nuxt-2.10.2.tgz: 84 vulnerabilities (highest severity is: 9.8) [trunk]

[mend-developer-platform-dev]

📂 Vulnerable Library - nuxt-2.10.2.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Partial results (34 findings) are displayed below due to a content size limitation in GitHub. To view information on the remaining findings, navigate to the Mend Application.

Findings

Finding	Severity	🎯 CVSS	Exploit Maturity	EPSS	Library	Type	Fixed in	Remediation Available	Reachability
CVE-154062-641864	🟣 Critical	9.8	N/A	N/A	ee-first-1.1.1.tgz	Transitive	N/A	❌
CVE-289561-266276	🟣 Critical	9.8	N/A	N/A	inherits-2.0.4.tgz	Transitive	N/A	❌
CVE-495493-603164	🟣 Critical	9.8	N/A	N/A	delegates-1.0.0.tgz	Transitive	N/A	❌
CVE-587792-470342	🟣 Critical	9.8	N/A	N/A	on-finished-2.3.0.tgz	Transitive	N/A	❌
CVE-616547-419802	🟣 Critical	9.8	N/A	N/A	parseurl-1.3.3.tgz	Transitive	N/A	❌
CVE-636288-474053	🟣 Critical	9.8	N/A	N/A	on-headers-1.0.2.tgz	Transitive	N/A	❌
CVE-796484-931798	🟣 Critical	9.8	N/A	N/A	lodash-4.17.15.tgz	Transitive	N/A	❌
WS-2021-0153	🟣 Critical	9.8	N/A	N/A	ejs-2.7.4.tgz	Transitive	N/A	❌
CVE-2021-44906	🟣 Critical	9.3	Not Defined	< 1%	minimist-1.2.0.tgz	Transitive	N/A	❌
CVE-2021-44906	🟣 Critical	9.3	Not Defined	< 1%	minimist-0.0.8.tgz	Transitive	N/A	❌
CVE-2022-29078	🟣 Critical	9.3	Not Defined	93.5%	ejs-2.7.4.tgz	Transitive	N/A	❌
CVE-2022-37598	🟣 Critical	9.3	Not Defined	< 1%	uglify-js-3.7.2.tgz	Transitive	N/A	❌
CVE-2022-37601	🟣 Critical	9.3	Not Defined	24.6%	loader-utils-0.2.17.tgz	Transitive	N/A	❌
CVE-2022-37601	🟣 Critical	9.3	Not Defined	24.6%	loader-utils-1.2.3.tgz	Transitive	N/A	❌
CVE-2020-13822	🟣 Critical	9.2	Not Defined	< 1%	elliptic-6.5.2.tgz	Transitive	N/A	❌
CVE-2020-7660	🟣 Critical	9.2	Not Defined	2.4%	serialize-javascript-1.9.1.tgz	Transitive	N/A	❌
CVE-2020-7660	🟣 Critical	9.2	Not Defined	2.4%	serialize-javascript-2.1.2.tgz	Transitive	N/A	❌
CVE-2021-32803	🟣 Critical	9.2	Not Defined	< 1%	tar-4.4.8.tgz	Transitive	N/A	❌
CVE-2021-32804	🟣 Critical	9.2	Not Defined	85.5%	tar-4.4.8.tgz	Transitive	N/A	❌
CVE-2021-37701	🟣 Critical	9.2	Not Defined	< 1%	tar-4.4.8.tgz	Transitive	N/A	❌
CVE-2021-37712	🟣 Critical	9.2	Not Defined	< 1%	tar-4.4.8.tgz	Transitive	N/A	❌
CVE-2021-37713	🟣 Critical	9.2	Not Defined	< 1%	tar-4.4.8.tgz	Transitive	N/A	❌
CVE-2025-6545	🟣 Critical	9.1	Not Defined	< 1%	pbkdf2-3.0.17.tgz	Transitive	N/A	❌
CVE-2025-6547	🟣 Critical	9.1	Not Defined	< 1%	pbkdf2-3.0.17.tgz	Transitive	N/A	❌
CVE-2025-9287	🟣 Critical	9.1	Not Defined	< 1%	cipher-base-1.0.4.tgz	Transitive	N/A	❌
CVE-2020-28498	🔴 High	8.9	Not Defined	< 1%	elliptic-6.5.2.tgz	Transitive	N/A	❌
CVE-2019-20149	🔴 High	8.7	Not Defined	< 1%	kind-of-6.0.2.tgz	Transitive	N/A	❌
CVE-2020-7733	🔴 High	8.7	Not Defined	1.2%	ua-parser-js-0.7.20.tgz	Transitive	N/A	❌
CVE-2021-27290	🔴 High	8.7	Not Defined	2.7%	ssri-6.0.1.tgz	Transitive	N/A	❌
CVE-2021-27290	🔴 High	8.7	Not Defined	2.7%	ssri-7.1.0.tgz	Transitive	N/A	❌
CVE-2021-27292	🔴 High	8.7	Not Defined	< 1%	ua-parser-js-0.7.20.tgz	Transitive	N/A	❌
CVE-2021-28092	🔴 High	8.7	Not Defined	< 1%	is-svg-3.0.0.tgz	Transitive	N/A	❌
CVE-2021-29059	🔴 High	8.7	Not Defined	2.8000002%	is-svg-3.0.0.tgz	Transitive	N/A	❌
CVE-2021-3803	🔴 High	8.7	Not Defined	< 1%	nth-check-1.0.2.tgz	Transitive	N/A	❌

Details

🟣CVE-154062-641864

Vulnerable Library - ee-first-1.1.1.tgz

return the first event in a set of ee/event pairs

Library home page: https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• cli-0.9.0.tgz (Root Library)

  • express-4.18.2.tgz
    • on-finished-2.4.1.tgz
      • ❌ ee-first-1.1.1.tgz (Vulnerable Library)

• nuxt-2.10.2.tgz (Root Library)

  • loading-screen-1.2.0.tgz
    • node-res-5.0.1.tgz
      • on-finished-2.3.0.tgz
        • ❌ ee-first-1.1.1.tgz (Vulnerable Library)

• cli-0.11.0.tgz (Root Library)

  • express-4.18.2.tgz
    • on-finished-2.4.1.tgz
      • ❌ ee-first-1.1.1.tgz (Vulnerable Library)

---

Vulnerability Details

Created automatically by the test suite

Publish Date: Jun 07, 2010 05:12 PM

URL: CVE-154062-641864

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 9.8

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟣CVE-289561-266276

Vulnerable Library - inherits-2.0.4.tgz

Browser-friendly inheritance fully compatible with standard node.js inherits()

Library home page: https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz

Path to dependency file: /src/Administration/Resources/app/administration/package.json

Dependency Hierarchy:

• puppeteer-13.7.0.tgz (Root Library)

  • tar-fs-2.1.1.tgz
    • tar-stream-2.2.0.tgz
      • bl-4.1.0.tgz
        • readable-stream-3.6.0.tgz
          • ❌ inherits-2.0.4.tgz (Vulnerable Library)

• cli-0.9.0.tgz (Root Library)

  • express-4.18.2.tgz
    • http-errors-2.0.0.tgz
      • ❌ inherits-2.0.4.tgz (Vulnerable Library)

• webpack-dev-server-3.11.3.tgz (Root Library)

  • chokidar-2.1.8.tgz
    • ❌ inherits-2.0.4.tgz (Vulnerable Library)

• glob-7.1.4.tgz (Root Library)

  • ❌ inherits-2.0.4.tgz (Vulnerable Library)

• test-utils-2.3.2.tgz (Root Library)

  • js-beautify-1.14.6.tgz
    • glob-8.1.0.tgz
      • ❌ inherits-2.0.4.tgz (Vulnerable Library)

• mocha-7.2.0.tgz (Root Library)

  • glob-7.1.3.tgz
    • ❌ inherits-2.0.4.tgz (Vulnerable Library)

• webpack-4.46.0.tgz (Root Library)

  • node-libs-browser-2.2.1.tgz
    • crypto-browserify-3.12.0.tgz
      • browserify-sign-4.2.1.tgz
        • readable-stream-3.6.0.tgz
          • ❌ inherits-2.0.4.tgz (Vulnerable Library)

• webpack-plugin-injector-1.0.7.tgz (Root Library)

  • copy-webpack-plugin-5.1.2.tgz
    • cacache-12.0.4.tgz
      • mississippi-3.0.0.tgz
        • pumpify-1.5.1.tgz
          • ❌ inherits-2.0.4.tgz (Vulnerable Library)

• puppeteer-13.1.2.tgz (Root Library)

  • tar-fs-2.1.1.tgz
    • tar-stream-2.2.0.tgz
      • bl-4.1.0.tgz
        • readable-stream-3.6.0.tgz
          • ❌ inherits-2.0.4.tgz (Vulnerable Library)

• webpack-plugin-injector-1.0.6.tgz (Root Library)

  • copy-webpack-plugin-5.1.2.tgz
    • cacache-12.0.4.tgz
      • mississippi-3.0.0.tgz
        • parallel-transform-1.2.0.tgz
          • ❌ inherits-2.0.4.tgz (Vulnerable Library)

• nuxt-2.10.2.tgz (Root Library)

  • builder-2.10.2.tgz
    • glob-7.1.6.tgz
      • ❌ inherits-2.0.4.tgz (Vulnerable Library)

• fork-ts-checker-webpack-plugin-6.5.3.tgz (Root Library)

  • glob-7.1.6.tgz
    • ❌ inherits-2.0.4.tgz (Vulnerable Library)

• cli-0.11.0.tgz (Root Library)

  • express-4.18.2.tgz
    • http-errors-2.0.0.tgz
      • ❌ inherits-2.0.4.tgz (Vulnerable Library)

---

Vulnerability Details

Created automatically by the test suite

Publish Date: Jun 07, 2010 05:12 PM

URL: CVE-289561-266276

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 9.8

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟣CVE-495493-603164

Vulnerable Library - delegates-1.0.0.tgz

delegate methods and accessors to another property

Library home page: https://registry.npmjs.org/delegates/-/delegates-1.0.0.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • watchpack-1.6.0.tgz
        • chokidar-2.1.8.tgz
          • fsevents-1.2.9.tgz
            • node-pre-gyp-0.12.0.tgz
              • npmlog-4.1.2.tgz
                • are-we-there-yet-1.1.5.tgz
                  • ❌ delegates-1.0.0.tgz (Vulnerable Library)

---

Vulnerability Details

Created automatically by the test suite

Publish Date: Jun 07, 2010 05:12 PM

URL: CVE-495493-603164

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 9.8

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟣CVE-587792-470342

Vulnerable Library - on-finished-2.3.0.tgz

Execute a callback when a request closes, finishes, or errors

Library home page: https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • webpack-bundle-analyzer-3.6.0.tgz
      • express-4.17.1.tgz
        • body-parser-1.19.0.tgz
          • ❌ on-finished-2.3.0.tgz (Vulnerable Library)

---

Vulnerability Details

Created automatically by the test suite

Publish Date: Jun 07, 2010 05:12 PM

URL: CVE-587792-470342

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 9.8

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟣CVE-616547-419802

Vulnerable Library - parseurl-1.3.3.tgz

parse a url with memoization

Library home page: https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• cli-0.9.0.tgz (Root Library)

  • express-4.18.2.tgz
    • finalhandler-1.2.0.tgz
      • ❌ parseurl-1.3.3.tgz (Vulnerable Library)

• webpack-dev-server-3.11.3.tgz (Root Library)

  • serve-index-1.9.1.tgz
    • ❌ parseurl-1.3.3.tgz (Vulnerable Library)

• nuxt-2.10.2.tgz (Root Library)

  • webpack-2.10.2.tgz
    • webpack-bundle-analyzer-3.6.0.tgz
      • express-4.17.1.tgz
        • ❌ parseurl-1.3.3.tgz (Vulnerable Library)

• cli-0.11.0.tgz (Root Library)

  • express-4.18.2.tgz
    • finalhandler-1.2.0.tgz
      • ❌ parseurl-1.3.3.tgz (Vulnerable Library)

---

Vulnerability Details

Created automatically by the test suite

Publish Date: Jun 07, 2010 05:12 PM

URL: CVE-616547-419802

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 9.8

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟣CVE-636288-474053

Vulnerable Library - on-headers-1.0.2.tgz

Execute a listener when a response is about to write headers

Library home page: https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz

Path to dependency file: /src/Administration/Resources/app/administration/package.json

Dependency Hierarchy:

• cli-0.9.0.tgz (Root Library)

  • compression-1.7.4.tgz
    • ❌ on-headers-1.0.2.tgz (Vulnerable Library)

• nuxt-2.10.2.tgz (Root Library)

  • core-2.10.2.tgz
    • server-2.10.2.tgz
      • compression-1.7.4.tgz
        • ❌ on-headers-1.0.2.tgz (Vulnerable Library)

• cli-0.11.0.tgz (Root Library)

  • compression-1.7.4.tgz
    • ❌ on-headers-1.0.2.tgz (Vulnerable Library)

---

Vulnerability Details

Created automatically by the test suite

Publish Date: Jun 07, 2010 05:12 PM

URL: CVE-636288-474053

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 9.8

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟣CVE-796484-931798

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • builder-2.10.2.tgz
    • ❌ lodash-4.17.15.tgz (Vulnerable Library)

---

Vulnerability Details

Created automatically by the test suite

Publish Date: Jun 07, 2010 05:12 PM

URL: CVE-796484-931798

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 9.8

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟣WS-2021-0153

Vulnerable Library - ejs-2.7.4.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.4.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• webpack-bundle-analyzer-3.9.0.tgz (Root Library)

  • ❌ ejs-2.7.4.tgz (Vulnerable Library)

• nuxt-2.10.2.tgz (Root Library)

  • webpack-2.10.2.tgz
    • webpack-bundle-analyzer-3.6.0.tgz
      • ❌ ejs-2.7.4.tgz (Vulnerable Library)

---

Vulnerability Details

Arbitrary Code Injection vulnerability was found in ejs before 3.1.6. Caused by filename which isn't sanitized for display.

Publish Date: Jan 22, 2021 12:00 AM

URL: WS-2021-0153

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 9.8

---

Suggested Fix

Type: Upgrade version

Origin: mde/ejs#571

Release Date: Jan 22, 2021 12:00 AM

Fix Resolution : ejs - 3.1.6

🟣CVE-2021-44906

Vulnerable Library - minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• html-loader-0.5.5.tgz (Root Library)

  • loader-utils-1.2.3.tgz
    • json5-1.0.1.tgz
      • ❌ minimist-1.2.0.tgz (Vulnerable Library)

• nuxt-2.10.2.tgz (Root Library)

  • cli-2.10.2.tgz
    • ❌ minimist-1.2.0.tgz (Vulnerable Library)

---

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: Mar 17, 2022 01:05 PM

URL: CVE-2021-44906

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 9.3

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvch-5gv4-984h

Release Date: Mar 17, 2022 01:05 PM

Fix Resolution : minimist - 0.2.4,minimist - 1.2.6

🟣CVE-2021-44906

Vulnerable Library - minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• pretty-2.0.0.tgz (Root Library)

  • js-beautify-1.10.2.tgz
    • mkdirp-0.5.1.tgz
      • ❌ minimist-0.0.8.tgz (Vulnerable Library)

• nuxt-2.10.2.tgz (Root Library)

  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • watchpack-1.6.0.tgz
        • chokidar-2.1.8.tgz
          • fsevents-1.2.9.tgz
            • node-pre-gyp-0.12.0.tgz
              • mkdirp-0.5.1.tgz
                • ❌ minimist-0.0.8.tgz (Vulnerable Library)

---

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: Mar 17, 2022 01:05 PM

URL: CVE-2021-44906

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 9.3

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvch-5gv4-984h

Release Date: Mar 17, 2022 01:05 PM

Fix Resolution : minimist - 0.2.4,minimist - 1.2.6

🟣CVE-2022-29078

Vulnerable Library - ejs-2.7.4.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.4.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• webpack-bundle-analyzer-3.9.0.tgz (Root Library)

  • ❌ ejs-2.7.4.tgz (Vulnerable Library)

• nuxt-2.10.2.tgz (Root Library)

  • webpack-2.10.2.tgz
    • webpack-bundle-analyzer-3.6.0.tgz
      • ❌ ejs-2.7.4.tgz (Vulnerable Library)

---

Vulnerability Details

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Publish Date: Apr 25, 2022 02:13 PM

URL: CVE-2022-29078

Threat Assessment

Exploit Maturity:Not Defined

EPSS:93.5%

Score: 9.3

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-phwq-j96m-2c2q

Release Date: Apr 25, 2022 02:13 PM

Fix Resolution : ejs - 3.1.7

🟣CVE-2022-37598

Vulnerable Library - uglify-js-3.7.2.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-3.7.2.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • generator-2.10.2.tgz
    • html-minifier-4.0.0.tgz
      • ❌ uglify-js-3.7.2.tgz (Vulnerable Library)

---

Vulnerability Details

Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.

Publish Date: Oct 20, 2022 12:00 AM

URL: CVE-2022-37598

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 9.3

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟣CVE-2022-37601

Vulnerable Library - loader-utils-0.2.17.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-0.2.17.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• svg-inline-loader-0.8.0.tgz (Root Library)

  • ❌ loader-utils-0.2.17.tgz (Vulnerable Library)

• nuxt-2.10.2.tgz (Root Library)

  • webpack-2.10.2.tgz
    • html-webpack-plugin-3.2.0.tgz
      • ❌ loader-utils-0.2.17.tgz (Vulnerable Library)

---

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Publish Date: Oct 12, 2022 12:00 AM

URL: CVE-2022-37601

Threat Assessment

Exploit Maturity:Not Defined

EPSS:24.6%

Score: 9.3

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-76p3-8jx3-jpfq

Release Date: Oct 12, 2022 12:00 AM

Fix Resolution : loader-utils - 2.0.3,loader-utils - 1.4.1

🟣CVE-2022-37601

Vulnerable Library - loader-utils-1.2.3.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• html-loader-0.5.5.tgz (Root Library)

  • ❌ loader-utils-1.2.3.tgz (Vulnerable Library)

• webpack-plugin-injector-1.0.7.tgz (Root Library)

  • copy-webpack-plugin-5.1.2.tgz
    • ❌ loader-utils-1.2.3.tgz (Vulnerable Library)

• nuxt-2.10.2.tgz (Root Library)

  • webpack-2.10.2.tgz
    • postcss-loader-3.0.0.tgz
      • ❌ loader-utils-1.2.3.tgz (Vulnerable Library)

• sass-loader-8.0.2.tgz (Root Library)

  • ❌ loader-utils-1.2.3.tgz (Vulnerable Library)

---

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Publish Date: Oct 12, 2022 12:00 AM

URL: CVE-2022-37601

Threat Assessment

Exploit Maturity:Not Defined

EPSS:24.6%

Score: 9.3

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-76p3-8jx3-jpfq

Release Date: Oct 12, 2022 12:00 AM

Fix Resolution : loader-utils - 2.0.3,loader-utils - 1.4.1

🟣CVE-2020-13822

Vulnerable Library - elliptic-6.5.2.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.2.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • node-libs-browser-2.2.1.tgz
        • crypto-browserify-3.12.0.tgz
          • browserify-sign-4.0.4.tgz
            • ❌ elliptic-6.5.2.tgz (Vulnerable Library)

---

Vulnerability Details

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Publish Date: Jun 04, 2020 02:01 PM

URL: CVE-2020-13822

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 9.2

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-vh7m-p724-62c2

Release Date: Jun 04, 2020 02:01 PM

Fix Resolution : elliptic - 6.5.3

🟣CVE-2020-7660

Vulnerable Library - serialize-javascript-1.9.1.tgz

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.9.1.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • core-2.10.2.tgz
    • vue-renderer-2.10.2.tgz
      • vue-server-renderer-2.6.10.tgz
        • ❌ serialize-javascript-1.9.1.tgz (Vulnerable Library)

---

Vulnerability Details

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

Publish Date: Jun 01, 2020 02:50 PM

URL: CVE-2020-7660

Threat Assessment

Exploit Maturity:Not Defined

EPSS:2.4%

Score: 9.2

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-hxcc-f52p-wc94

Release Date: Jun 01, 2020 02:50 PM

Fix Resolution : serialize-javascript - 3.1.0

🟣CVE-2020-7660

Vulnerable Library - serialize-javascript-2.1.2.tgz

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-2.1.2.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • builder-2.10.2.tgz
    • utils-2.10.2.tgz
      • ❌ serialize-javascript-2.1.2.tgz (Vulnerable Library)

---

Vulnerability Details

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

Publish Date: Jun 01, 2020 02:50 PM

URL: CVE-2020-7660

Threat Assessment

Exploit Maturity:Not Defined

EPSS:2.4%

Score: 9.2

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-hxcc-f52p-wc94

Release Date: Jun 01, 2020 02:50 PM

Fix Resolution : serialize-javascript - 3.1.0

🟣CVE-2021-32803

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • watchpack-1.6.0.tgz
        • chokidar-2.1.8.tgz
          • fsevents-1.2.9.tgz
            • node-pre-gyp-0.12.0.tgz
              • ❌ tar-4.4.8.tgz (Vulnerable Library)

---

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. "node-tar" aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary "stat" calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the "node-tar" directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where "node-tar" checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass "node-tar" symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: Aug 03, 2021 07:05 PM

URL: CVE-2021-32803

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 9.2

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-r628-mhmh-qjhw

Release Date: Aug 03, 2021 07:05 PM

Fix Resolution : tar - 3.2.3,tar - 4.4.15,tar - 6.1.2,tar - 5.0.7

🟣CVE-2021-32804

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • watchpack-1.6.0.tgz
        • chokidar-2.1.8.tgz
          • fsevents-1.2.9.tgz
            • node-pre-gyp-0.12.0.tgz
              • ❌ tar-4.4.8.tgz (Vulnerable Library)

---

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the "preservePaths" flag is not set to "true". This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example "/home/user/.bashrc" would turn into "home/user/.bashrc". This logic was insufficient when file paths contained repeated path roots such as "////home/user/.bashrc". "node-tar" would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. "///home/user/.bashrc") would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom "onentry" method which sanitizes the "entry.path" or a "filter" method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: Aug 03, 2021 07:10 PM

URL: CVE-2021-32804

Threat Assessment

Exploit Maturity:Not Defined

EPSS:85.5%

Score: 9.2

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-3jfq-g458-7qm9

Release Date: Aug 03, 2021 07:10 PM

Fix Resolution : tar - 4.4.14,tar - 6.1.1,tar - 3.2.2,tar - 5.0.6

🟣CVE-2021-37701

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • watchpack-1.6.0.tgz
        • chokidar-2.1.8.tgz
          • fsevents-1.2.9.tgz
            • node-pre-gyp-0.12.0.tgz
              • ❌ tar-4.4.8.tgz (Vulnerable Library)

---

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both "" and "/" characters as path separators, however "" is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at "FOO", followed by a symbolic link named "foo", then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the "FOO" directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: Aug 31, 2021 12:00 AM

URL: CVE-2021-37701

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 9.2

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-9r2w-394v-53qc

Release Date: Aug 31, 2021 12:00 AM

Fix Resolution : tar - 6.1.7,tar - 4.4.16,tar - 5.0.8

🟣CVE-2021-37712

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • watchpack-1.6.0.tgz
        • chokidar-2.1.8.tgz
          • fsevents-1.2.9.tgz
            • node-pre-gyp-0.12.0.tgz
              • ❌ tar-4.4.8.tgz (Vulnerable Library)

---

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.

Publish Date: Aug 31, 2021 12:00 AM

URL: CVE-2021-37712

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 9.2

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-qq89-hq3f-393p

Release Date: Aug 31, 2021 12:00 AM

Fix Resolution : tar - 5.0.10,tar - 4.4.18,tar - 6.1.9

🟣CVE-2021-37713

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • watchpack-1.6.0.tgz
        • chokidar-2.1.8.tgz
          • fsevents-1.2.9.tgz
            • node-pre-gyp-0.12.0.tgz
              • ❌ tar-4.4.8.tgz (Vulnerable Library)

---

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain ".." path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as "C:some\path". If the drive letter does not match the extraction target, for example "D:\extraction\dir", then the result of "path.resolve(extractionDirectory, entryPath)" would resolve against the current working directory on the "C:" drive, rather than the extraction target directory. Additionally, a ".." portion of the path could occur immediately after the drive letter, such as "C:../foo", and was not properly sanitized by the logic that checked for ".." within the normalized and split portions of the path. This only affects users of "node-tar" on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: Aug 31, 2021 04:50 PM

URL: CVE-2021-37713

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 9.2

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-5955-9wpr-37jh

Release Date: Aug 31, 2021 04:50 PM

Fix Resolution : tar - 5.0.10,tar - 4.4.18,tar - 6.1.9

🟣CVE-2025-6545

Vulnerable Library - pbkdf2-3.0.17.tgz

This library provides the functionality of PBKDF2 with the ability to use any supported hashing algorithm returned from crypto.getHashes()

Library home page: https://registry.npmjs.org/pbkdf2/-/pbkdf2-3.0.17.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • node-libs-browser-2.2.1.tgz
        • crypto-browserify-3.12.0.tgz
          • browserify-sign-4.0.4.tgz
            • parse-asn1-5.1.5.tgz
              • ❌ pbkdf2-3.0.17.tgz (Vulnerable Library)

---

Vulnerability Details

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js.
This issue affects pbkdf2: from 3.0.10 through 3.1.2.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: Jun 23, 2025 06:41 PM

URL: CVE-2025-6545

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 9.1

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟣CVE-2025-6547

Vulnerable Library - pbkdf2-3.0.17.tgz

This library provides the functionality of PBKDF2 with the ability to use any supported hashing algorithm returned from crypto.getHashes()

Library home page: https://registry.npmjs.org/pbkdf2/-/pbkdf2-3.0.17.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • node-libs-browser-2.2.1.tgz
        • crypto-browserify-3.12.0.tgz
          • browserify-sign-4.0.4.tgz
            • parse-asn1-5.1.5.tgz
              • ❌ pbkdf2-3.0.17.tgz (Vulnerable Library)

---

Vulnerability Details

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

Publish Date: Jun 23, 2025 07:00 PM

URL: CVE-2025-6547

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 9.1

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟣CVE-2025-9287

Vulnerable Library - cipher-base-1.0.4.tgz

abstract base class for crypto-streams

Library home page: https://registry.npmjs.org/cipher-base/-/cipher-base-1.0.4.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• webpack-4.46.0.tgz (Root Library)

  • node-libs-browser-2.2.1.tgz
    • crypto-browserify-3.12.0.tgz
      • browserify-cipher-1.0.1.tgz
        • browserify-des-1.0.2.tgz
          • ❌ cipher-base-1.0.4.tgz (Vulnerable Library)

• nuxt-2.10.2.tgz (Root Library)

  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • node-libs-browser-2.2.1.tgz
        • crypto-browserify-3.12.0.tgz
          • browserify-cipher-1.0.1.tgz
            • browserify-aes-1.2.0.tgz
              • ❌ cipher-base-1.0.4.tgz (Vulnerable Library)

---

Vulnerability Details

Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.

Publish Date: Aug 20, 2025 09:43 PM

URL: CVE-2025-9287

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 9.1

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🔴CVE-2020-28498

Vulnerable Library - elliptic-6.5.2.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.2.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • node-libs-browser-2.2.1.tgz
        • crypto-browserify-3.12.0.tgz
          • browserify-sign-4.0.4.tgz
            • ❌ elliptic-6.5.2.tgz (Vulnerable Library)

---

Vulnerability Details

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.

Publish Date: Feb 02, 2021 06:50 PM

URL: CVE-2020-28498

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.9

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-r9p9-mrjm-926w

Release Date: Feb 02, 2021 06:50 PM

Fix Resolution : elliptic - 6.5.4

🔴CVE-2019-20149

Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)

  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • micromatch-3.1.10.tgz
        • ❌ kind-of-6.0.2.tgz (Vulnerable Library)

• sass-loader-8.0.2.tgz (Root Library)

  • clone-deep-4.0.1.tgz
    • ❌ kind-of-6.0.2.tgz (Vulnerable Library)

---

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: Dec 30, 2019 06:25 PM

URL: CVE-2019-20149

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-6c8f-qphg-qjgp

Release Date: Dec 30, 2019 06:25 PM

Fix Resolution : kind-of - 6.0.3

🔴CVE-2020-7733

Vulnerable Library - ua-parser-js-0.7.20.tgz

Lightweight JavaScript-based user-agent string parser

Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.20.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • builder-2.10.2.tgz
    • utils-2.10.2.tgz
      • ❌ ua-parser-js-0.7.20.tgz (Vulnerable Library)

---

Vulnerability Details

The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.

Publish Date: Sep 16, 2020 02:10 PM

URL: CVE-2020-7733

Threat Assessment

Exploit Maturity:Not Defined

EPSS:1.2%

Score: 8.7

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-662x-fhqg-9p8v

Release Date: Sep 16, 2020 02:10 PM

Fix Resolution : ua-parser-js - 0.7.22

🔴CVE-2021-27290

Vulnerable Library - ssri-6.0.1.tgz

Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.

Library home page: https://registry.npmjs.org/ssri/-/ssri-6.0.1.tgz

Path to dependency file: /src/Storefront/Resources/app/storefront/package.json

Dependency Hierarchy:

• webpack-plugin-injector-1.0.7.tgz (Root Library)

  • copy-webpack-plugin-5.1.2.tgz
    • cacache-12.0.4.tgz
      • ❌ ssri-6.0.1.tgz (Vulnerable Library)

• nuxt-2.10.2.tgz (Root Library)

  • webpack-2.10.2.tgz
    • webpack-4.41.2.tgz
      • terser-webpack-plugin-1.4.3.tgz
        • cacache-12.0.3.tgz
          • ❌ ssri-6.0.1.tgz (Vulnerable Library)

---

Vulnerability Details

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

Publish Date: Mar 12, 2021 09:47 PM

URL: CVE-2021-27290

Threat Assessment

Exploit Maturity:Not Defined

EPSS:2.7%

Score: 8.7

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-vx3p-948g-6vhq

Release Date: Mar 12, 2021 09:47 PM

Fix Resolution : ssri - 7.1.1,ssri - 8.0.1,ssri - 6.0.2

🔴CVE-2021-27290

Vulnerable Library - ssri-7.1.0.tgz

Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.

Library home page: https://registry.npmjs.org/ssri/-/ssri-7.1.0.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • terser-webpack-plugin-2.2.3.tgz
      • cacache-13.0.1.tgz
        • ❌ ssri-7.1.0.tgz (Vulnerable Library)

---

Vulnerability Details

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

Publish Date: Mar 12, 2021 09:47 PM

URL: CVE-2021-27290

Threat Assessment

Exploit Maturity:Not Defined

EPSS:2.7%

Score: 8.7

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-vx3p-948g-6vhq

Release Date: Mar 12, 2021 09:47 PM

Fix Resolution : ssri - 8.0.1,ssri - 6.0.2,ssri - 7.1.1

🔴CVE-2021-27292

Vulnerable Library - ua-parser-js-0.7.20.tgz

Lightweight JavaScript-based user-agent string parser

Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.20.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • builder-2.10.2.tgz
    • utils-2.10.2.tgz
      • ❌ ua-parser-js-0.7.20.tgz (Vulnerable Library)

---

Vulnerability Details

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.

Publish Date: Mar 17, 2021 12:34 PM

URL: CVE-2021-27292

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-78cj-fxph-m83p

Release Date: Mar 17, 2021 12:34 PM

Fix Resolution : ua-parser-js - 0.7.24

🔴CVE-2021-28092

Vulnerable Library - is-svg-3.0.0.tgz

Check if a string or buffer is SVG

Library home page: https://registry.npmjs.org/is-svg/-/is-svg-3.0.0.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • cssnano-4.1.10.tgz
      • cssnano-preset-default-4.0.7.tgz
        • postcss-svgo-4.0.2.tgz
          • ❌ is-svg-3.0.0.tgz (Vulnerable Library)

---

Vulnerability Details

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time.

Publish Date: Mar 12, 2021 09:31 PM

URL: CVE-2021-28092

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

---

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/CVE-2021-28092

Release Date: Mar 12, 2021 09:31 PM

Fix Resolution : https://github.com/sindresorhus/is-svg.git - no_fix

🔴CVE-2021-29059

Vulnerable Library - is-svg-3.0.0.tgz

Check if a string or buffer is SVG

Library home page: https://registry.npmjs.org/is-svg/-/is-svg-3.0.0.tgz

Path to dependency file: /src/Administration/Resources/app/administration/build/nuxt-component-library/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)
  • webpack-2.10.2.tgz
    • cssnano-4.1.10.tgz
      • cssnano-preset-default-4.0.7.tgz
        • postcss-svgo-4.0.2.tgz
          • ❌ is-svg-3.0.0.tgz (Vulnerable Library)

---

Vulnerability Details

A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.

Publish Date: Jun 21, 2021 03:49 PM

URL: CVE-2021-29059

Threat Assessment

Exploit Maturity:Not Defined

EPSS:2.8000002%

Score: 8.7

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🔴CVE-2021-3803

Vulnerable Library - nth-check-1.0.2.tgz

performant nth-check parser & compiler

Library home page: https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz

Path to dependency file: /src/Administration/Resources/app/administration/package.json

Dependency Hierarchy:

• nuxt-2.10.2.tgz (Root Library)

  • webpack-2.10.2.tgz
    • html-webpack-plugin-3.2.0.tgz
      • pretty-error-2.1.1.tgz
        • renderkid-2.0.3.tgz
          • css-select-1.2.0.tgz
            • ❌ nth-check-1.0.2.tgz (Vulnerable Library)

• optimize-css-assets-webpack-plugin-5.0.8.tgz (Root Library)

  • cssnano-4.1.11.tgz
    • cssnano-preset-default-4.0.8.tgz
      • postcss-svgo-4.0.3.tgz
        • svgo-1.3.2.tgz
          • css-select-2.1.0.tgz
            • ❌ nth-check-1.0.2.tgz (Vulnerable Library)

---

Vulnerability Details

nth-check is vulnerable to Inefficient Regular Expression Complexity

Publish Date: Sep 17, 2021 12:00 AM

URL: CVE-2021-3803

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-rp65-9cf3-cjxr

Release Date: Sep 17, 2021 12:00 AM

Fix Resolution : nth-check - 2.0.1,https://github.com/fb55/nth-check.git - no_fix

[mend-developer-platform-dev]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-developer-platform-dev]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.