You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to dependency file: /fixtures/packaging/webpack/dev/package.json
Path to vulnerable library: /fixtures/packaging/webpack/dev/package.json,/fixtures/dom/package.json,/fixtures/packaging/webpack/prod/package.json,/fixtures/packaging/webpack-alias/dev/package.json,/fixtures/expiration/package.json,/fixtures/attribute-behavior/package.json,/fixtures/packaging/brunch/dev/package.json,/fixtures/packaging/webpack-alias/prod/package.json,/fixtures/packaging/brunch/prod/package.json
fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.
mend-bolt-for-githubbot
changed the title
CVE-2023-45311 (Critical) detected in fsevents-1.2.4.tgz
CVE-2023-45311 (Critical) detected in fsevents-1.2.9.tgz, fsevents-1.2.4.tgz
Dec 9, 2023
mend-bolt-for-githubbot
changed the title
CVE-2023-45311 (Critical) detected in fsevents-1.2.9.tgz, fsevents-1.2.4.tgz
CVE-2023-45311 (Critical) detected in multiple libraries
Dec 12, 2023
CVE-2023-45311 - Critical Severity Vulnerability
Vulnerable Libraries - fsevents-1.1.2.tgz, fsevents-1.1.3.tgz, fsevents-1.2.9.tgz, fsevents-1.2.4.tgz, fsevents-1.0.14.tgz, fsevents-1.0.17.tgz, fsevents-1.1.1.tgz
fsevents-1.1.2.tgz
Native Access to Mac OS-X FSEvents
Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.1.2.tgz
Path to dependency file: /fixtures/packaging/webpack/dev/package.json
Path to vulnerable library: /fixtures/packaging/webpack/dev/package.json,/fixtures/dom/package.json,/fixtures/packaging/webpack/prod/package.json,/fixtures/packaging/webpack-alias/dev/package.json,/fixtures/expiration/package.json,/fixtures/attribute-behavior/package.json,/fixtures/packaging/brunch/dev/package.json,/fixtures/packaging/webpack-alias/prod/package.json,/fixtures/packaging/brunch/prod/package.json
Dependency Hierarchy:
fsevents-1.1.3.tgz
Native Access to Mac OS-X FSEvents
Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.1.3.tgz
Path to dependency file: /fixtures/expiration/package.json
Path to vulnerable library: /fixtures/expiration/package.json,/fixtures/concurrent/time-slicing/package.json
Dependency Hierarchy:
fsevents-1.2.9.tgz
Native Access to Mac OS-X FSEvents
Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.2.9.tgz
Path to dependency file: /fixtures/flight/package.json
Path to vulnerable library: /fixtures/flight/package.json
Dependency Hierarchy:
fsevents-1.2.4.tgz
Native Access to Mac OS-X FSEvents
Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.2.4.tgz
Path to dependency file: /fixtures/flight/package.json
Path to vulnerable library: /fixtures/flight/package.json,/fixtures/concurrent/time-slicing/package.json
Dependency Hierarchy:
fsevents-1.0.14.tgz
Native Access to Mac OS-X FSEvents
Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.0.14.tgz
Path to dependency file: /fixtures/dom/package.json
Path to vulnerable library: /fixtures/dom/package.json
Dependency Hierarchy:
fsevents-1.0.17.tgz
Native Access to Mac OS-X FSEvents
Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.0.17.tgz
Path to dependency file: /fixtures/fiber-debugger/package.json
Path to vulnerable library: /fixtures/fiber-debugger/package.json,/fixtures/ssr/package.json
Dependency Hierarchy:
fsevents-1.1.1.tgz
Native Access to Mac OS-X FSEvents
Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.1.1.tgz
Path to dependency file: /fixtures/art/package.json
Path to vulnerable library: /fixtures/art/package.json
Dependency Hierarchy:
Found in HEAD commit: 4669645897ed4ebcd4ee037f4dabb509ed4754c7
Found in base branch: master
Vulnerability Details
fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.
Publish Date: 2023-10-06
URL: CVE-2023-45311
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-45311
Release Date: 2023-10-06
Fix Resolution (fsevents): 1.2.11
Direct dependency fix Resolution (brunch): 2.10.13
Fix Resolution (fsevents): 1.2.11
Direct dependency fix Resolution (react-scripts): 1.1.5
Fix Resolution (fsevents): 1.2.11
Direct dependency fix Resolution (react-dev-utils): 10.0.0
Fix Resolution (fsevents): 1.2.11
Direct dependency fix Resolution (react-scripts): 1.1.5
Fix Resolution (fsevents): 1.2.11
Direct dependency fix Resolution (react-scripts): 1.1.1
Fix Resolution (fsevents): 1.2.11
Direct dependency fix Resolution (react-scripts): 1.1.1
Fix Resolution (fsevents): 1.2.11
Direct dependency fix Resolution (webpack): 1.15.0
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: