018-07-09
URL: CVE-2018-1000620
CVSS 3 Score Details (9.8 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000620
Release Date: 2018-07-09
Fix Resolution (cryptiles): 4.1.2
Direct dependency fix Resolution (coveralls): 3.0.0
Step up your Open Source Security Game with Mend here
CVE-2017-16032 - Medium Severity Vulnerability
Vulnerable Library - brace-expansion-1.1.6.tgz
Brace expansion as known from sh/bash
Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.6.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/brace-expansion/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
glob-7.0.5.tgz
minimatch-3.0.2.tgz
❌ brace-expansion-1.1.6.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
brace-expansion before 1.1.7 are vulnerable to a regular expression denial of service.
Publish Date: 2020-07-21
URL: CVE-2017-16032
CVSS 3 Score Details (5.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Local
Attack Complexity: High
Privileges Required: Low
User Interaction: Required
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/338
Release Date: 2020-07-21
Fix Resolution (brace-expansion): 1.1.7
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
CVE-2019-19919 - High Severity Vulnerability
Vulnerable Library - handlebars-4.0.5.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-reports-1.0.0-alpha.8.tgz
❌ handlebars-4.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Publish Date: 2019-12-20
URL: CVE-2019-19919
CVSS 3 Score Details (9.8 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19919
Release Date: 2019-12-20
Fix Resolution (handlebars): 4.3.0
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
CVE-2019-10744 - High Severity Vulnerability
Vulnerable Library - lodash-4.13.1.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.13.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-lib-instrument-1.1.0-alpha.4.tgz
babel-types-6.11.1.tgz
❌ lodash-4.13.1.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-07-26
URL: CVE-2019-10744
CVSS 3 Score Details (9.1 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: High
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: GHSA-jf85-cpcp-j695
Release Date: 2019-07-26
Fix Resolution (lodash): 4.17.12
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
WS-2019-0331 - Medium Severity Vulnerability
Vulnerable Library - handlebars-4.0.5.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz
Path to dependency file: istanbul/package.json
Path to vulnerable library: istanbul/node_modules/nyc/node_modules/handlebars/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-reports-1.0.0-alpha.8.tgz
❌ handlebars-4.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Arbitrary Code Execution vulnerability found in handlebars before 4.5.2. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.
Publish Date: 2019-11-13
URL: WS-2019-0331
CVSS 2 Score Details (5.0 )
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1316
Release Date: 2019-12-05
Fix Resolution: handlebars - 4.5.2
Step up your Open Source Security Game with WhiteSource here
WS-2019-0103 - Medium Severity Vulnerability
Vulnerable Library - handlebars-4.0.5.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-reports-1.0.0-alpha.8.tgz
❌ handlebars-4.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Handlebars.js before 4.1.0 has Remote Code Execution (RCE)
Publish Date: 2019-01-30
URL: WS-2019-0103
CVSS 3 Score Details (5.6 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: Low
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Release Date: 2019-01-30
Fix Resolution (handlebars): 4.0.13
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
CVE-2020-8203 - High Severity Vulnerability
Vulnerable Library - lodash-4.13.1.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.13.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-lib-instrument-1.1.0-alpha.4.tgz
babel-types-6.11.1.tgz
❌ lodash-4.13.1.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Publish Date: 2020-07-15
URL: CVE-2020-8203
CVSS 3 Score Details (7.4 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: High
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1523
Release Date: 2020-07-15
Fix Resolution (lodash): 4.17.9
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
CVE-2020-28469 - High Severity Vulnerability
Vulnerable Library - glob-parent-2.0.0.tgz
Strips glob magic from a string to provide the parent path
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/glob-parent/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
micromatch-2.3.11.tgz
parse-glob-3.0.4.tgz
glob-base-0.3.0.tgz
❌ glob-parent-2.0.0.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Publish Date: 2021-06-03
URL: CVE-2020-28469
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
Release Date: 2021-06-03
Fix Resolution (glob-parent): 5.1.2
Direct dependency fix Resolution (nodeunit): 0.11.3
Step up your Open Source Security Game with Mend here
CVE-2021-23369 - High Severity Vulnerability
Vulnerable Library - handlebars-4.0.5.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-reports-1.0.0-alpha.8.tgz
❌ handlebars-4.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
Publish Date: 2021-04-12
URL: CVE-2021-23369
CVSS 3 Score Details (9.8 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23369
Release Date: 2021-04-12
Fix Resolution (handlebars): 4.1.2-0
Direct dependency fix Resolution (nodeunit): 0.10.0
Step up your Open Source Security Game with Mend here
WS-2019-0493 - High Severity Vulnerability
Vulnerable Library - handlebars-4.0.5.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz
Path to dependency file: istanbul/package.json
Path to vulnerable library: istanbul/node_modules/nyc/node_modules/handlebars/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-reports-1.0.0-alpha.8.tgz
❌ handlebars-4.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
handlebars before 3.0.8 and 4.x before 4.5.2 is vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system.
Publish Date: 2019-11-14
URL: WS-2019-0493
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1316
Release Date: 2019-11-14
Fix Resolution: handlebars - 3.0.8,4.5.2
Step up your Open Source Security Game with WhiteSource here
WS-2019-0492 - High Severity Vulnerability
Vulnerable Library - handlebars-4.0.5.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz
Path to dependency file: istanbul/package.json
Path to vulnerable library: istanbul/node_modules/nyc/node_modules/handlebars/package.json
Dependency Hierarchy:
nodeunit-0.9.5.tgz (Root Library)
tap-7.1.2.tgz
nyc-7.1.0.tgz
istanbul-reports-1.0.0-alpha.8.tgz
❌ handlebars-4.0.5.tgz (Vulnerable Library)
Found in HEAD commit: 1bc76b2a4f1c68652ba76458f4f973a52dbbfe9e
Found in base branch: master
Vulnerability Details
handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system.
Publish Date: 2019-11-19
URL: WS-2019-0492
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1324
Release Date: 2019-11-19
Fix Resolution: handlebars - 3.0.8,4.5.3
Step up your Open Source Security Game with WhiteSource here