Skip to content

[Snyk] Fix for 85 vulnerabilities#14

Open
StanSnyk wants to merge 1 commit intomainfrom
snyk-fix-ac25a2cecd4beb1a568e8fad5a63ae22
Open

[Snyk] Fix for 85 vulnerabilities#14
StanSnyk wants to merge 1 commit intomainfrom
snyk-fix-ac25a2cecd4beb1a568e8fad5a63ae22

Conversation

@StanSnyk
Copy link
Copy Markdown
Owner

snyk-top-banner

Snyk has created this PR to fix 85 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • package.json
  • package-lock.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Prototype Pollution
SNYK-JS-MIXINDEEP-450212
  ****  
medium severity Improper Handling of Unexpected Data Type
SNYK-JS-ONHEADERS-10773729
  ****  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHPARSE-1077067
  ****  
high severity Allocation of Resources Without Limits or Throttling
SNYK-JS-QS-14724253
  ****  
high severity Prototype Poisoning
SNYK-JS-QS-3153490
  ****  
medium severity Server-side Request Forgery (SSRF)
SNYK-JS-REQUEST-3361831
  ****  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795
  ****  
high severity Prototype Pollution
SNYK-JS-SETVALUE-1540541
  ****  
high severity Prototype Pollution
SNYK-JS-SETVALUE-450213
  ****  
medium severity Prototype Pollution
SNYK-JS-TOUGHCOOKIE-5672873
  ****  
high severity Prototype Pollution
SNYK-JS-TYPEORM-590152
  ****  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-UGLIFYJS-1727251
  ****  
medium severity Arbitrary Code Injection
SNYK-JS-UNDERSCORE-1080984
  ****  
high severity Prototype Pollution
SNYK-JS-UNSETVALUE-2400660
  ****  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090599
  ****  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090601
  ****  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090602
  ****  
high severity Prototype Pollution
SNYK-JS-Y18N-1021887
  ****  
medium severity Prototype Pollution
SNYK-JS-YARGSPARSER-560381
  ****  
critical severity Arbitrary File Write via Archive Extraction (Zip Slip)
npm:adm-zip:20180415
  1000  
medium severity Cross-site Scripting (XSS)
SNYK-JS-JQUERY-565129
  496  
high severity Code Injection
SNYK-JS-LODASH-1040724
  398  
high severity Prototype Pollution
SNYK-JS-LODASH-567746
  318  
medium severity Remote Memory Exposure
npm:mongoose:20160116
  297  
high severity Uninitialized Memory Exposure
npm:npmconf:20180512
  286  
medium severity Cross-site Scripting (XSS)
SNYK-JS-JQUERY-567880
  275  
high severity Prototype Pollution
SNYK-JS-EXPRESSFILEUPLOAD-595969
  274  
high severity Prototype Pollution
SNYK-JS-LODASH-6139239
  267  
medium severity Prototype Pollution
SNYK-JS-JQUERY-174006
  260  
high severity Prototype Pollution
SNYK-JS-LODASH-450202
  254  
high severity Prototype Pollution
SNYK-JS-LODASH-608086
  250  
critical severity Predictable Value Range from Previous Values
SNYK-JS-FORMDATA-10841150
  249  
high severity Prototype Pollution
SNYK-JS-LODASH-73638
  249  
high severity Arbitrary Code Execution
npm:ejs:20161128
  242  
high severity Cross-site Scripting (XSS)
npm:marked:20150520
  238  
medium severity Prototype Pollution
npm:lodash:20180130
  233  
high severity Denial of Service (DoS)
SNYK-JS-DICER-2311764
  222  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639
  220  
critical severity Incomplete List of Disallowed Inputs
SNYK-JS-BABELTRAVERSE-5962463
  218  
high severity Arbitrary Code Execution
SNYK-JS-HANDLEBARS-534478
  214  
high severity Code Injection
npm:dustjs-linkedin:20160819
  201  
high severity Remote Code Execution (RCE)
SNYK-JS-HANDLEBARS-1056767
  194  
high severity Denial of Service (DoS)
SNYK-JS-EXPRESSFILEUPLOAD-473997
  192  
critical severity Prototype Pollution
SNYK-JS-HANDLEBARS-534988
  188  
medium severity Regular Expression Denial of Service (ReDoS)
npm:moment:20161019
  170  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-15309438
  169  
high severity Inefficient Algorithmic Complexity
SNYK-JS-MINIMATCH-15353389
  169  
high severity Prototype Pollution
SNYK-JS-AJV-584908
  165  
medium severity Cross-site Scripting (XSS)
npm:jquery:20150627
  161  
high severity Denial of Service (DoS)
SNYK-JS-DECODEURICOMPONENT-3149970
  160  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908
  159  
high severity Excessive Platform Resource Consumption within a Loop
SNYK-JS-BRACES-6838727
  159  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-CROSSSPAWN-8303230
  159  
medium severity Directory Traversal
npm:st:20140206
  158  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-AJV-15274295
  155  
high severity Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922
  151  
high severity Prototype Pollution
SNYK-JS-INI-1048974
  149  
medium severity Prototype Pollution
SNYK-JS-LODASH-15053838
  144  
medium severity Prototype Pollution
SNYK-JS-HANDLEBARS-1279029
  141  
medium severity Prototype Pollution
SNYK-JS-MINIMIST-559764
  137  
medium severity Denial of Service (DoS)
npm:ejs:20161130-1
  136  
medium severity Prototype Pollution
SNYK-JS-HANDLEBARS-567742
  134  
medium severity Cross-site Scripting (XSS)
npm:ejs:20161130
  134  
high severity Prototype Pollution
SNYK-JS-HANDLEBARS-469063
  132  
medium severity Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116
  131  
high severity Prototype Override Protection Bypass
npm:qs:20170213
  115  
high severity Denial of Service (DoS)
SNYK-JS-HANDLEBARS-480388
  114  
high severity Regular Expression Denial of Service (ReDoS)
npm:negotiator:20160616
  114  
high severity Prototype Pollution
SNYK-JS-HANDLEBARS-173692
  108  
high severity Prototype Pollution
SNYK-JS-HANDLEBARS-174183
  108  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905
  104  
medium severity Regular Expression Denial of Service (ReDoS)
npm:ms:20151024
  76  
medium severity Denial of Service (DoS)
npm:mem:20180117
  73  
low severity Regular Expression Denial of Service (ReDoS)
npm:ms:20170412
  67  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-HOSTEDGITINFO-1088355
  63  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-DIFF-14917201
  61  
low severity Validation Bypass
SNYK-JS-KINDOF-537849
  58  
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795
  58  
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073
  57  
medium severity Prototype Pollution
SNYK-JS-JSYAML-13961110
  49  
medium severity Regular Expression Denial of Service (ReDoS)
npm:semver:20150403
  46  
medium severity Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728
  45  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818
  45  
medium severity Cross-site Scripting (XSS)
SNYK-JS-COOKIE-8163060
  40  
medium severity Reverse Tabnabbing
SNYK-JS-ISTANBULREPORTS-2328088
  35  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Cross-site Scripting (XSS)
🦉 More lessons are available in Snyk Learn

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-MIXINDEEP-450212
- https://snyk.io/vuln/SNYK-JS-ONHEADERS-10773729
- https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067
- https://snyk.io/vuln/SNYK-JS-QS-14724253
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541
- https://snyk.io/vuln/SNYK-JS-SETVALUE-450213
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
- https://snyk.io/vuln/SNYK-JS-TYPEORM-590152
- https://snyk.io/vuln/SNYK-JS-UGLIFYJS-1727251
- https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090599
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090601
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090602
- https://snyk.io/vuln/SNYK-JS-Y18N-1021887
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
- https://snyk.io/vuln/npm:adm-zip:20180415
- https://snyk.io/vuln/SNYK-JS-JQUERY-565129
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/npm:mongoose:20160116
- https://snyk.io/vuln/npm:npmconf:20180512
- https://snyk.io/vuln/SNYK-JS-JQUERY-567880
- https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-595969
- https://snyk.io/vuln/SNYK-JS-LODASH-6139239
- https://snyk.io/vuln/SNYK-JS-JQUERY-174006
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-FORMDATA-10841150
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/npm:ejs:20161128
- https://snyk.io/vuln/npm:marked:20150520
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/SNYK-JS-DICER-2311764
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
- https://snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962463
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478
- https://snyk.io/vuln/npm:dustjs-linkedin:20160819
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767
- https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-473997
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534988
- https://snyk.io/vuln/npm:moment:20161019
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-15309438
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-15353389
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/npm:jquery:20150627
- https://snyk.io/vuln/SNYK-JS-DECODEURICOMPONENT-3149970
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-BRACES-6838727
- https://snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230
- https://snyk.io/vuln/npm:st:20140206
- https://snyk.io/vuln/SNYK-JS-AJV-15274295
- https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://snyk.io/vuln/SNYK-JS-LODASH-15053838
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/npm:ejs:20161130-1
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-567742
- https://snyk.io/vuln/npm:ejs:20161130
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-469063
- https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
- https://snyk.io/vuln/npm:qs:20170213
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-480388
- https://snyk.io/vuln/npm:negotiator:20160616
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-173692
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-174183
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/npm:ms:20151024
- https://snyk.io/vuln/npm:mem:20180117
- https://snyk.io/vuln/npm:ms:20170412
- https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
- https://snyk.io/vuln/SNYK-JS-DIFF-14917201
- https://snyk.io/vuln/SNYK-JS-KINDOF-537849
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-BRACEEXPANSION-9789073
- https://snyk.io/vuln/SNYK-JS-JSYAML-13961110
- https://snyk.io/vuln/npm:semver:20150403
- https://snyk.io/vuln/SNYK-JS-MICROMATCH-6838728
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-COOKIE-8163060
- https://snyk.io/vuln/SNYK-JS-ISTANBULREPORTS-2328088
@StanSnyk
Copy link
Copy Markdown
Owner Author

StanSnyk commented Mar 10, 2026

Snyk checks have failed. 8 issues have been found so far.

Status Scanner Critical High Medium Low Total (8)
Open Source Security 0 4 3 1 8 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants