lint-staged-7.2.2.tgz: 5 vulnerabilities (highest severity is: 9.8)

[mend-local-app]

Vulnerable Library - lint-staged-7.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/set-value/package.json

Found in HEAD commit: df030affe6fe3de4496f2f71d0bed6559686b108

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (lint-staged version)	Remediation Possible**	Reachability
CVE-2021-23440	High	9.8	detected in multiple dependencies	Transitive	7.3.0	✅
CVE-2019-10747	High	9.8	detected in multiple dependencies	Transitive	7.3.0	✅
CVE-2019-10746	High	9.8	mixin-deep-1.3.1.tgz	Transitive	7.3.0	✅
CVE-2019-20149	High	7.5	kind-of-6.0.2.tgz	Transitive	7.3.0	✅
CVE-2022-38900	High	7.5	decode-uri-component-0.2.0.tgz	Transitive	7.3.0	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-23440

Vulnerable Libraries - set-value-0.4.3.tgz, set-value-2.0.0.tgz

set-value-0.4.3.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/union-value/node_modules/set-value/package.json

Dependency Hierarchy:

• lint-staged-7.2.2.tgz (Root Library)
  • micromatch-3.1.10.tgz
    • snapdragon-0.8.2.tgz
      • base-0.11.2.tgz
        • cache-base-1.0.1.tgz
          • union-value-1.0.0.tgz
            • ❌ set-value-0.4.3.tgz (Vulnerable Library)

set-value-2.0.0.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/set-value/package.json

Dependency Hierarchy:

• lint-staged-7.2.2.tgz (Root Library)
  • micromatch-3.1.10.tgz
    • snapdragon-0.8.2.tgz
      • base-0.11.2.tgz
        • cache-base-1.0.1.tgz
          • ❌ set-value-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: df030affe6fe3de4496f2f71d0bed6559686b108

Found in base branch: master

Vulnerability Details

Mend Note: After conducting further research, Mend has determined that all versions of set-value before versions 2.0.1, 4.0.1 are vulnerable to CVE-2021-23440.

Publish Date: 2021-09-12

URL: CVE-2021-23440

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/

Release Date: 2021-09-12

Fix Resolution (set-value): 2.0.1

Direct dependency fix Resolution (lint-staged): 7.3.0

Fix Resolution (set-value): 2.0.1

Direct dependency fix Resolution (lint-staged): 7.3.0

In order to enable automatic remediation, please create workflow rules

CVE-2019-10747

Vulnerable Libraries - set-value-0.4.3.tgz, set-value-2.0.0.tgz

set-value-0.4.3.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/union-value/node_modules/set-value/package.json

Dependency Hierarchy:

• lint-staged-7.2.2.tgz (Root Library)
  • micromatch-3.1.10.tgz
    • snapdragon-0.8.2.tgz
      • base-0.11.2.tgz
        • cache-base-1.0.1.tgz
          • union-value-1.0.0.tgz
            • ❌ set-value-0.4.3.tgz (Vulnerable Library)

set-value-2.0.0.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/set-value/package.json

Dependency Hierarchy:

• lint-staged-7.2.2.tgz (Root Library)
  • micromatch-3.1.10.tgz
    • snapdragon-0.8.2.tgz
      • base-0.11.2.tgz
        • cache-base-1.0.1.tgz
          • ❌ set-value-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: df030affe6fe3de4496f2f71d0bed6559686b108

Found in base branch: master

Vulnerability Details

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Publish Date: 2019-08-23

URL: CVE-2019-10747

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-08-23

Fix Resolution (set-value): 2.0.1

Direct dependency fix Resolution (lint-staged): 7.3.0

Fix Resolution (set-value): 2.0.1

Direct dependency fix Resolution (lint-staged): 7.3.0

In order to enable automatic remediation, please create workflow rules

CVE-2019-10746

Vulnerable Library - mixin-deep-1.3.1.tgz

Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone.

Library home page: https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mixin-deep/package.json

Dependency Hierarchy:

• lint-staged-7.2.2.tgz (Root Library)
  • micromatch-3.1.10.tgz
    • snapdragon-0.8.2.tgz
      • base-0.11.2.tgz
        • ❌ mixin-deep-1.3.1.tgz (Vulnerable Library)

Found in HEAD commit: df030affe6fe3de4496f2f71d0bed6559686b108

Found in base branch: master

Vulnerability Details

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-08-23

URL: CVE-2019-10746

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-08-23

Fix Resolution (mixin-deep): 1.3.2

Direct dependency fix Resolution (lint-staged): 7.3.0

In order to enable automatic remediation, please create workflow rules

CVE-2019-20149

Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/define-property/node_modules/kind-of/package.json,/node_modules/lint-staged/node_modules/kind-of/package.json,/node_modules/clone-deep/node_modules/kind-of/package.json,/node_modules/nanomatch/node_modules/kind-of/package.json,/node_modules/randomatic/node_modules/kind-of/package.json,/node_modules/watchpack/node_modules/kind-of/package.json,/node_modules/webpack/node_modules/kind-of/package.json,/node_modules/base/node_modules/kind-of/package.json,/node_modules/snapdragon-node/node_modules/kind-of/package.json

Dependency Hierarchy:

• lint-staged-7.2.2.tgz (Root Library)
  • micromatch-3.1.10.tgz
    • ❌ kind-of-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: df030affe6fe3de4496f2f71d0bed6559686b108

Found in base branch: master

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149

Release Date: 2019-12-30

Fix Resolution (kind-of): 6.0.3

Direct dependency fix Resolution (lint-staged): 7.3.0

In order to enable automatic remediation, please create workflow rules

CVE-2022-38900

Vulnerable Library - decode-uri-component-0.2.0.tgz

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decode-uri-component/package.json

Dependency Hierarchy:

• lint-staged-7.2.2.tgz (Root Library)
  • micromatch-3.1.10.tgz
    • snapdragon-0.8.2.tgz
      • source-map-resolve-0.5.2.tgz
        • ❌ decode-uri-component-0.2.0.tgz (Vulnerable Library)

Found in HEAD commit: df030affe6fe3de4496f2f71d0bed6559686b108

Found in base branch: master

Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w573-4hg7-7wgq

Release Date: 2022-11-28

Fix Resolution (decode-uri-component): 0.2.1

Direct dependency fix Resolution (lint-staged): 7.3.0

In order to enable automatic remediation, please create workflow rules

---

In order to enable automatic remediation for this issue, please create workflow rules