react-scripts-1.0.14.tgz: 122 vulnerabilities (highest severity is: 9.8)

[mend-bolt-for-github]

Vulnerable Library - react-scripts-1.0.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (react-scripts version)	Remediation Possible**
MSC-2023-16606	Critical	9.8	fsevents-1.1.2.tgz	Transitive	N/A*	❌
CVE-2023-45311	Critical	9.8	fsevents-1.1.2.tgz	Transitive	1.1.1	❌
CVE-2023-42282	Critical	9.8	ip-1.1.5.tgz	Transitive	1.0.15	❌
CVE-2023-26136	Critical	9.8	tough-cookie-2.3.3.tgz	Transitive	4.0.0	❌
CVE-2022-37601	Critical	9.8	detected in multiple dependencies	Transitive	4.0.0	❌
CVE-2022-0691	Critical	9.8	detected in multiple dependencies	Transitive	1.0.15	❌
CVE-2021-44906	Critical	9.8	detected in multiple dependencies	Transitive	1.0.15	❌
CVE-2021-42740	Critical	9.8	shell-quote-1.6.1.tgz	Transitive	5.0.0	❌
CVE-2021-3918	Critical	9.8	json-schema-0.2.3.tgz	Transitive	1.0.15	❌
CVE-2021-23383	Critical	9.8	handlebars-4.0.10.tgz	Transitive	1.0.15	❌
CVE-2021-23369	Critical	9.8	handlebars-4.0.10.tgz	Transitive	1.0.15	❌
CVE-2020-7788	Critical	9.8	ini-1.3.4.tgz	Transitive	1.0.15	❌
CVE-2020-7774	Critical	9.8	y18n-3.2.1.tgz	Transitive	1.0.15	❌
CVE-2020-28499	Critical	9.8	merge-1.2.0.tgz	Transitive	3.0.0	❌
CVE-2019-19919	Critical	9.8	handlebars-4.0.10.tgz	Transitive	1.0.15	❌
CVE-2018-6342	Critical	9.8	react-dev-utils-4.1.0.tgz	Transitive	1.0.15	❌
CVE-2018-3774	Critical	9.8	detected in multiple dependencies	Transitive	1.0.15	❌
CVE-2018-16492	Critical	9.8	extend-3.0.1.tgz	Transitive	1.0.15	❌
CVE-2018-13797	Critical	9.8	macaddress-0.2.8.tgz	Transitive	1.0.15	❌
CVE-2018-1000620	Critical	9.8	detected in multiple dependencies	Transitive	1.1.1	❌
CVE-2022-1650	Critical	9.3	eventsource-0.1.6.tgz	Transitive	2.1.3	❌
CVE-2022-0686	Critical	9.1	detected in multiple dependencies	Transitive	1.0.15	❌
CVE-2019-10744	Critical	9.1	detected in multiple dependencies	Transitive	1.0.15	❌
CVE-2023-45133	High	8.8	babel-traverse-6.26.0.tgz	Transitive	N/A*	❌
CVE-2022-46175	High	8.8	json5-0.5.1.tgz	Transitive	3.0.0	❌
CVE-2018-3728	High	8.8	hoek-2.16.3.tgz	Transitive	1.1.1	❌
CVE-2021-37713	High	8.6	tar-2.2.1.tgz	Transitive	1.1.1	❌
CVE-2021-37712	High	8.6	tar-2.2.1.tgz	Transitive	1.1.1	❌
CVE-2021-37701	High	8.6	tar-2.2.1.tgz	Transitive	1.1.1	❌
WS-2019-0063	High	8.1	detected in multiple dependencies	Transitive	2.0.0	❌
CVE-2021-32804	High	8.1	tar-2.2.1.tgz	Transitive	1.1.1	❌
CVE-2021-32803	High	8.1	tar-2.2.1.tgz	Transitive	1.1.1	❌
CVE-2019-20920	High	8.1	handlebars-4.0.10.tgz	Transitive	1.0.15	❌
CVE-2021-43138	High	7.8	async-2.5.0.tgz	Transitive	1.0.15	❌
CVE-2020-13822	High	7.7	elliptic-6.4.0.tgz	Transitive	1.0.15	❌
WS-2021-0152	High	7.5	color-string-0.3.0.tgz	Transitive	2.0.0	❌
WS-2020-0450	High	7.5	handlebars-4.0.10.tgz	Transitive	1.0.15	❌
WS-2020-0091	High	7.5	http-proxy-1.16.2.tgz	Transitive	1.0.15	❌
WS-2019-0541	High	7.5	macaddress-0.2.8.tgz	Transitive	1.0.15	❌
WS-2019-0032	High	7.5	detected in multiple dependencies	Transitive	2.0.0	❌
CVE-2023-46234	High	7.5	browserify-sign-4.0.4.tgz	Transitive	1.0.15	❌
CVE-2022-37620	High	7.5	html-minifier-3.5.5.tgz	Transitive	N/A*	❌
CVE-2022-37603	High	7.5	loader-utils-1.1.0.tgz	Transitive	1.0.15	❌
CVE-2022-3517	High	7.5	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2022-29167	High	7.5	detected in multiple dependencies	Transitive	1.1.1	❌
CVE-2022-25883	High	7.5	semver-5.4.1.tgz	Transitive	5.0.0	❌
CVE-2022-24999	High	7.5	detected in multiple dependencies	Transitive	1.0.15	❌
CVE-2022-24772	High	7.5	node-forge-0.6.33.tgz	Transitive	5.0.0	❌
CVE-2022-24771	High	7.5	node-forge-0.6.33.tgz	Transitive	5.0.0	❌
CVE-2022-21222	High	7.5	css-what-2.1.0.tgz	Transitive	1.0.15	❌
CVE-2021-3807	High	7.5	ansi-regex-3.0.0.tgz	Transitive	1.0.15	❌
CVE-2021-3803	High	7.5	nth-check-1.0.1.tgz	Transitive	1.0.15	❌
CVE-2021-3777	High	7.5	tmpl-1.0.4.tgz	Transitive	1.0.15	❌
CVE-2021-33623	High	7.5	trim-newlines-1.0.0.tgz	Transitive	2.0.1	❌
CVE-2021-29059	High	7.5	is-svg-2.1.0.tgz	Transitive	2.0.0	❌
CVE-2021-28092	High	7.5	is-svg-2.1.0.tgz	Transitive	2.0.0	❌
CVE-2021-27516	High	7.5	urijs-1.19.0.tgz	Transitive	1.0.15	❌
CVE-2021-23424	High	7.5	ansi-html-0.0.7.tgz	Transitive	5.0.0	❌
CVE-2021-23382	High	7.5	detected in multiple dependencies	Transitive	3.0.0	❌
CVE-2021-23343	High	7.5	path-parse-1.0.5.tgz	Transitive	1.0.15	❌
CVE-2020-7662	High	7.5	websocket-extensions-0.1.2.tgz	Transitive	1.0.15	❌
CVE-2020-28469	High	7.5	glob-parent-2.0.0.tgz	Transitive	5.0.0	❌
CVE-2019-20922	High	7.5	handlebars-4.0.10.tgz	Transitive	1.0.15	❌
CVE-2019-13173	High	7.5	fstream-1.0.11.tgz	Transitive	1.0.15	❌
CVE-2018-3737	High	7.5	sshpk-1.13.1.tgz	Transitive	1.0.15	❌
CVE-2018-20834	High	7.5	tar-2.2.1.tgz	Transitive	1.0.15	❌
CVE-2018-16469	High	7.5	merge-1.2.0.tgz	Transitive	1.0.15	❌
CVE-2018-14732	High	7.5	webpack-dev-server-2.8.2.tgz	Transitive	2.0.0	❌
CVE-2017-16138	High	7.5	mime-1.3.6.tgz	Transitive	1.0.15	❌
WS-2018-0588	High	7.4	detected in multiple dependencies	Transitive	1.0.15	❌
CVE-2024-29180	High	7.4	webpack-dev-middleware-1.12.0.tgz	Transitive	5.0.0	❌
CVE-2020-8203	High	7.4	lodash-4.17.4.tgz	Transitive	1.0.15	❌
WS-2019-0064	High	7.3	handlebars-4.0.10.tgz	Transitive	1.0.15	❌
CVE-2020-8116	High	7.3	dot-prop-3.0.0.tgz	Transitive	1.0.15	❌
CVE-2020-7720	High	7.3	node-forge-0.6.33.tgz	Transitive	1.0.15	❌
CVE-2021-23337	High	7.2	lodash-4.17.4.tgz	Transitive	1.0.15	❌
WS-2018-0590	High	7.1	diff-3.3.1.tgz	Transitive	1.0.15	❌
CVE-2020-28498	Medium	6.8	elliptic-6.4.0.tgz	Transitive	1.0.15	❌
WS-2022-0008	Medium	6.6	node-forge-0.6.33.tgz	Transitive	5.0.0	❌
CVE-2024-28863	Medium	6.5	tar-2.2.1.tgz	Transitive	N/A*	❌
CVE-2022-0613	Medium	6.5	urijs-1.19.0.tgz	Transitive	N/A*	❌
CVE-2021-23386	Medium	6.5	dns-packet-1.2.2.tgz	Transitive	1.0.15	❌
CVE-2020-26291	Medium	6.5	urijs-1.19.0.tgz	Transitive	1.0.15	❌
CVE-2019-1010266	Medium	6.5	lodash-4.17.4.tgz	Transitive	1.0.15	❌
CVE-2018-3721	Medium	6.5	lodash-4.17.4.tgz	Transitive	1.0.15	❌
CVE-2018-21270	Medium	6.5	stringstream-0.0.5.tgz	Transitive	1.0.15	❌
CVE-2024-29041	Medium	6.1	express-4.16.1.tgz	Transitive	N/A*	❌
CVE-2023-28155	Medium	6.1	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2022-1243	Medium	6.1	urijs-1.19.0.tgz	Transitive	1.0.15	❌
CVE-2022-1233	Medium	6.1	urijs-1.19.0.tgz	Transitive	1.0.15	❌
CVE-2022-0868	Medium	6.1	urijs-1.19.0.tgz	Transitive	1.0.15	❌
CVE-2022-0122	Medium	6.1	node-forge-0.6.33.tgz	Transitive	5.0.0	❌
CVE-2021-3647	Medium	6.1	urijs-1.19.0.tgz	Transitive	1.0.15	❌
WS-2019-0427	Medium	5.9	elliptic-6.4.0.tgz	Transitive	1.0.15	❌
WS-2019-0424	Medium	5.9	elliptic-6.4.0.tgz	Transitive	1.0.15	❌
WS-2019-0103	Medium	5.6	handlebars-4.0.10.tgz	Transitive	1.0.15	❌
CVE-2021-24033	Medium	5.6	react-dev-utils-4.1.0.tgz	Transitive	4.0.0	❌
CVE-2020-7789	Medium	5.6	node-notifier-5.1.2.tgz	Transitive	1.0.15	❌
CVE-2020-7598	Medium	5.6	detected in multiple dependencies	Transitive	1.0.15	❌
CVE-2020-15366	Medium	5.6	detected in multiple dependencies	Transitive	2.0.0	❌
CVE-2018-16487	Medium	5.6	lodash-4.17.4.tgz	Transitive	1.0.15	❌
WS-2019-0017	Medium	5.3	clean-css-4.1.9.tgz	Transitive	1.0.15	❌
WS-2018-0347	Medium	5.3	eslint-4.4.1.tgz	Transitive	2.0.0	❌
WS-2017-3757	Medium	5.3	content-type-parser-1.0.1.tgz	Transitive	N/A*	❌
CVE-2022-33987	Medium	5.3	got-5.7.1.tgz	Transitive	2.0.1	❌
CVE-2022-24773	Medium	5.3	node-forge-0.6.33.tgz	Transitive	5.0.0	❌
CVE-2022-24723	Medium	5.3	urijs-1.19.0.tgz	Transitive	1.0.15	❌
CVE-2022-0639	Medium	5.3	detected in multiple dependencies	Transitive	1.0.15	❌
CVE-2022-0512	Medium	5.3	detected in multiple dependencies	Transitive	1.0.15	❌
CVE-2021-3664	Medium	5.3	detected in multiple dependencies	Transitive	1.0.15	❌
CVE-2021-29060	Medium	5.3	color-string-0.3.0.tgz	Transitive	2.0.0	❌
CVE-2021-27515	Medium	5.3	detected in multiple dependencies	Transitive	1.0.15	❌
CVE-2021-23362	Medium	5.3	hosted-git-info-2.5.0.tgz	Transitive	1.0.15	❌
CVE-2020-8124	Medium	5.3	detected in multiple dependencies	Transitive	1.0.15	❌
CVE-2020-7693	Medium	5.3	sockjs-0.3.18.tgz	Transitive	3.4.2	❌
CVE-2020-7608	Medium	5.3	detected in multiple dependencies	Transitive	3.4.2	❌
CVE-2020-28500	Medium	5.3	lodash-4.17.4.tgz	Transitive	1.0.15	❌
CVE-2017-16028	Medium	5.3	randomatic-1.1.7.tgz	Transitive	1.0.15	❌
WS-2019-0307	Medium	5.1	mem-1.1.0.tgz	Transitive	2.0.0	❌
WS-2018-0103	Medium	4.8	stringstream-0.0.5.tgz	Transitive	1.0.15	❌
WS-2018-0589	Low	3.7	nwmatcher-1.4.2.tgz	Transitive	1.0.15	❌
CVE-2024-27088	Low	0.0	es5-ext-0.10.30.tgz	Transitive	1.0.15	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (14 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

MSC-2023-16606

Vulnerable Library - fsevents-1.1.2.tgz

Native Access to Mac OS-X FSEvents

Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • ❌ fsevents-1.1.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running (user's machine or backend server). The following risks were identified: Malware dropper – this package contains a Trojan horse, allowing the unauthorized installation of other potentially malicious software.

Publish Date: 2023-09-20

URL: MSC-2023-16606

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2023-45311

Vulnerable Library - fsevents-1.1.2.tgz

Native Access to Mac OS-X FSEvents

Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • ❌ fsevents-1.1.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.

Publish Date: 2023-10-06

URL: CVE-2023-45311

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-45311

Release Date: 2023-10-06

Fix Resolution (fsevents): 1.2.11

Direct dependency fix Resolution (react-scripts): 1.1.1

Step up your Open Source Security Game with Mend here

CVE-2023-42282

Vulnerable Library - ip-1.1.5.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • webpack-dev-server-2.8.2.tgz
    • ❌ ip-1.1.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Publish Date: 2024-02-08

URL: CVE-2023-42282

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-78xj-cgh5-2h22

Release Date: 2024-02-08

Fix Resolution (ip): 1.1.9

Direct dependency fix Resolution (react-scripts): 1.0.15

Step up your Open Source Security Game with Mend here

CVE-2023-26136

Vulnerable Library - tough-cookie-2.3.3.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.3.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • jest-environment-jsdom-20.0.3.tgz
        • jsdom-9.12.0.tgz
          • ❌ tough-cookie-2.3.3.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Publish Date: 2023-07-01

URL: CVE-2023-26136

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136

Release Date: 2023-07-01

Fix Resolution (tough-cookie): 4.1.3

Direct dependency fix Resolution (react-scripts): 4.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-37601

Vulnerable Libraries - loader-utils-1.1.0.tgz, loader-utils-0.2.17.tgz

loader-utils-1.1.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • extract-text-webpack-plugin-3.0.0.tgz
    • ❌ loader-utils-1.1.0.tgz (Vulnerable Library)

loader-utils-0.2.17.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-0.2.17.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • html-webpack-plugin-2.29.0.tgz
    • ❌ loader-utils-0.2.17.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

Publish Date: 2022-10-12

URL: CVE-2022-37601

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-76p3-8jx3-jpfq

Release Date: 2022-10-12

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (react-scripts): 4.0.0

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (react-scripts): 4.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-0691

Vulnerable Libraries - url-parse-1.1.9.tgz, url-parse-1.0.5.tgz

url-parse-1.1.9.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.1.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • react-dev-utils-4.1.0.tgz
    • sockjs-client-1.1.4.tgz
      • ❌ url-parse-1.1.9.tgz (Vulnerable Library)

url-parse-1.0.5.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • react-dev-utils-4.1.0.tgz
    • sockjs-client-1.1.4.tgz
      • eventsource-0.1.6.tgz
        • original-1.0.0.tgz
          • ❌ url-parse-1.0.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

Publish Date: 2022-02-21

URL: CVE-2022-0691

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691

Release Date: 2022-02-21

Fix Resolution (url-parse): 1.5.9

Direct dependency fix Resolution (react-scripts): 1.0.15

Fix Resolution (url-parse): 1.5.9

Direct dependency fix Resolution (react-scripts): 1.0.15

Step up your Open Source Security Game with Mend here

CVE-2021-44906

Vulnerable Libraries - minimist-1.2.0.tgz, minimist-0.0.8.tgz, minimist-0.0.10.tgz

minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • sw-precache-webpack-plugin-0.11.4.tgz
    • sw-precache-5.2.0.tgz
      • meow-3.7.0.tgz
        • ❌ minimist-1.2.0.tgz (Vulnerable Library)

minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • babel-loader-7.1.1.tgz
    • mkdirp-0.5.1.tgz
      • ❌ minimist-0.0.8.tgz (Vulnerable Library)

minimist-0.0.10.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • istanbul-api-1.1.14.tgz
        • istanbul-reports-1.1.2.tgz
          • handlebars-4.0.10.tgz
            • optimist-0.6.1.tgz
              • ❌ minimist-0.0.10.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvch-5gv4-984h

Release Date: 2022-03-17

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (react-scripts): 1.0.15

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (react-scripts): 1.0.15

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (react-scripts): 1.0.15

Step up your Open Source Security Game with Mend here

CVE-2021-42740

Vulnerable Library - shell-quote-1.6.1.tgz

quote and parse shell commands

Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • react-dev-utils-4.1.0.tgz
    • ❌ shell-quote-1.6.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

Publish Date: 2021-10-21

URL: CVE-2021-42740

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740

Release Date: 2021-10-21

Fix Resolution (shell-quote): 1.7.3

Direct dependency fix Resolution (react-scripts): 5.0.0

Step up your Open Source Security Game with Mend here

CVE-2021-3918

Vulnerable Library - json-schema-0.2.3.tgz

JSON Schema validation and specifications

Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • fsevents-1.1.2.tgz
    • node-pre-gyp-0.6.38.tgz
      • request-2.81.0.tgz
        • http-signature-1.1.1.tgz
          • jsprim-1.4.1.tgz
            • ❌ json-schema-0.2.3.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-11-13

URL: CVE-2021-3918

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918

Release Date: 2021-11-13

Fix Resolution (json-schema): 0.4.0

Direct dependency fix Resolution (react-scripts): 1.0.15

Step up your Open Source Security Game with Mend here

CVE-2021-23383

Vulnerable Library - handlebars-4.0.10.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • istanbul-api-1.1.14.tgz
        • istanbul-reports-1.1.2.tgz
          • ❌ handlebars-4.0.10.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Publish Date: 2021-05-04

URL: CVE-2021-23383

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23383

Release Date: 2021-05-04

Fix Resolution (handlebars): 4.1.2-0

Direct dependency fix Resolution (react-scripts): 1.0.15

Step up your Open Source Security Game with Mend here

CVE-2021-23369

Vulnerable Library - handlebars-4.0.10.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • istanbul-api-1.1.14.tgz
        • istanbul-reports-1.1.2.tgz
          • ❌ handlebars-4.0.10.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Publish Date: 2021-04-12

URL: CVE-2021-23369

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-04-12

Fix Resolution (handlebars): 4.1.2-0

Direct dependency fix Resolution (react-scripts): 1.0.15

Step up your Open Source Security Game with Mend here

CVE-2020-7788

Vulnerable Library - ini-1.3.4.tgz

An ini encoder/decoder for node

Library home page: https://registry.npmjs.org/ini/-/ini-1.3.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • react-dev-utils-4.1.0.tgz
    • global-modules-1.0.0.tgz
      • global-prefix-1.0.2.tgz
        • ❌ ini-1.3.4.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Publish Date: 2020-12-11

URL: CVE-2020-7788

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788

Release Date: 2020-12-11

Fix Resolution (ini): 1.3.6

Direct dependency fix Resolution (react-scripts): 1.0.15

Step up your Open Source Security Game with Mend here

CVE-2020-7774

Vulnerable Library - y18n-3.2.1.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-3.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • webpack-3.5.1.tgz
    • yargs-8.0.2.tgz
      • ❌ y18n-3.2.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1654

Release Date: 2020-11-17

Fix Resolution (y18n): 3.2.2

Direct dependency fix Resolution (react-scripts): 1.0.15

Step up your Open Source Security Game with Mend here

CVE-2020-28499

Vulnerable Library - merge-1.2.0.tgz

Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.

Library home page: https://registry.npmjs.org/merge/-/merge-1.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-1.0.14.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • jest-haste-map-20.0.5.tgz
        • sane-1.6.0.tgz
          • exec-sh-0.2.1.tgz
            • ❌ merge-1.2.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .

Publish Date: 2021-02-18

URL: CVE-2020-28499

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-18

Fix Resolution (merge): 2.1.0

Direct dependency fix Resolution (react-scripts): 3.0.0

Step up your Open Source Security Game with Mend here