mocha-multi-reporters-1.1.7.tgz: 4 vulnerabilities (highest severity is: 9.8)

[dev-mend-for-github-com]

Vulnerable Library - mocha-multi-reporters-1.1.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (mocha-multi-reporters version)	Remediation Possible**	Reachability
GHSA-35jh-r3h4-6jhm	Critical	9.8	lodash-4.17.15.tgz	Transitive	N/A*	❌
CVE-2020-8203	High	7.4	lodash-4.17.15.tgz	Transitive	N/A*	❌
CVE-2021-23337	High	7.2	lodash-4.17.15.tgz	Transitive	1.5.0	✅
CVE-2020-28500	Medium	5.3	lodash-4.17.15.tgz	Transitive	1.5.0	✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

GHSA-35jh-r3h4-6jhm

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• mocha-multi-reporters-1.1.7.tgz (Root Library)
  • ❌ lodash-4.17.15.tgz (Vulnerable Library)

Found in base branch: electron-upgrade

Vulnerability Details

lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2025-04-23

URL: GHSA-35jh-r3h4-6jhm

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: 2025-04-23

Fix Resolution: lodash - 4.17.21,lodash-es - 4.17.21

CVE-2020-8203

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• mocha-multi-reporters-1.1.7.tgz (Root Library)
  • ❌ lodash-4.17.15.tgz (Vulnerable Library)

Found in base branch: electron-upgrade

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Mend Note:

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p6mc-m468-83gw

Release Date: 2020-07-15

Fix Resolution: lodash - 4.17.19,lodash-es - 4.17.20

CVE-2021-23337

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• mocha-multi-reporters-1.1.7.tgz (Root Library)
  • ❌ lodash-4.17.15.tgz (Vulnerable Library)

Found in base branch: electron-upgrade

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Mend Note:

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (mocha-multi-reporters): 1.5.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-28500

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• mocha-multi-reporters-1.1.7.tgz (Root Library)
  • ❌ lodash-4.17.15.tgz (Vulnerable Library)

Found in base branch: electron-upgrade

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.
Mend Note:

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-29mw-wpgm-hmr9

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (mocha-multi-reporters): 1.5.0

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.