ts-node-dev-1.0.0-pre.32.tgz: 9 vulnerabilities (highest severity is: 7.5)

[mend-bolt-for-github]

Vulnerable Library - ts-node-dev-1.0.0-pre.32.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/ts-node-dev/node_modules/node-notifier/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (ts-node-dev version)	Remediation Possible**
WS-2019-0024	High	7.5	marked-0.5.2.tgz	Transitive	1.0.0	❌
CVE-2022-21681	High	7.5	marked-0.5.2.tgz	Transitive	1.0.0	❌
CVE-2022-21680	High	7.5	marked-0.5.2.tgz	Transitive	1.0.0	❌
CVE-2021-33623	High	7.5	trim-newlines-1.0.0.tgz	Transitive	1.1.7	❌
WS-2020-0163	Medium	5.9	marked-0.5.2.tgz	Transitive	1.0.0	❌
CVE-2020-7789	Medium	5.6	node-notifier-4.6.1.tgz	Transitive	1.0.0	❌
WS-2019-0209	Medium	5.5	marked-0.5.2.tgz	Transitive	1.0.0	❌
WS-2019-0169	Medium	5.3	marked-0.5.2.tgz	Transitive	1.0.0	❌
CVE-2021-23362	Medium	5.3	hosted-git-info-2.7.1.tgz	Transitive	1.0.0	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2019-0024

Vulnerable Library - marked-0.5.2.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.5.2.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/marked/package.json

Dependency Hierarchy:

• ts-node-dev-1.0.0-pre.32.tgz (Root Library)
  • node-notifier-4.6.1.tgz
    • cli-usage-0.1.8.tgz
      • ❌ marked-0.5.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A flaw was found in nodejs-marked versions from 0.5.0 to before 0.6.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). Input to the host variable is vulnerable when input contains parenthesis in link URIs, coupled with a high number of link tokens in a single line.

Publish Date: 2019-01-13

URL: WS-2019-0024

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1679550

Release Date: 2019-01-13

Fix Resolution (marked): 0.6.1

Direct dependency fix Resolution (ts-node-dev): 1.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-21681

Vulnerable Library - marked-0.5.2.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.5.2.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/marked/package.json

Dependency Hierarchy:

• ts-node-dev-1.0.0-pre.32.tgz (Root Library)
  • node-notifier-4.6.1.tgz
    • cli-usage-0.1.8.tgz
      • ❌ marked-0.5.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

Publish Date: 2022-01-14

URL: CVE-2022-21681

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5v2h-r2cx-5xgj

Release Date: 2022-01-14

Fix Resolution (marked): 4.0.10

Direct dependency fix Resolution (ts-node-dev): 1.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-21680

Vulnerable Library - marked-0.5.2.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.5.2.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/marked/package.json

Dependency Hierarchy:

• ts-node-dev-1.0.0-pre.32.tgz (Root Library)
  • node-notifier-4.6.1.tgz
    • cli-usage-0.1.8.tgz
      • ❌ marked-0.5.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression block.def may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

Publish Date: 2022-01-14

URL: CVE-2022-21680

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rrrm-qjm4-v8hf

Release Date: 2022-01-14

Fix Resolution (marked): 4.0.10

Direct dependency fix Resolution (ts-node-dev): 1.0.0

Step up your Open Source Security Game with Mend here

CVE-2021-33623

Vulnerable Library - trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/trim-newlines/package.json

Dependency Hierarchy:

• ts-node-dev-1.0.0-pre.32.tgz (Root Library)
  • dateformat-1.0.12.tgz
    • meow-3.7.0.tgz
      • ❌ trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution (trim-newlines): 3.0.1

Direct dependency fix Resolution (ts-node-dev): 1.1.7

Step up your Open Source Security Game with Mend here

WS-2020-0163

Vulnerable Library - marked-0.5.2.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.5.2.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/marked/package.json

Dependency Hierarchy:

• ts-node-dev-1.0.0-pre.32.tgz (Root Library)
  • node-notifier-4.6.1.tgz
    • cli-usage-0.1.8.tgz
      • ❌ marked-0.5.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

marked before 1.1.1 is vulnerable to Regular Expression Denial of Service (REDoS). rules.js have multiple unused capture groups which can lead to a Denial of Service.

Publish Date: 2020-07-02

URL: WS-2020-0163

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-02

Fix Resolution (marked): 1.1.1

Direct dependency fix Resolution (ts-node-dev): 1.0.0

Step up your Open Source Security Game with Mend here

CVE-2020-7789

Vulnerable Library - node-notifier-4.6.1.tgz

A Node.js module for sending notifications on native Mac, Windows (post and pre 8) and Linux (or Growl as fallback)

Library home page: https://registry.npmjs.org/node-notifier/-/node-notifier-4.6.1.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/ts-node-dev/node_modules/node-notifier/package.json

Dependency Hierarchy:

• ts-node-dev-1.0.0-pre.32.tgz (Root Library)
  • ❌ node-notifier-4.6.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Publish Date: 2020-12-11

URL: CVE-2020-7789

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1906853

Release Date: 2020-12-11

Fix Resolution (node-notifier): 5.4.4

Direct dependency fix Resolution (ts-node-dev): 1.0.0

Step up your Open Source Security Game with Mend here

WS-2019-0209

Vulnerable Library - marked-0.5.2.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.5.2.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/marked/package.json

Dependency Hierarchy:

• ts-node-dev-1.0.0-pre.32.tgz (Root Library)
  • node-notifier-4.6.1.tgz
    • cli-usage-0.1.8.tgz
      • ❌ marked-0.5.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

marked before 0.7.0 vulnerable to Redos attack by he _label subrule that may significantly degrade parsing performance of malformed input.

Publish Date: 2019-07-04

URL: WS-2019-0209

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1076

Release Date: 2019-07-04

Fix Resolution (marked): 0.7.0

Direct dependency fix Resolution (ts-node-dev): 1.0.0

Step up your Open Source Security Game with Mend here

WS-2019-0169

Vulnerable Library - marked-0.5.2.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.5.2.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/marked/package.json

Dependency Hierarchy:

• ts-node-dev-1.0.0-pre.32.tgz (Root Library)
  • node-notifier-4.6.1.tgz
    • cli-usage-0.1.8.tgz
      • ❌ marked-0.5.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

marked versions >0.3.14 and < 0.6.2 has Regular Expression Denial of Service vulnerability Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion.

Publish Date: 2019-04-03

URL: WS-2019-0169

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/812

Release Date: 2019-04-03

Fix Resolution (marked): 0.6.2

Direct dependency fix Resolution (ts-node-dev): 1.0.0

Step up your Open Source Security Game with Mend here

CVE-2021-23362

Vulnerable Library - hosted-git-info-2.7.1.tgz

Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab

Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.7.1.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/hosted-git-info/package.json

Dependency Hierarchy:

• ts-node-dev-1.0.0-pre.32.tgz (Root Library)
  • dateformat-1.0.12.tgz
    • meow-3.7.0.tgz
      • normalize-package-data-2.4.0.tgz
        • ❌ hosted-git-info-2.7.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Publish Date: 2021-03-23

URL: CVE-2021-23362

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-43f8-2h32-f4cj

Release Date: 2021-03-23

Fix Resolution (hosted-git-info): 2.8.9

Direct dependency fix Resolution (ts-node-dev): 1.0.0

Step up your Open Source Security Game with Mend here