You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Path to vulnerable library: /script/node_modules/set-value/package.json
Dependency Hierarchy:
stylelint-9.3.0.tgz (Root Library)
globby-8.0.1.tgz
fast-glob-2.2.2.tgz
micromatch-3.1.10.tgz
snapdragon-0.8.2.tgz
base-0.11.2.tgz
cache-base-1.0.1.tgz
❌ set-value-2.0.0.tgz (Vulnerable Library)
Found in base branch: electron-upgrade
Vulnerability Details
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.
Path to vulnerable library: /script/node_modules/extend/package.json
Dependency Hierarchy:
stylelint-9.3.0.tgz (Root Library)
postcss-markdown-0.28.0.tgz
remark-9.0.0.tgz
unified-6.2.0.tgz
❌ extend-3.0.1.tgz (Vulnerable Library)
Found in base branch: electron-upgrade
Vulnerability Details
A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
Path to dependency file: /script/vsts/package.json
Path to vulnerable library: /script/vsts/node_modules/decode-uri-component/package.json,/script/node_modules/decode-uri-component/package.json,/apm/node_modules/npm/node_modules/decode-uri-component/package.json
Path to vulnerable library: /script/node_modules/dir-compare/node_modules/minimatch/package.json,/script/node_modules/rimraf/node_modules/minimatch/package.json,/script/node_modules/stylelint/node_modules/minimatch/package.json,/script/node_modules/tmp-promise/node_modules/minimatch/package.json,/script/node_modules/@wdio/config/node_modules/minimatch/package.json,/apm/node_modules/npm/node_modules/minimatch/package.json,/script/node_modules/eslint-plugin-import/node_modules/minimatch/package.json,/script/node_modules/asar/node_modules/minimatch/package.json,/script/node_modules/eslint/node_modules/minimatch/package.json,/script/node_modules/eslint-plugin-node/node_modules/minimatch/package.json
Dependency Hierarchy:
stylelint-9.3.0.tgz (Root Library)
globby-8.0.1.tgz
glob-7.1.2.tgz
❌ minimatch-3.0.4.tgz (Vulnerable Library)
Found in base branch: electron-upgrade
Vulnerability Details
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Path to vulnerable library: /script/node_modules/stylelint/node_modules/trim-newlines/package.json
Dependency Hierarchy:
stylelint-9.3.0.tgz (Root Library)
meow-5.0.0.tgz
❌ trim-newlines-2.0.0.tgz (Vulnerable Library)
Found in base branch: electron-upgrade
Vulnerability Details
The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Path to vulnerable library: /script/node_modules/postcss-sass/node_modules/postcss/package.json
Dependency Hierarchy:
stylelint-9.3.0.tgz (Root Library)
postcss-sass-0.3.2.tgz
❌ postcss-6.0.22.tgz (Vulnerable Library)
Found in base branch: electron-upgrade
Vulnerability Details
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).
Path to vulnerable library: /script/node_modules/define-property/node_modules/kind-of/package.json,/script/node_modules/randomatic/node_modules/kind-of/package.json,/script/node_modules/base/node_modules/kind-of/package.json,/script/node_modules/nanomatch/node_modules/kind-of/package.json,/script/node_modules/fast-glob/node_modules/kind-of/package.json,/script/node_modules/snapdragon-node/node_modules/kind-of/package.json
Dependency Hierarchy:
stylelint-9.3.0.tgz (Root Library)
globby-8.0.1.tgz
fast-glob-2.2.2.tgz
micromatch-3.1.10.tgz
❌ kind-of-6.0.2.tgz (Vulnerable Library)
Found in base branch: electron-upgrade
Vulnerability Details
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Path to vulnerable library: /script/node_modules/dot-prop/package.json
Dependency Hierarchy:
stylelint-9.3.0.tgz (Root Library)
postcss-selector-parser-3.1.1.tgz
❌ dot-prop-4.2.0.tgz (Vulnerable Library)
Found in base branch: electron-upgrade
Vulnerability Details
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Path to vulnerable library: /script/node_modules/stylelint/node_modules/ajv/package.json
Dependency Hierarchy:
stylelint-9.3.0.tgz (Root Library)
table-4.0.3.tgz
❌ ajv-6.5.2.tgz (Vulnerable Library)
Found in base branch: electron-upgrade
Vulnerability Details
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
dev-mend-for-github-combot
changed the title
stylelint-9.3.0.tgz: 13 vulnerabilities (highest severity is: 9.8)
stylelint-9.3.0.tgz: 15 vulnerabilities (highest severity is: 9.8)
Dec 14, 2023
Vulnerable Library - stylelint-9.3.0.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/set-value/package.json
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2021-44906
Vulnerable Library - minimist-1.1.3.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.1.3.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/gonzales-pe/node_modules/minimist/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Publish Date: 2022-03-17
URL: CVE-2021-44906
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2022-03-17
Fix Resolution (minimist): 1.2.6
Direct dependency fix Resolution (stylelint): 9.4.0
In order to enable automatic remediation, please create workflow rules
CVE-2019-10747
Vulnerable Libraries - set-value-0.4.3.tgz, set-value-2.0.0.tgz
set-value-0.4.3.tgz
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/union-value/node_modules/set-value/package.json
Dependency Hierarchy:
set-value-2.0.0.tgz
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/set-value/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.
Publish Date: 2019-08-23
URL: CVE-2019-10747
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2019-08-23
Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (stylelint): 9.4.0
Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (stylelint): 9.4.0
In order to enable automatic remediation, please create workflow rules
CVE-2018-16492
Vulnerable Library - extend-3.0.1.tgz
Port of jQuery.extend for node.js and the browser
Library home page: https://registry.npmjs.org/extend/-/extend-3.0.1.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/extend/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
Publish Date: 2019-02-01
URL: CVE-2018-16492
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://hackerone.com/reports/381185
Release Date: 2019-02-01
Fix Resolution (extend): 3.0.2
Direct dependency fix Resolution (stylelint): 9.4.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-38900
Vulnerable Library - decode-uri-component-0.2.0.tgz
A better decodeURIComponent
Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz
Path to dependency file: /script/vsts/package.json
Path to vulnerable library: /script/vsts/node_modules/decode-uri-component/package.json,/script/node_modules/decode-uri-component/package.json,/apm/node_modules/npm/node_modules/decode-uri-component/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
Publish Date: 2022-11-28
URL: CVE-2022-38900
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-w573-4hg7-7wgq
Release Date: 2022-11-28
Fix Resolution (decode-uri-component): 0.2.1
Direct dependency fix Resolution (stylelint): 9.4.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-3517
Vulnerable Library - minimatch-3.0.4.tgz
a glob matcher in javascript
Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/dir-compare/node_modules/minimatch/package.json,/script/node_modules/rimraf/node_modules/minimatch/package.json,/script/node_modules/stylelint/node_modules/minimatch/package.json,/script/node_modules/tmp-promise/node_modules/minimatch/package.json,/script/node_modules/@wdio/config/node_modules/minimatch/package.json,/apm/node_modules/npm/node_modules/minimatch/package.json,/script/node_modules/eslint-plugin-import/node_modules/minimatch/package.json,/script/node_modules/asar/node_modules/minimatch/package.json,/script/node_modules/eslint/node_modules/minimatch/package.json,/script/node_modules/eslint-plugin-node/node_modules/minimatch/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Publish Date: 2022-10-17
URL: CVE-2022-3517
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2022-10-17
Fix Resolution: minimatch - 3.0.5
CVE-2021-3807
Vulnerable Library - ansi-regex-3.0.0.tgz
Regular expression for matching ANSI escape codes
Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3807
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/
Release Date: 2021-09-17
Fix Resolution (ansi-regex): 3.0.1
Direct dependency fix Resolution (stylelint): 9.4.0
CVE-2021-33623
Vulnerable Library - trim-newlines-2.0.0.tgz
Trim newlines from the start and/or end of a string
Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-2.0.0.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/stylelint/node_modules/trim-newlines/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Publish Date: 2021-05-28
URL: CVE-2021-33623
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623
Release Date: 2021-05-28
Fix Resolution (trim-newlines): 3.0.1
Direct dependency fix Resolution (stylelint): 13.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-23382
Vulnerable Libraries - postcss-6.0.23.tgz, postcss-5.2.18.tgz, postcss-6.0.22.tgz
postcss-6.0.23.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/postcss/package.json
Dependency Hierarchy:
postcss-5.2.18.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-5.2.18.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/postcss-less/node_modules/postcss/package.json
Dependency Hierarchy:
postcss-6.0.22.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.22.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/postcss-sass/node_modules/postcss/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).
Publish Date: 2021-04-26
URL: CVE-2021-23382
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382
Release Date: 2021-04-26
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (stylelint): 9.7.0
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (stylelint): 9.7.0
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (stylelint): 9.7.0
In order to enable automatic remediation, please create workflow rules
CVE-2020-7753
Vulnerable Library - trim-0.0.1.tgz
Trim string whitespace
Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/trim/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
Publish Date: 2020-10-27
URL: CVE-2020-7753
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2020-10-27
Fix Resolution (trim): 0.0.3
Direct dependency fix Resolution (stylelint): 13.3.1
In order to enable automatic remediation, please create workflow rules
CVE-2019-20149
Vulnerable Library - kind-of-6.0.2.tgz
Get the native type of a value.
Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/define-property/node_modules/kind-of/package.json,/script/node_modules/randomatic/node_modules/kind-of/package.json,/script/node_modules/base/node_modules/kind-of/package.json,/script/node_modules/nanomatch/node_modules/kind-of/package.json,/script/node_modules/fast-glob/node_modules/kind-of/package.json,/script/node_modules/snapdragon-node/node_modules/kind-of/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Publish Date: 2019-12-30
URL: CVE-2019-20149
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149
Release Date: 2019-12-30
Fix Resolution (kind-of): 6.0.3
Direct dependency fix Resolution (stylelint): 9.4.0
In order to enable automatic remediation, please create workflow rules
CVE-2020-8116
Vulnerable Library - dot-prop-4.2.0.tgz
Get, set, or delete a property from a nested object using a dot path
Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/dot-prop/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Publish Date: 2020-02-04
URL: CVE-2020-8116
CVSS 3 Score Details (7.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116
Release Date: 2020-02-04
Fix Resolution (dot-prop): 4.2.1
Direct dependency fix Resolution (stylelint): 9.4.0
In order to enable automatic remediation, please create workflow rules
CVE-2020-7598
Vulnerable Library - minimist-1.1.3.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.1.3.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/gonzales-pe/node_modules/minimist/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.
Publish Date: 2020-03-11
URL: CVE-2020-7598
CVSS 3 Score Details (5.6)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2020-03-11
Fix Resolution (minimist): 1.2.3
Direct dependency fix Resolution (stylelint): 9.4.0
In order to enable automatic remediation, please create workflow rules
CVE-2020-15366
Vulnerable Library - ajv-6.5.2.tgz
Another JSON Schema Validator
Library home page: https://registry.npmjs.org/ajv/-/ajv-6.5.2.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/stylelint/node_modules/ajv/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Publish Date: 2020-07-15
URL: CVE-2020-15366
CVSS 3 Score Details (5.6)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2020-07-15
Fix Resolution (ajv): 6.12.3
Direct dependency fix Resolution (stylelint): 9.4.0
In order to enable automatic remediation, please create workflow rules
CVE-2020-7608
Vulnerable Library - yargs-parser-10.1.0.tgz
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-10.1.0.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/yargs-parser/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
Publish Date: 2020-03-16
URL: CVE-2020-7608
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2020-03-16
Fix Resolution (yargs-parser): 13.1.2
Direct dependency fix Resolution (stylelint): 13.0.0
In order to enable automatic remediation, please create workflow rules
WS-2021-0154
Vulnerable Library - glob-parent-3.1.0.tgz
Strips glob magic from a string to provide the parent directory path
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz
Path to dependency file: /script/package.json
Path to vulnerable library: /script/node_modules/fast-glob/node_modules/glob-parent/package.json
Dependency Hierarchy:
Found in base branch: electron-upgrade
Vulnerability Details
Regular Expression Denial of Service (ReDoS) vulnerability was found in glob-parent before 5.1.2.
Publish Date: 2021-01-27
URL: WS-2021-0154
CVSS 2 Score Details (0.0)
Base Score Metrics not available
In order to enable automatic remediation for this issue, please create workflow rules
The text was updated successfully, but these errors were encountered: