This repository has been archived by the owner on Mar 8, 2024. It is now read-only.
nextra-1.1.0.tgz: 1 vulnerabilities (highest severity is: 5.3) #3
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Vulnerable Library - nextra-1.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/got/package.json
Found in HEAD commit: 0f7cb9daf3eee4198e5a28d7d9a696f38a304ec4
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2022-33987
Vulnerable Library - got-8.3.2.tgz
Simplified HTTP requests
Library home page: https://registry.npmjs.org/got/-/got-8.3.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/got/package.json
Dependency Hierarchy:
Found in HEAD commit: 0f7cb9daf3eee4198e5a28d7d9a696f38a304ec4
Found in base branch: production
Vulnerability Details
The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
Publish Date: 2022-06-18
URL: CVE-2022-33987
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987
Release Date: 2022-06-18
Fix Resolution: got - 11.8.5,12.1.0
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: