The js-snackbar from mickelsonmichael

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23368

Release Date: 2021-04-12

Fix Resolution: postcss -8.2.10

Step up your Open Source Security Game with WhiteSource here

CVE-2020-28469 (High) detected in glob-parent-3.1.0.tgz, glob-parent-5.1.1.tgz

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Libraries - glob-parent-3.1.0.tgz, glob-parent-5.1.1.tgz

glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/glob-parent/package.json,js-snackbar/node_modules/glob-parent/package.json

Dependency Hierarchy:

cli-7.12.10.tgz (Root Library)
- chokidar-2-2.1.8-no-fsevents.tgz
  - ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

glob-parent-5.1.1.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/chokidar/node_modules/glob-parent/package.json,js-snackbar/node_modules/chokidar/node_modules/glob-parent/package.json,js-snackbar/node_modules/fast-glob/node_modules/glob-parent/package.json,js-snackbar/node_modules/fast-glob/node_modules/glob-parent/package.json

Dependency Hierarchy:

cli-7.12.10.tgz (Root Library)
- chokidar-3.5.1.tgz
  - ❌ glob-parent-5.1.1.tgz (Vulnerable Library)

Found in HEAD commit: b35b12e4b75552332fefa13fbaab6aeafccb3a81

Found in base branch: master

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution: glob-parent - 5.1.2

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23382 (Medium) detected in postcss-8.2.4.tgz, postcss-7.0.35.tgz - autoclosed

CVE-2021-23382 - Medium Severity Vulnerability

Vulnerable Libraries - postcss-8.2.4.tgz, postcss-7.0.35.tgz

postcss-8.2.4.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.2.4.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/postcss/package.json,js-snackbar/node_modules/postcss/package.json

Dependency Hierarchy:

❌ postcss-8.2.4.tgz (Vulnerable Library)

postcss-7.0.35.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/postcss-discard-overridden/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-display-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-params/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-timing-functions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-display-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-repeat-style/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-svgo/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-svgo/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-transforms/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-preset-default/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-calc/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-preset-default/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-whitespace/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-unicode/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-transforms/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-colormin/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-url/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-initial/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-params/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-ordered-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-charset/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-calc/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-overridden/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-colormin/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-string/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-util-raw-cache/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-string/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-comments/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-unique-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/css-declaration-sorter/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-font-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-empty/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-convert-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-convert-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-rules/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-charset/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-positions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-positions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-util-raw-cache/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-ordered-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-comments/node_modules/postcss/package.json,js-snackbar/node_modules/stylehacks/node_modules/postcss/package.json,js-snackbar/node_modules/stylehacks/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-duplicates/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-empty/node_modules/postcss/package.json,js-snackbar/node_modules/css-declaration-sorter/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-initial/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-unique-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-url/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-gradients/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-timing-functions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-repeat-style/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-rules/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-longhand/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-longhand/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-unicode/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-whitespace/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-duplicates/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-gradients/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-font-values/node_modules/postcss/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - cssnano-util-raw-cache-4.0.1.tgz
    - ❌ postcss-7.0.35.tgz (Vulnerable Library)

Found in HEAD commit: b35b12e4b75552332fefa13fbaab6aeafccb3a81

Found in base branch: master

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution: postcss - 8.2.13

Step up your Open Source Security Game with WhiteSource here

Move "Try It Yourself" Section to bottom

The "Try It Yourself" section of the demo site is really better suited to be at the bottom of the page, instead of between other potential features.

CVE-2021-33587 (High) detected in css-what-3.4.2.tgz - autoclosed

CVE-2021-33587 - High Severity Vulnerability

Vulnerable Library - css-what-3.4.2.tgz

a CSS selector parser

Library home page: https://registry.npmjs.org/css-what/-/css-what-3.4.2.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/css-what/package.json,js-snackbar/node_modules/css-what/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - postcss-svgo-4.0.2.tgz
    - svgo-1.3.2.tgz
      - css-select-2.1.0.tgz
        
        ❌ css-what-3.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 5907d79b6a1d0acdc78422f8ebd462ef585ee119

Found in base branch: master

Vulnerability Details

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Publish Date: 2021-05-28

URL: CVE-2021-33587

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587

Release Date: 2021-05-28

Fix Resolution: css-what - 5.0.1

Step up your Open Source Security Game with WhiteSource here

CVE-2021-29060 (Medium) detected in color-string-1.5.4.tgz - autoclosed

CVE-2021-29060 - Medium Severity Vulnerability

Vulnerable Library - color-string-1.5.4.tgz

Parser and generator for CSS color strings

Library home page: https://registry.npmjs.org/color-string/-/color-string-1.5.4.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/color-string/package.json,js-snackbar/node_modules/color-string/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - postcss-colormin-4.0.3.tgz
    - color-3.1.3.tgz
      - ❌ color-string-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: b35b12e4b75552332fefa13fbaab6aeafccb3a81

Found in base branch: master

Vulnerability Details

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.

Publish Date: 2021-06-21

URL: CVE-2021-29060

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-257v-vj4p-3w2h

Release Date: 2021-06-21

Fix Resolution: color-string - 1.5.5

Step up your Open Source Security Game with WhiteSource here

CVE-2021-33587 (High) detected in css-what-3.4.2.tgz - autoclosed

CVE-2021-33587 - High Severity Vulnerability

Vulnerable Library - css-what-3.4.2.tgz

a CSS selector parser

Library home page: https://registry.npmjs.org/css-what/-/css-what-3.4.2.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/css-what/package.json,js-snackbar/node_modules/css-what/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - postcss-svgo-4.0.2.tgz
    - svgo-1.3.2.tgz
      - css-select-2.1.0.tgz
        
        ❌ css-what-3.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 82b4bdf100c66805949a25007c739ee410d28d5b

Found in base branch: master

Vulnerability Details

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Publish Date: 2021-05-28

URL: CVE-2021-33587

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587

Release Date: 2021-05-28

Fix Resolution: css-what - 5.0.1

Step up your Open Source Security Game with WhiteSource here

CVE-2021-29059 (High) detected in is-svg-3.0.0.tgz - autoclosed

CVE-2021-29059 - High Severity Vulnerability

Vulnerable Library - is-svg-3.0.0.tgz

Check if a string or buffer is SVG

Library home page: https://registry.npmjs.org/is-svg/-/is-svg-3.0.0.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/is-svg/package.json,js-snackbar/node_modules/is-svg/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - postcss-svgo-4.0.2.tgz
    - ❌ is-svg-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 82b4bdf100c66805949a25007c739ee410d28d5b

Found in base branch: master

Vulnerability Details

A vulnerability was discovered in IS-SVG version 4.3.1 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.

Publish Date: 2021-06-21

URL: CVE-2021-29059

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

IE - Extra spacing at the bottom of the wrapper

In Internet Explorer 11, there is an extra white space below each of the Snackbars. This was solved in Chrome by adding a vertical align bottom to the elements, but the fix doesn't seem to work for IE.

CVE-2021-33587 (High) detected in css-what-3.4.2.tgz

CVE-2021-33587 - High Severity Vulnerability

Vulnerable Library - css-what-3.4.2.tgz

a CSS selector parser

Library home page: https://registry.npmjs.org/css-what/-/css-what-3.4.2.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/css-what/package.json,js-snackbar/node_modules/css-what/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - postcss-svgo-4.0.2.tgz
    - svgo-1.3.2.tgz
      - css-select-2.1.0.tgz
        
        ❌ css-what-3.4.2.tgz (Vulnerable Library)

Found in HEAD commit: b35b12e4b75552332fefa13fbaab6aeafccb3a81

Found in base branch: master

Vulnerability Details

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Publish Date: 2021-05-28

URL: CVE-2021-33587

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587

Release Date: 2021-05-28

Fix Resolution: css-what - 5.0.1

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23364 (Medium) detected in browserslist-4.16.1.tgz - autoclosed

CVE-2021-23364 - Medium Severity Vulnerability

Vulnerable Library - browserslist-4.16.1.tgz

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.16.1.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/browserslist/package.json,js-snackbar/node_modules/browserslist/package.json

Dependency Hierarchy:

preset-env-7.12.11.tgz (Root Library)
- helper-compilation-targets-7.12.5.tgz
  - ❌ browserslist-4.16.1.tgz (Vulnerable Library)

Found in HEAD commit: 82b4bdf100c66805949a25007c739ee410d28d5b

Found in base branch: master

Vulnerability Details

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Publish Date: 2021-04-28

URL: CVE-2021-23364

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364

Release Date: 2021-04-28

Fix Resolution: browserslist - 4.16.5

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-4.17.20.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.20.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/lodash/package.json

Dependency Hierarchy:

cli-7.12.10.tgz (Root Library)
- ❌ lodash-4.17.20.tgz (Vulnerable Library)

Found in HEAD commit: b35b12e4b75552332fefa13fbaab6aeafccb3a81

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23343 (High) detected in path-parse-1.0.6.tgz - autoclosed

CVE-2021-23343 - High Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/path-parse/package.json,js-snackbar/node_modules/path-parse/package.json

Dependency Hierarchy:

css-minify-1.1.0.tgz (Root Library)
- yargs-7.1.1.tgz
  - read-pkg-up-1.0.1.tgz
    - read-pkg-1.1.0.tgz
      - normalize-package-data-2.5.0.tgz
        
        resolve-1.19.0.tgz
        
        ❌ path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: 82b4bdf100c66805949a25007c739ee410d28d5b

Found in base branch: master

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution: path-parse - 1.0.7

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23343 (High) detected in path-parse-1.0.6.tgz

CVE-2021-23343 - High Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/path-parse/package.json,js-snackbar/node_modules/path-parse/package.json

Dependency Hierarchy:

css-minify-1.1.0.tgz (Root Library)
- yargs-7.1.1.tgz
  - read-pkg-up-1.0.1.tgz
    - read-pkg-1.1.0.tgz
      - normalize-package-data-2.5.0.tgz
        
        resolve-1.19.0.tgz
        
        ❌ path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: c25d9b24a5d644736aa2011f659edbe951cbc638

Found in base branch: master

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution: path-parse - 1.0.7

Step up your Open Source Security Game with WhiteSource here

WS-2021-0152 (High) detected in color-string-1.5.4.tgz

WS-2021-0152 - High Severity Vulnerability

Vulnerable Library - color-string-1.5.4.tgz

Parser and generator for CSS color strings

Library home page: https://registry.npmjs.org/color-string/-/color-string-1.5.4.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/color-string/package.json,js-snackbar/node_modules/color-string/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - postcss-colormin-4.0.3.tgz
    - color-3.1.3.tgz
      - ❌ color-string-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: b35b12e4b75552332fefa13fbaab6aeafccb3a81

Found in base branch: master

Vulnerability Details

Regular Expression Denial of Service (ReDoS) was found in color-string before 1.5.5.

Publish Date: 2021-03-12

URL: WS-2021-0152

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/Qix-/color-string/releases/tag/1.5.5

Release Date: 2021-03-12

Fix Resolution: color-string - 1.5.5

Step up your Open Source Security Game with WhiteSource here

WS-2021-0152 (High) detected in color-string-1.5.4.tgz - autoclosed

WS-2021-0152 - High Severity Vulnerability

Vulnerable Library - color-string-1.5.4.tgz

Parser and generator for CSS color strings

Library home page: https://registry.npmjs.org/color-string/-/color-string-1.5.4.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/color-string/package.json,js-snackbar/node_modules/color-string/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - postcss-colormin-4.0.3.tgz
    - color-3.1.3.tgz
      - ❌ color-string-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: 82b4bdf100c66805949a25007c739ee410d28d5b

Found in base branch: master

Vulnerability Details

Regular Expression Denial of Service (ReDoS) was found in color-string before 1.5.5.

Publish Date: 2021-03-12

URL: WS-2021-0152

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/Qix-/color-string/releases/tag/1.5.5

Release Date: 2021-03-12

Fix Resolution: color-string - 1.5.5

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23343 (High) detected in path-parse-1.0.6.tgz - autoclosed

CVE-2021-23343 - High Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/path-parse/package.json,js-snackbar/node_modules/path-parse/package.json

Dependency Hierarchy:

css-minify-1.1.0.tgz (Root Library)
- yargs-7.1.1.tgz
  - read-pkg-up-1.0.1.tgz
    - read-pkg-1.1.0.tgz
      - normalize-package-data-2.5.0.tgz
        
        resolve-1.19.0.tgz
        
        ❌ path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: b35b12e4b75552332fefa13fbaab6aeafccb3a81

Found in base branch: master

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution: path-parse - 1.0.7

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23368 (Medium) detected in postcss-8.2.4.tgz, postcss-7.0.35.tgz - autoclosed

CVE-2021-23368 - Medium Severity Vulnerability

Vulnerable Libraries - postcss-8.2.4.tgz, postcss-7.0.35.tgz

postcss-8.2.4.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.2.4.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/postcss/package.json,js-snackbar/node_modules/postcss/package.json

Dependency Hierarchy:

❌ postcss-8.2.4.tgz (Vulnerable Library)

postcss-7.0.35.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/postcss-discard-overridden/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-display-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-params/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-timing-functions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-display-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-repeat-style/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-svgo/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-svgo/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-transforms/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-preset-default/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-calc/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-preset-default/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-whitespace/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-unicode/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-transforms/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-colormin/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-url/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-initial/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-params/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-ordered-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-charset/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-calc/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-overridden/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-colormin/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-string/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-util-raw-cache/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-string/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-comments/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-unique-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/css-declaration-sorter/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-font-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-empty/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-convert-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-convert-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-rules/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-charset/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-positions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-positions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-util-raw-cache/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-ordered-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-comments/node_modules/postcss/package.json,js-snackbar/node_modules/stylehacks/node_modules/postcss/package.json,js-snackbar/node_modules/stylehacks/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-duplicates/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-empty/node_modules/postcss/package.json,js-snackbar/node_modules/css-declaration-sorter/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-initial/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-unique-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-url/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-gradients/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-timing-functions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-repeat-style/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-rules/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-longhand/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-longhand/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-unicode/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-whitespace/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-duplicates/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-gradients/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-font-values/node_modules/postcss/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - cssnano-util-raw-cache-4.0.1.tgz
    - ❌ postcss-7.0.35.tgz (Vulnerable Library)

Found in HEAD commit: b35b12e4b75552332fefa13fbaab6aeafccb3a81

Found in base branch: master

Vulnerability Details

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

Publish Date: 2021-04-12

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23368

Release Date: 2021-04-12

Fix Resolution: postcss -8.2.10

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23368 (Medium) detected in postcss-8.2.4.tgz, postcss-7.0.35.tgz

CVE-2021-23368 - Medium Severity Vulnerability

Vulnerable Libraries - postcss-8.2.4.tgz, postcss-7.0.35.tgz

postcss-8.2.4.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.2.4.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/postcss/package.json

Dependency Hierarchy:

❌ postcss-8.2.4.tgz (Vulnerable Library)

postcss-7.0.35.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/postcss-discard-overridden/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-display-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-params/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-timing-functions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-display-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-repeat-style/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-svgo/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-svgo/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-transforms/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-preset-default/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-calc/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-preset-default/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-whitespace/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-unicode/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-transforms/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-colormin/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-url/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-initial/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-params/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-ordered-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-charset/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-calc/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-overridden/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-colormin/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-string/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-util-raw-cache/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-string/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-comments/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-unique-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/css-declaration-sorter/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-font-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-empty/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-convert-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-convert-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-rules/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-charset/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-positions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-positions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-util-raw-cache/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-ordered-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-comments/node_modules/postcss/package.json,js-snackbar/node_modules/stylehacks/node_modules/postcss/package.json,js-snackbar/node_modules/stylehacks/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-duplicates/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-empty/node_modules/postcss/package.json,js-snackbar/node_modules/css-declaration-sorter/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-initial/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-unique-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-url/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-gradients/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-timing-functions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-repeat-style/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-rules/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-longhand/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-longhand/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-unicode/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-whitespace/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-duplicates/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-gradients/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-font-values/node_modules/postcss/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - cssnano-util-raw-cache-4.0.1.tgz
    - ❌ postcss-7.0.35.tgz (Vulnerable Library)

Found in HEAD commit: 5907d79b6a1d0acdc78422f8ebd462ef585ee119

Found in base branch: master

Vulnerability Details

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

Publish Date: 2021-04-12

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23368

Release Date: 2021-04-12

Fix Resolution: postcss -8.2.10

Step up your Open Source Security Game with WhiteSource here

WS-2021-0154 (Medium) detected in glob-parent-3.1.0.tgz, glob-parent-5.1.1.tgz - autoclosed

WS-2021-0154 - Medium Severity Vulnerability

Vulnerable Libraries - glob-parent-3.1.0.tgz, glob-parent-5.1.1.tgz

glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/glob-parent/package.json,js-snackbar/node_modules/glob-parent/package.json

Dependency Hierarchy:

cli-7.12.10.tgz (Root Library)
- chokidar-2-2.1.8-no-fsevents.tgz
  - ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

glob-parent-5.1.1.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/chokidar/node_modules/glob-parent/package.json,js-snackbar/node_modules/chokidar/node_modules/glob-parent/package.json,js-snackbar/node_modules/fast-glob/node_modules/glob-parent/package.json,js-snackbar/node_modules/fast-glob/node_modules/glob-parent/package.json

Dependency Hierarchy:

cli-7.12.10.tgz (Root Library)
- chokidar-3.5.1.tgz
  - ❌ glob-parent-5.1.1.tgz (Vulnerable Library)

Found in HEAD commit: 82b4bdf100c66805949a25007c739ee410d28d5b

Found in base branch: master

Vulnerability Details

Regular Expression Denial of Service (ReDoS) vulnerability was found in glob-parent before 5.1.2.

Publish Date: 2021-01-27

URL: WS-2021-0154

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2

Release Date: 2021-01-27

Fix Resolution: glob-parent - 5.1.2

Step up your Open Source Security Game with WhiteSource here

CVE-2020-28500 (Medium) detected in lodash-4.17.20.tgz

CVE-2020-28500 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.17.20.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/lodash/package.json

Dependency Hierarchy:

cli-7.12.10.tgz (Root Library)
- ❌ lodash-4.17.20.tgz (Vulnerable Library)

Found in HEAD commit: b35b12e4b75552332fefa13fbaab6aeafccb3a81

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution: lodash-4.17.21

Step up your Open Source Security Game with WhiteSource here

WS-2021-0152 (High) detected in color-string-1.5.4.tgz - autoclosed

WS-2021-0152 - High Severity Vulnerability

Vulnerable Library - color-string-1.5.4.tgz

Parser and generator for CSS color strings

Library home page: https://registry.npmjs.org/color-string/-/color-string-1.5.4.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/color-string/package.json,js-snackbar/node_modules/color-string/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - postcss-colormin-4.0.3.tgz
    - color-3.1.3.tgz
      - ❌ color-string-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: 5907d79b6a1d0acdc78422f8ebd462ef585ee119

Found in base branch: master

Vulnerability Details

Regular Expression Denial of Service (ReDoS) was found in color-string before 1.5.5.

Publish Date: 2021-03-12

URL: WS-2021-0152

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/Qix-/color-string/releases/tag/1.5.5

Release Date: 2021-03-12

Fix Resolution: color-string - 1.5.5

Step up your Open Source Security Game with WhiteSource here

CVE-2021-29059 (High) detected in is-svg-3.0.0.tgz

CVE-2021-29059 - High Severity Vulnerability

Vulnerable Library - is-svg-3.0.0.tgz

Check if a string or buffer is SVG

Library home page: https://registry.npmjs.org/is-svg/-/is-svg-3.0.0.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/is-svg/package.json,js-snackbar/node_modules/is-svg/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - postcss-svgo-4.0.2.tgz
    - ❌ is-svg-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 5907d79b6a1d0acdc78422f8ebd462ef585ee119

Found in base branch: master

Vulnerability Details

A vulnerability was discovered in IS-SVG version 4.3.1 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.

Publish Date: 2021-06-21

URL: CVE-2021-29059

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23364 (Medium) detected in browserslist-4.16.1.tgz - autoclosed

CVE-2021-23364 - Medium Severity Vulnerability

Vulnerable Library - browserslist-4.16.1.tgz

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.16.1.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/browserslist/package.json,js-snackbar/node_modules/browserslist/package.json

Dependency Hierarchy:

preset-env-7.12.11.tgz (Root Library)
- helper-compilation-targets-7.12.5.tgz
  - ❌ browserslist-4.16.1.tgz (Vulnerable Library)

Found in HEAD commit: b35b12e4b75552332fefa13fbaab6aeafccb3a81

Found in base branch: master

Vulnerability Details

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Publish Date: 2021-04-28

URL: CVE-2021-23364

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364

Release Date: 2021-04-28

Fix Resolution: browserslist - 4.16.5

Step up your Open Source Security Game with WhiteSource here

Add ability to include buttons inside the snackbar

These would allow custom functions to run within the snackbar. For example an Undo button, or a custom dismiss button

Introduce GitHub Actions to CI/CD process

Merging into the master branch should require new build checks to be performed

Babel should transpile the JS into a more browser-friendly version in the /dist directory, and both the transpiled JS and the CSS should have their minified versions updated. This will ensure that any conflicts in the dev branch will be reconciled before release

setting timeout to 0 should be equivalent to false

Hi,
What could be the goal to display a notification with a timeout set to 0 as it will never be seen ?
As this value has no usability it could be equivalent to no timeout.
It will be easiest to use as we should have only one type of parameter to process.
In my case I have to add a test to replace 0 by false.
Most Toast component that I know are using 0 to prevent auto hiding.
JY

Add ability to target a particular element to be the container

By default the target container should be the body, but if the user passes a target option, initialize the snackbar into it. This will result in multiple instances of tooltips but there shouldn't be conflicts. Users should be able to create as many as they want

Not visable when scrolling

On my project the element is always in the given location from when i load the page.
If i scroll and call another element i can´t see it because its all the way up top. (Firefox, Chrome, Edge)
In picture 1 i called many elements while scrolled down. The first 4 aren´t visable at all, the 5th only half.
On your demo page it always is visable and dosn´t care about the scrolling.

My File
Demo Link

Picture 1:

CVE-2021-23343 (High) detected in path-parse-1.0.6.tgz - autoclosed

CVE-2021-23343 - High Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/path-parse/package.json,js-snackbar/node_modules/path-parse/package.json

Dependency Hierarchy:

css-minify-1.1.0.tgz (Root Library)
- yargs-7.1.1.tgz
  - read-pkg-up-1.0.1.tgz
    - read-pkg-1.1.0.tgz
      - normalize-package-data-2.5.0.tgz
        
        resolve-1.19.0.tgz
        
        ❌ path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: 5907d79b6a1d0acdc78422f8ebd462ef585ee119

Found in base branch: master

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution: path-parse - 1.0.7

Step up your Open Source Security Game with WhiteSource here

Typo in README

README states: "Simply call Snackbar()"
When it should be SnackBar().

Minor, but inexperienced users may struggle. A brief entry on how to install + an example would take this even further.

Thanks for an otherwise performant & easy to use library :)

Add ability to define the animation speed as an option

When initializing a snackbar, one of the options should be a speed option that will define how quickly the javascript or css animations will run

Add additional information about Actions to index.html

The documentation on the demo site for Actions is very sparse; the README.md has been updated with some additional usage information on the actions, and the site should be updated to reflect those changes.

Additionally, if possible, the Actions ability should be added to the "Try It Yourself" section

Option to change positioning and add icon

Kindly provide option to change positioning and add icon. If the position is top right corner then toasts should be stacked vertically downward and the latest toast should be at the top.

CVE-2021-29060 (Medium) detected in color-string-1.5.4.tgz

CVE-2021-29060 - Medium Severity Vulnerability

Vulnerable Library - color-string-1.5.4.tgz

Parser and generator for CSS color strings

Library home page: https://registry.npmjs.org/color-string/-/color-string-1.5.4.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/color-string/package.json,js-snackbar/node_modules/color-string/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - postcss-colormin-4.0.3.tgz
    - color-3.1.3.tgz
      - ❌ color-string-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: 5907d79b6a1d0acdc78422f8ebd462ef585ee119

Found in base branch: master

Vulnerability Details

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.

Publish Date: 2021-06-21

URL: CVE-2021-29060

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-257v-vj4p-3w2h

Release Date: 2021-06-21

Fix Resolution: color-string - 1.5.5

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23364 (Medium) detected in browserslist-4.16.1.tgz

CVE-2021-23364 - Medium Severity Vulnerability

Vulnerable Library - browserslist-4.16.1.tgz

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.16.1.tgz

Dependency Hierarchy:

preset-env-7.12.11.tgz (Root Library)
- helper-compilation-targets-7.12.5.tgz
  - ❌ browserslist-4.16.1.tgz (Vulnerable Library)

Found in HEAD commit: 5907d79b6a1d0acdc78422f8ebd462ef585ee119

Found in base branch: master

Vulnerability Details

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Publish Date: 2021-04-28

URL: CVE-2021-23364

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364

Release Date: 2021-04-28

Fix Resolution: browserslist - 4.16.5

Step up your Open Source Security Game with WhiteSource here

Just an advice for those who prefer fixed width for toast

Hi,
To have fixed width snackbar you have to slightly modify the css:

add width property to .js-snackbar
add flex:1 to .js-snackbar__message

JY

Using HTML in message

Hello!

I was trying out the js-snackbar library and was wondering if it is possible to add the use of html tags in my message. So that way I could use something like PHP Error: Biep boep something wrong

Greetings,
Roy

setting status to null raise an exception

Hi,
If status is null => Uncaught TypeError: Cannot read property 'toLowerCase' of null
If status is undefined => no error.
You should replace
status: userOptions?.status !== undefined ? userOptions.status.toLowerCase().trim() : "",
by
status: userOptions?.status ? userOptions.status.toLowerCase().trim() : "",
JY

CVE-2021-23362 (Medium) detected in hosted-git-info-2.8.8.tgz - autoclosed

CVE-2021-23362 - Medium Severity Vulnerability

Vulnerable Library - hosted-git-info-2.8.8.tgz

Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab

Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.8.tgz

Dependency Hierarchy:

Found in HEAD commit: b35b12e4b75552332fefa13fbaab6aeafccb3a81

Found in base branch: master

Vulnerability Details

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Publish Date: 2021-03-23

URL: CVE-2021-23362

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-43f8-2h32-f4cj

Release Date: 2021-03-23

Fix Resolution: hosted-git-info - 2.8.9,3.0.8

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23368 (Medium) detected in postcss-8.2.4.tgz, postcss-7.0.35.tgz - autoclosed

CVE-2021-23368 - Medium Severity Vulnerability

Vulnerable Libraries - postcss-8.2.4.tgz, postcss-7.0.35.tgz

postcss-8.2.4.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.2.4.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/postcss/package.json,js-snackbar/node_modules/postcss/package.json

Dependency Hierarchy:

❌ postcss-8.2.4.tgz (Vulnerable Library)

postcss-7.0.35.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz

Path to dependency file: js-snackbar/package.json

Path to vulnerable library: js-snackbar/node_modules/postcss-discard-overridden/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-display-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-params/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-timing-functions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-display-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-repeat-style/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-svgo/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-svgo/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-transforms/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-preset-default/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-calc/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-preset-default/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-whitespace/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-unicode/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-transforms/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-colormin/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-url/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-initial/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-params/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-ordered-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-charset/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-calc/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-overridden/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-colormin/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-string/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-util-raw-cache/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-string/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-comments/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-unique-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/css-declaration-sorter/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-font-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-empty/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-convert-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-convert-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-rules/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-charset/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-positions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-positions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano-util-raw-cache/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-ordered-values/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-comments/node_modules/postcss/package.json,js-snackbar/node_modules/stylehacks/node_modules/postcss/package.json,js-snackbar/node_modules/stylehacks/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-duplicates/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-empty/node_modules/postcss/package.json,js-snackbar/node_modules/css-declaration-sorter/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-reduce-initial/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-unique-selectors/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-url/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-gradients/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-timing-functions/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-repeat-style/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-rules/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-longhand/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-merge-longhand/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-unicode/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-normalize-whitespace/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-discard-duplicates/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-gradients/node_modules/postcss/package.json,js-snackbar/node_modules/cssnano/node_modules/postcss/package.json,js-snackbar/node_modules/postcss-minify-font-values/node_modules/postcss/package.json

Dependency Hierarchy:

cssnano-4.1.10.tgz (Root Library)
- cssnano-preset-default-4.0.7.tgz
  - cssnano-util-raw-cache-4.0.1.tgz
    - ❌ postcss-7.0.35.tgz (Vulnerable Library)

Found in HEAD commit: c25d9b24a5d644736aa2011f659edbe951cbc638

Found in base branch: master

Vulnerability Details

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

Publish Date: 2021-04-12