Vulnerable Library - grunt-bower-task-0.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/bl/package.json

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

CVE-2021-23369

Vulnerable Library - handlebars-2.0.0.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/handlebars/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • ❌ handlebars-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Publish Date: 2021-04-12

URL: CVE-2021-23369

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23369

Release Date: 2021-04-12

Fix Resolution (handlebars): 4.1.2-0

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2018-3750

Vulnerable Library - deep-extend-0.2.11.tgz

Recursive object extending.

Library home page: https://registry.npmjs.org/deep-extend/-/deep-extend-0.2.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/deep-extend/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • bower-json-0.4.0.tgz
      • ❌ deep-extend-0.2.11.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Publish Date: 2018-07-03

URL: CVE-2018-3750

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750

Release Date: 2018-07-03

Fix Resolution (deep-extend): 0.5.1

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2019-19919

Vulnerable Library - handlebars-2.0.0.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/handlebars/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • ❌ handlebars-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Publish Date: 2019-12-20

URL: CVE-2019-19919

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19919

Release Date: 2019-12-20

Fix Resolution (handlebars): 3.0.8

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2016-10541

Vulnerable Library - shell-quote-1.4.3.tgz

quote and parse shell commands

Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.4.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/shell-quote/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • ❌ shell-quote-1.4.3.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.

Publish Date: 2018-05-31

URL: CVE-2016-10541

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10541

Release Date: 2018-05-31

Fix Resolution (shell-quote): 1.6.1

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2018-1000620

Vulnerable Library - cryptiles-0.2.2.tgz

General purpose crypto utilities

Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-0.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cryptiles/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • request-2.42.0.tgz
      • hawk-1.1.1.tgz
        • ❌ cryptiles-0.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.

Publish Date: 2018-07-09

URL: CVE-2018-1000620

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000620

Release Date: 2018-07-09

Fix Resolution (cryptiles): 4.1.2

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2015-8857

Vulnerable Library - uglify-js-2.3.6.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-2.3.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/uglify-js/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • handlebars-2.0.0.tgz
      • ❌ uglify-js-2.3.6.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.

Publish Date: 2017-01-23

URL: CVE-2015-8857

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8858

Release Date: 2017-01-23

Fix Resolution (uglify-js): 2.4.24

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-44906

Vulnerable Libraries - minimist-0.0.8.tgz, minimist-0.0.10.tgz

minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/minimist/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • mkdirp-0.5.0.tgz
      • ❌ minimist-0.0.8.tgz (Vulnerable Library)

minimist-0.0.10.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/optimist/node_modules/minimist/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • bower-config-0.5.3.tgz
      • optimist-0.6.1.tgz
        • ❌ minimist-0.0.10.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2022-03-17

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-23383

Vulnerable Library - handlebars-2.0.0.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/handlebars/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • ❌ handlebars-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Publish Date: 2021-05-04

URL: CVE-2021-23383

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23383

Release Date: 2021-05-04

Fix Resolution (handlebars): 4.1.2-0

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-42740

Vulnerable Library - shell-quote-1.4.3.tgz

quote and parse shell commands

Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.4.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/shell-quote/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • ❌ shell-quote-1.4.3.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

Publish Date: 2021-10-21

URL: CVE-2021-42740

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740

Release Date: 2021-10-21

Fix Resolution (shell-quote): 1.7.3

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

WS-2019-0164

Vulnerable Library - decompress-zip-0.0.8.tgz

A library for reading data from zip files

Library home page: https://registry.npmjs.org/decompress-zip/-/decompress-zip-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decompress-zip/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • ❌ decompress-zip-0.0.8.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

decompress-zip 0.2.x before 0.2.2 and 0.3.x before 0.3.2 has a Zip-Slip vulnerability, an arbitrary file write vulnerability.

Publish Date: 2019-01-16

URL: WS-2019-0164

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/777

Release Date: 2019-01-16

Fix Resolution (decompress-zip): 0.2.2

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2019-10744

Vulnerable Library - lodash-0.10.0.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • ❌ lodash-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0

CVE-2018-3728

Vulnerable Library - hoek-0.9.1.tgz

General purpose node utilities

Library home page: https://registry.npmjs.org/hoek/-/hoek-0.9.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/hoek/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • request-2.42.0.tgz
      • hawk-1.1.1.tgz
        • ❌ hoek-0.9.1.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-03-30

URL: CVE-2018-3728

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16082

Release Date: 2018-03-30

Fix Resolution (hoek): 4.2.0

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2019-20920

Vulnerable Library - handlebars-2.0.0.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/handlebars/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • ❌ handlebars-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

Publish Date: 2020-09-30

URL: CVE-2019-20920

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1324

Release Date: 2020-10-15

Fix Resolution (handlebars): 4.5.3

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-7792

Vulnerable Library - mout-0.9.1.tgz

Modular Utilities

Library home page: https://registry.npmjs.org/mout/-/mout-0.9.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mout/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • ❌ mout-0.9.1.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects into the target object, recursively mixing existing child objects as well'. In both cases, the key used to access the target object recursively is not checked, leading to a Prototype Pollution.

Publish Date: 2020-12-11

URL: CVE-2020-7792

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-7792

Release Date: 2020-12-11

Fix Resolution (mout): 1.2.3

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2019-5484

Vulnerable Library - bower-1.3.12.tgz

The browser package manager

Library home page: https://registry.npmjs.org/bower/-/bower-1.3.12.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/bower/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • ❌ bower-1.3.12.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.

Publish Date: 2019-09-13

URL: CVE-2019-5484

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5484

Release Date: 2019-10-09

Fix Resolution (bower): 1.8.8

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-21213

Vulnerable Library - mout-0.9.1.tgz

Modular Utilities

Library home page: https://registry.npmjs.org/mout/-/mout-0.9.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mout/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • ❌ mout-0.9.1.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively is not checked, leading to exploiting this vulnerability. Note: This vulnerability derives from an incomplete fix of CVE-2020-7792.

Publish Date: 2022-06-17

URL: CVE-2022-21213

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

CVE-2018-20835

Vulnerable Library - tar-fs-0.5.2.tgz

filesystem bindings for tar-stream

Library home page: https://registry.npmjs.org/tar-fs/-/tar-fs-0.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tar-fs/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • ❌ tar-fs-0.5.2.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.

Publish Date: 2019-04-30

URL: CVE-2018-20835

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/344595

Release Date: 2019-04-30

Fix Resolution (tar-fs): 1.16.2

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2017-15010

Vulnerable Library - tough-cookie-0.12.1.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-0.12.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tough-cookie/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • request-2.42.0.tgz
      • ❌ tough-cookie-0.12.1.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.

Publish Date: 2017-10-04

URL: CVE-2017-15010

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-15010

Release Date: 2017-10-04

Fix Resolution (tough-cookie): 2.3.3

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2016-10540

Vulnerable Library - minimatch-1.0.0.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-1.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/minimatch/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • glob-4.0.6.tgz
      • ❌ minimatch-1.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter.

Publish Date: 2018-05-31

URL: CVE-2016-10540

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-10540

Release Date: 2018-05-31

Fix Resolution (minimatch): 3.0.2

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2016-2515

Vulnerable Library - hawk-1.1.1.tgz

HTTP Hawk Authentication Scheme

Library home page: https://registry.npmjs.org/hawk/-/hawk-1.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/hawk/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • request-2.42.0.tgz
      • ❌ hawk-1.1.1.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.

Publish Date: 2016-04-13

URL: CVE-2016-2515

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-2515

Release Date: 2016-04-13

Fix Resolution (hawk): 3.1.3

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2017-1000048

Vulnerable Libraries - qs-1.2.2.tgz, qs-2.3.3.tgz

qs-1.2.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-1.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/node_modules/qs/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • request-2.42.0.tgz
      • ❌ qs-1.2.2.tgz (Vulnerable Library)

qs-2.3.3.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-2.3.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/bower-registry-client/node_modules/qs/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • bower-registry-client-0.2.4.tgz
      • request-2.51.0.tgz
        • ❌ qs-2.3.3.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Publish Date: 2017-07-17

URL: CVE-2017-1000048

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000048

Release Date: 2017-07-17

Fix Resolution (qs): 6.0.4

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

Fix Resolution (qs): 6.0.4

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

CVE-2017-16138

Vulnerable Library - mime-1.2.11.tgz

A comprehensive library for mime-type mapping

Library home page: https://registry.npmjs.org/mime/-/mime-1.2.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/form-data/node_modules/mime/package.json

Dependency Hierarchy:

• grunt-bower-task-0.4.0.tgz (Root Library)
  • bower-1.3.12.tgz
    • request-2.42.0.tgz
      • form-data-0.1.4.tgz
        • ❌ mime-1.2.11.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.

Publish Date: 2018-06-07

URL: CVE-2017-16138

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16138

Release Date: 2018-06-07

Fix Resolution (mime): 1.4.1

Direct dependency fix Resolution (grunt-bower-task): 0.5.0

⛑️ Automatic Remediation is available for this issue

Vulnerable Library - grunt-0.4.5.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-0.4.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt/package.json

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

CVE-2020-28282

Vulnerable Library - getobject-0.1.0.tgz

get.and.set.deep.objects.easily = true

Library home page: https://registry.npmjs.org/getobject/-/getobject-0.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/getobject/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • ❌ getobject-0.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.

Publish Date: 2020-12-29

URL: CVE-2020-28282

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/package/getobject

Release Date: 2020-12-29

Fix Resolution (getobject): 1.0.0

Direct dependency fix Resolution (grunt): 1.3.0

⛑️ Automatic Remediation is available for this issue

CVE-2019-10744

Vulnerable Libraries - lodash-2.4.2.tgz, lodash-0.9.2.tgz

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/inquirer/node_modules/lodash/package.json,/node_modules/grunt-legacy-log-utils/node_modules/lodash/package.json,/node_modules/findup-sync/node_modules/lodash/package.json,/node_modules/insight/node_modules/lodash/package.json,/node_modules/grunt-legacy-log/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • grunt-legacy-log-0.1.3.tgz
    • ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • ❌ lodash-0.9.2.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (grunt): 1.0.3

⛑️ Automatic Remediation is available for this issue

WS-2019-0063

Vulnerable Library - js-yaml-2.0.5.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-2.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/js-yaml/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • ❌ js-yaml-2.0.5.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Publish Date: 2019-04-05

URL: WS-2019-0063

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/813

Release Date: 2019-04-05

Fix Resolution (js-yaml): 3.13.1

Direct dependency fix Resolution (grunt): 1.0.4

⛑️ Automatic Remediation is available for this issue

CVE-2022-3517

Vulnerable Libraries - minimatch-0.2.14.tgz, minimatch-0.3.0.tgz

minimatch-0.2.14.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.2.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimatch/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • ❌ minimatch-0.2.14.tgz (Vulnerable Library)

minimatch-0.3.0.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/findup-sync/node_modules/minimatch/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • findup-sync-0.1.3.tgz
    • glob-3.2.11.tgz
      • ❌ minimatch-0.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5

CVE-2016-10540

Vulnerable Libraries - minimatch-0.2.14.tgz, minimatch-0.3.0.tgz

minimatch-0.2.14.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.2.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimatch/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • ❌ minimatch-0.2.14.tgz (Vulnerable Library)

minimatch-0.3.0.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/findup-sync/node_modules/minimatch/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • findup-sync-0.1.3.tgz
    • glob-3.2.11.tgz
      • ❌ minimatch-0.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter.

Publish Date: 2018-05-31

URL: CVE-2016-10540

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-10540

Release Date: 2018-05-31

Fix Resolution (minimatch): 3.0.2

Direct dependency fix Resolution (grunt): 1.0.0

Fix Resolution (minimatch): 3.0.2

Direct dependency fix Resolution (grunt): 1.0.0

⛑️ Automatic Remediation is available for this issue

WS-2019-0032

Vulnerable Library - js-yaml-2.0.5.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-2.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/js-yaml/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • ❌ js-yaml-2.0.5.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-20

URL: WS-2019-0032

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-20

Fix Resolution (js-yaml): 3.13.0

Direct dependency fix Resolution (grunt): 1.0.4

⛑️ Automatic Remediation is available for this issue

CVE-2020-8203

Vulnerable Libraries - lodash-2.4.2.tgz, lodash-0.9.2.tgz

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/inquirer/node_modules/lodash/package.json,/node_modules/grunt-legacy-log-utils/node_modules/lodash/package.json,/node_modules/findup-sync/node_modules/lodash/package.json,/node_modules/insight/node_modules/lodash/package.json,/node_modules/grunt-legacy-log/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • grunt-legacy-log-0.1.3.tgz
    • ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • ❌ lodash-0.9.2.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (grunt): 1.0.3

⛑️ Automatic Remediation is available for this issue

CVE-2021-23358

Vulnerable Library - underscore-1.7.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.7.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/underscore/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • js-yaml-2.0.5.tgz
    • argparse-0.1.16.tgz
      • ❌ underscore-1.7.0.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution (underscore): 1.12.1

Direct dependency fix Resolution (grunt): 1.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-23337

Vulnerable Libraries - lodash-2.4.2.tgz, lodash-0.9.2.tgz

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/inquirer/node_modules/lodash/package.json,/node_modules/grunt-legacy-log-utils/node_modules/lodash/package.json,/node_modules/findup-sync/node_modules/lodash/package.json,/node_modules/insight/node_modules/lodash/package.json,/node_modules/grunt-legacy-log/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • grunt-legacy-log-0.1.3.tgz
    • ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • ❌ lodash-0.9.2.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (grunt): 1.0.3

⛑️ Automatic Remediation is available for this issue

CVE-2020-7729

Vulnerable Library - grunt-0.4.5.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-0.4.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt/package.json

Dependency Hierarchy:

• ❌ grunt-0.4.5.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

Publish Date: 2020-09-03

URL: CVE-2020-7729

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1684

Release Date: 2020-10-27

Fix Resolution: 1.3.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-1537

Vulnerable Library - grunt-0.4.5.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-0.4.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt/package.json

Dependency Hierarchy:

• ❌ grunt-0.4.5.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.

Publish Date: 2022-05-10

URL: CVE-2022-1537

CVSS 3 Score Details (7.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/0179c3e5-bc02-4fc9-8491-a1a319b51b4d/

Release Date: 2022-05-10

Fix Resolution: 1.5.3

⛑️ Automatic Remediation is available for this issue

CVE-2019-1010266

Vulnerable Libraries - lodash-0.9.2.tgz, lodash-2.4.2.tgz

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • ❌ lodash-0.9.2.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/inquirer/node_modules/lodash/package.json,/node_modules/grunt-legacy-log-utils/node_modules/lodash/package.json,/node_modules/findup-sync/node_modules/lodash/package.json,/node_modules/insight/node_modules/lodash/package.json,/node_modules/grunt-legacy-log/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • grunt-legacy-log-0.1.3.tgz
    • ❌ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (grunt): 1.0.3

⛑️ Automatic Remediation is available for this issue

CVE-2018-3721

Vulnerable Libraries - lodash-0.9.2.tgz, lodash-2.4.2.tgz

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • ❌ lodash-0.9.2.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/inquirer/node_modules/lodash/package.json,/node_modules/grunt-legacy-log-utils/node_modules/lodash/package.json,/node_modules/findup-sync/node_modules/lodash/package.json,/node_modules/insight/node_modules/lodash/package.json,/node_modules/grunt-legacy-log/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • grunt-legacy-log-0.1.3.tgz
    • ❌ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution (lodash): 4.17.5

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.5

Direct dependency fix Resolution (grunt): 1.0.3

⛑️ Automatic Remediation is available for this issue

CVE-2018-16487

Vulnerable Libraries - lodash-2.4.2.tgz, lodash-0.9.2.tgz

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/inquirer/node_modules/lodash/package.json,/node_modules/grunt-legacy-log-utils/node_modules/lodash/package.json,/node_modules/findup-sync/node_modules/lodash/package.json,/node_modules/insight/node_modules/lodash/package.json,/node_modules/grunt-legacy-log/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • grunt-legacy-log-0.1.3.tgz
    • ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • ❌ lodash-0.9.2.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (grunt): 1.0.3

⛑️ Automatic Remediation is available for this issue

CVE-2022-0436

Vulnerable Library - grunt-0.4.5.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-0.4.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt/package.json

Dependency Hierarchy:

• ❌ grunt-0.4.5.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.

Publish Date: 2022-04-12

URL: CVE-2022-0436

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0436

Release Date: 2022-04-12

Fix Resolution: 1.5.1

⛑️ Automatic Remediation is available for this issue

CVE-2020-28500

Vulnerable Libraries - lodash-2.4.2.tgz, lodash-0.9.2.tgz

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/inquirer/node_modules/lodash/package.json,/node_modules/grunt-legacy-log-utils/node_modules/lodash/package.json,/node_modules/findup-sync/node_modules/lodash/package.json,/node_modules/insight/node_modules/lodash/package.json,/node_modules/grunt-legacy-log/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • grunt-legacy-log-0.1.3.tgz
    • ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-0.9.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-0.4.5.tgz (Root Library)
  • ❌ lodash-0.9.2.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (grunt): 1.0.3

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (grunt): 1.0.3

⛑️ Automatic Remediation is available for this issue

Vulnerable Library - grunt-karma-0.12.2.tgz

grunt plugin for karma test runner

Library home page: https://registry.npmjs.org/grunt-karma/-/grunt-karma-0.12.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-karma/package.json

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

CVE-2022-37602

Vulnerable Library - grunt-karma-0.12.2.tgz

grunt plugin for karma test runner

Library home page: https://registry.npmjs.org/grunt-karma/-/grunt-karma-0.12.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-karma/package.json

Dependency Hierarchy:

• ❌ grunt-karma-0.12.2.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.

Publish Date: 2022-10-14

URL: CVE-2022-37602

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

CVE-2019-10744

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-karma/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-karma-0.12.2.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (grunt-karma): 3.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-8203

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-karma/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-karma-0.12.2.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (grunt-karma): 3.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-23337

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-karma/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-karma-0.12.2.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (grunt-karma): 3.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2019-1010266

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-karma/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-karma-0.12.2.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (grunt-karma): 3.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2018-3721

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-karma/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-karma-0.12.2.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution (lodash): 4.17.5

Direct dependency fix Resolution (grunt-karma): 3.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2018-16487

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-karma/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-karma-0.12.2.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (grunt-karma): 3.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-28500

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-karma/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-karma-0.12.2.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 491c618646d2b932bf1967ea581a086fb72c7e38

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (grunt-karma): 3.0.0

⛑️ Automatic Remediation is available for this issue