### Summary
A prototype pollution in derby can crash the application, if the application author has atypical HTML templates that feed user input into an object key.

Attribute keys are almost always developer-controlled, not end-user-controlled, so this shouldn't be an issue in practice for most applications.

### Details
```
emit(context: Context, target: T) {
  const node = traverseAndCreate(context.controller, this.segments);
    node[this.lastSegment] = target;
    this.addListeners(target, node, this.lastSegment);
}
```
The emit() function in src/templates/templates.ts is called without sanitizing the variable `this.lastSegment `. The variable `this.lastSegment ` can be set to `__proto__`, and this will pollute the prototype of Javascipt Object (`node['__proto__'] = target`).

### PoC
To reproduce this vulnerability, you can adjust the test case `ignores DOM mutations in components\' create()` in `test/dom/ComponentHarness.mocha.js`.

```
it('ignores DOM mutations in components\' create()', function() {
      function Box() {}
      Box.view = {
        is: 'box',
-        source: '<index:><div class="box" as="boxElement"></div>'
+        source: '<index:><div class="box" as="__proto__"></div>'
      };
      Box.prototype.create = function() {
        this.boxElement.className = 'box-changed-in-create';
      };
      var harness = runner.createHarness('<view is="box" />', Box);
      expect(harness).to.render('<div class="box"></div>');
});
```
When `as` attribute is controlled by attackers, the variable in `this.lastSegment` will exactly take value` __proto__` and prototype pollution happens.

### Patch
Add a check on `this.lastSegment` can prevent this attack.
```
emit(context: Context, target: T) {
  const node = traverseAndCreate(context.controller, this.segments);
+  if (this.lastSegment.includes('__proto__') || this.lastSegment.includes('prototype')) {
+    throw new Error('Unsafe code detected');
+  }
    node[this.lastSegment] = target;
    this.addListeners(target, node, this.lastSegment);
}
```


Affected versions of `windows-latestchromedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-latestchromedriver`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

### Impact
A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the `codesample` plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the `codesample` plugin using TinyMCE 5.5.1 or lower.

### Patches
This vulnerability has been patched in TinyMCE 5.6.0 by upgrading to a version of the dependency without the vulnerability.

### Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.6.0 or higher
- Disable the `codesample` plugin
- Disable ruby code samples using the [codesample_languages](https://www.tiny.cloud/docs/plugins/opensource/codesample/#exampleusingcodesample_languages) setting
- Override the PrismJS syntax highlighter to version 1.21.0 or higher using the [codesample_global_prismjs](https://www.tiny.cloud/docs/plugins/opensource/codesample/#codesample_global_prismjs) setting

### Acknowledgements
Tiny Technologies would like to thank Erik Krogh Kristensen at GitHub for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](http://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)

All versions of `plotter` are vulnerable to Command Injection. The package fails to sanitize plot titles, which may allow attackers to execute arbitrary code in the system if the title value is supplied by a user. The following proof-of-concept creates a `testing` file in the current directory:

```
var plot = require('plotter').plot;

const title = 'Example "\nset title system("touch testing")#';

plot({
data: [ 3, 1, 2, 3, 4 ],
filename: 'output.pdf',
style: 'linespoints',
title: title,
logscale: true,
xlabel: 'time',
ylabel: 'length of string',
format: 'pdf'
});

```


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

 Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.

All versions of `deep-setter` are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Versions of `command-exists` before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module.


## Recommendation

Update to version 1.2.4 or later.

Affected versions of `sequelize` are vulnerable to SQL Injection in locations where user input is passed into the `limit` or `order` parameters of `sequelize` query calls, such as `findOne` or `findAll`.



## Recommendation

Update to version 3.17.0 or later.

Versions of `cloudcmd` before 9.1.6 are vulnerable to cross-site scripting (XSS) when listing files in a directory. The attacker must control the name of a file for this vulnerability to be exploitable.


## Recommendation

Update to version 9.1.6 or later.

Affected versions of `node-bsdiff-android` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

Version 2.0.10 of `json-serializer` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Versions of `base64url` before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.


## Recommendation

Update to version 3.0.0 or later.

**Withdrawn:** Duplicate of GHSA-9prh-257w-9277

Affected versions of `liuyaserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

All versions of `soletta-dev-app` are vulnerable to Command Injection. The package does not validate user input on the `/api/service/status` API endpoint, passing contents of the `service` query parameter to an exec call. This may allow attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected versions of `haxe` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `haxe`.


## Recommendation

Update to version 5.0.10 or later.

Affected versions of `haxe-dev` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `haxe-dev`.


## Recommendation

This package is actively maintained, yet after 2 years, the maintainer has not provided a patch for the vulnerability. This likely means that the maintainer has decided to accept the risk, and this vulnerability will never be patched.

Because of this, the best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

The npm package `rc` had versions published with malicious code. Users of affected versions (1.2.9, 1.3.9, and 2.3.9) should downgrade to 1.2.8 as soon as possible and check their systems for suspicious activity.
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

### Impact
Mirador users less than v3.0.0 (alpha-rc) versions that have an unpatched jQuery. When adopters update jQuery they will find some of Mirador functionality to be broken.

### Patches
Mirador adopters should update to v3.0.0, no updates exist for v2.x releases.

### Workarounds
Yes, Mirador users could fork and create their own custom build of Mirador and make the bug fixes themselves.

### References
https://github.com/advisories/GHSA-gxr4-xjj5-5px2
https://github.com/advisories/GHSA-jpcq-cgw6-v4j6


https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/

Versions of `@hapi/accept` prior to 3.2.4 or 5.0.1 are vulnerable to Denial of Service. The Accept-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 3.2.4 or 5.0.1.

Versions 0.3.2 and earlier of `marked` are affected by a cross-site scripting vulnerability even when `sanitize:true` is set. 

## Proof of Concept ( IE10 Compatibility Mode Only )

`[xss link](vbscript:alert(1&#41;)`

will get a link

`<a href="vbscript:alert(1)">xss link</a>`


## Recommendation

Update to version 0.3.3 or later.

Affected versions of `openframe-glslviewer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `openframe-glslviewer`.


## Recommendation

No patch is currently available for this vulnerability, and the package hasn't been updated since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

Affected versions of `prince` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `prince`.


## Recommendation

Update to version 1.4.6 or later.

Versions of  `bin-links` prior to 1.1.6 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This behavior is still allowed in local installations.


## Recommendation

Upgrade to version 1.1.6 or later.

Versions of `syntax-error` prior to 1.1.1 are affected by a cross-site scripting vulnerability which may allow a malicious file to execute code when browserified. 

## Recommendation

Update to version 1.1.1 or later.

All versions of `pomelo-monitor` are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Versions of `http-live-simulator` prior to 1.0.6 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to version 1.0.6

Kendo UI for Angular Editor Component (npm package @progress/kendo-angular-editor) before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts in element event handlers, they get executed.
Adding the following content to the Editor value demonstrates the issue: `<img src="" onerror=alert(document.domain)>`.

All version of `jquery-mobile` are vulnerable to Cross-Site Scripting. The package checks for content in `location.hash` and if a URL is found it does an XmlHttpRequest (XHR) to the URL and renders the response with `innerHTML`. It fails to validate the `Content-Type` of the response, allowing attackers to include malicious payloads as part of query parameters that are reflected back to the user. A response such as `{"q":"<iframe/src='javascript:alert(1)'></iframe>","results":[]}` would be parsed as HTML and the JavaScript payload executed.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

npm packages `loadyaml` and `electorn` were removed from the npm registry for containing malicious code. Upon installation the package runs a preinstall script that writes a public comment on GitHub containing the following information:
- IP and IP-based geolocation
- home directory name
- local username 

The malicious packages have been removed from the npm registry and the leaked content removed from GitHub.

Version 1.0.5 of `pyramid-proportion` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Users may consider a downgrade to version 1.0.4.

Versions of `grunt-gh-pages` prior to 0.10.0 are affected by a vulnerability which may cause unencrypted GitHub credentials to be written to a log file in certain circumstances.

In the `grunt-gh-pages` deployment scenario where authentication is performed by injecting a GitHub token directly into the auth portion of the URL, `grunt-gh-pages` will write the token to a log file, unencrypted.


## Recommendation

Update to version 0.10.0 or later.

All versions of `localeval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `constructor.constructor`. This may allow attackers to execute arbitrary code in the system.  Evaluating the payload 
```
constructor.constructor("return process.env")()
``` 

returns the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected versions of `mystem-wrapper` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mystem-wrapper`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

CVE ID↕	Published↕	CVSS↓
GHSA-82jv-9wjw-pqh6	Apr 17, 2024	N/A
GHSA-4ccc-jm2p-vg3p	Sep 1, 2020	N/A
GHSA-h96f-fc7c-9r55	Jan 6, 2021	N/A
GHSA-65xx-c85x-wg76	Sep 4, 2020	N/A
GHSA-cp47-r258-q626	Mar 2, 2023	N/A
GHSA-9qrg-h9g8-c65q	Sep 4, 2020	N/A
GHSA-cff4-rrq6-h78w	Jun 3, 2019	N/A
GHSA-98pq-pmw9-4gpm	Feb 18, 2019	N/A
GHSA-m8fw-534v-xm85	Jun 4, 2019	N/A
GHSA-c2vr-2c89-ph88	Sep 18, 2018	N/A
GHSA-chh2-rvhg-wqwr	Sep 3, 2020	N/A
GHSA-rvg8-pwq2-xj7q	Sep 1, 2020	N/A
GHSA-fmr4-7g9q-7hc7	Oct 24, 2017	N/A
GHSA-xj6q-9hx8-mm7f	Sep 1, 2020	N/A
GHSA-8mgg-5x65-m4m4	Sep 11, 2020	N/A
GHSA-g785-775g-f2g8	Feb 18, 2019	N/A
GHSA-cwp7-92h5-82wx	Feb 18, 2019	N/A
GHSA-g2q5-5433-rhrf	Nov 4, 2021	N/A
GHSA-hgwm-pv9h-q5m7	Sep 18, 2020	N/A
GHSA-9vrw-m88g-w75q	Sep 3, 2020	N/A
GHSA-cfjh-p3g4-3q2f	Oct 24, 2017	N/A
GHSA-g2pf-qjgf-6fw3	Feb 18, 2019	N/A
GHSA-cr79-9pwf-r6f5	Feb 18, 2019	N/A
GHSA-v45m-2wcp-gg98	Sep 4, 2020	N/A
GHSA-5726-g6r9-5f22	Oct 24, 2017	N/A
GHSA-m5ch-gx8g-rg73	Sep 2, 2020	N/A
GHSA-2hhw-p8mg-jrm6	Apr 8, 2019	N/A
GHSA-j7wp-vjj6-cp5m	Aug 11, 2020	N/A
GHSA-fj93-7wm4-8x2g	Sep 2, 2020	N/A
GHSA-38hx-3542-8fh3	Oct 1, 2020	N/A
GHSA-v6vv-hhqc-6hh2	Sep 3, 2020	N/A
GHSA-rrj3-qmh8-72pf	Feb 18, 2019	N/A
GHSA-mmqv-m45h-q2hp	Sep 4, 2020	N/A
GHSA-wg5r-c793-w5w2	Feb 18, 2019	N/A

Know every vulnerability
before it knows you.

npm CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

npm CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.