results_os.json

{
  "vulnerabilities": [
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "concurrently@5.3.0",
        "yargs@13.3.2",
        "string-width@3.1.0",
        "strip-ansi@5.2.0",
        "ansi-regex@4.1.0"
      ],
      "upgradePath": [
        false,
        "concurrently@5.3.0",
        "yargs@13.3.2",
        "string-width@3.1.0",
        "strip-ansi@5.2.0",
        "ansi-regex@4.1.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "4.1.0"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "concurrently@5.3.0",
        "yargs@13.3.2",
        "cliui@5.0.0",
        "strip-ansi@5.2.0",
        "ansi-regex@4.1.0"
      ],
      "upgradePath": [
        false,
        "concurrently@5.3.0",
        "yargs@13.3.2",
        "cliui@5.0.0",
        "strip-ansi@5.2.0",
        "ansi-regex@4.1.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "4.1.0"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "concurrently@5.3.0",
        "yargs@13.3.2",
        "cliui@5.0.0",
        "string-width@3.1.0",
        "strip-ansi@5.2.0",
        "ansi-regex@4.1.0"
      ],
      "upgradePath": [
        false,
        "concurrently@5.3.0",
        "yargs@13.3.2",
        "cliui@5.0.0",
        "string-width@3.1.0",
        "strip-ansi@5.2.0",
        "ansi-regex@4.1.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "4.1.0"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "concurrently@5.3.0",
        "yargs@13.3.2",
        "cliui@5.0.0",
        "wrap-ansi@5.1.0",
        "strip-ansi@5.2.0",
        "ansi-regex@4.1.0"
      ],
      "upgradePath": [
        false,
        "concurrently@5.3.0",
        "yargs@13.3.2",
        "cliui@5.0.0",
        "wrap-ansi@5.1.0",
        "strip-ansi@5.2.0",
        "ansi-regex@4.1.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "4.1.0"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "concurrently@5.3.0",
        "yargs@13.3.2",
        "cliui@5.0.0",
        "wrap-ansi@5.1.0",
        "string-width@3.1.0",
        "strip-ansi@5.2.0",
        "ansi-regex@4.1.0"
      ],
      "upgradePath": [
        false,
        "concurrently@5.3.0",
        "yargs@13.3.2",
        "cliui@5.0.0",
        "wrap-ansi@5.1.0",
        "string-width@3.1.0",
        "strip-ansi@5.2.0",
        "ansi-regex@4.1.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "4.1.0"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "grunt-contrib-compress@1.6.0",
        "chalk@1.1.3",
        "has-ansi@2.0.0",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "grunt-contrib-compress@1.6.0",
        "chalk@1.1.3",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "node-pre-gyp@0.15.0",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "node-pre-gyp@0.15.0",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "string-width@1.0.2",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "grunt-contrib-compress@1.6.0",
        "iltorb@2.4.5",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.3",
        "node-gyp@8.4.1",
        "npmlog@6.0.0",
        "gauge@4.0.0",
        "strip-ansi@6.0.1",
        "ansi-regex@5.0.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-pre-gyp@0.11.0",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "node-pre-gyp@0.15.0",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "wide-align@1.1.3",
        "string-width@1.0.2",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [
        false,
        "node-pre-gyp@0.15.0",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "wide-align@1.1.3",
        "string-width@2.1.0",
        "strip-ansi@4.0.0",
        "ansi-regex@3.0.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "grunt-contrib-compress@1.6.0",
        "iltorb@2.4.5",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "string-width@1.0.2",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "string-width@1.0.2",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.3",
        "node-gyp@8.4.1",
        "npmlog@6.0.0",
        "gauge@4.0.0",
        "string-width@4.2.3",
        "strip-ansi@6.0.1",
        "ansi-regex@5.0.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-pre-gyp@0.11.0",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "string-width@1.0.2",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "grunt-contrib-compress@1.6.0",
        "iltorb@2.4.5",
        "prebuild-install@5.3.6",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "grunt-contrib-compress@1.6.0",
        "iltorb@2.4.5",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "wide-align@1.1.3",
        "string-width@1.0.2",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [
        false,
        "grunt-contrib-compress@1.6.0",
        "iltorb@2.4.5",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "wide-align@1.1.3",
        "string-width@2.1.0",
        "strip-ansi@4.0.0",
        "ansi-regex@3.0.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "wide-align@1.1.3",
        "string-width@1.0.2",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "wide-align@1.1.3",
        "string-width@2.1.0",
        "strip-ansi@4.0.0",
        "ansi-regex@3.0.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-pre-gyp@0.11.0",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "wide-align@1.1.3",
        "string-width@1.0.2",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.2",
        "node-pre-gyp@0.11.0",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "wide-align@1.1.3",
        "string-width@2.1.0",
        "strip-ansi@4.0.0",
        "ansi-regex@3.0.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "libxmljs2@0.26.7",
        "@mapbox/node-pre-gyp@1.0.8",
        "npmlog@5.0.1",
        "gauge@3.0.2",
        "wide-align@1.1.3",
        "string-width@1.0.2",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [
        false,
        "libxmljs2@0.26.7",
        "@mapbox/node-pre-gyp@1.0.8",
        "npmlog@5.0.1",
        "gauge@3.0.2",
        "wide-align@1.1.3",
        "string-width@2.1.0",
        "strip-ansi@4.0.0",
        "ansi-regex@3.0.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "grunt-contrib-compress@1.6.0",
        "iltorb@2.4.5",
        "prebuild-install@5.3.6",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "string-width@1.0.2",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ANSIREGEX-1583908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
      "credit": [
        "Yeting Li"
      ],
      "semver": {
        "vulnerable": [
          ">=2.1.1 <3.0.1",
          ">=4.0.0 <4.1.1",
          ">=5.0.0 <5.0.1",
          ">=6.0.0 <6.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.0.1",
        "4.1.1",
        "5.0.1",
        "6.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "ansi-regex",
      "references": [
        {
          "url": "https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/chalk/ansi-regex/pull/37",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-18T11:04:40.935720Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-25T16:45:11.225574Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-08T01:10:38.334810Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-3807"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "ansi-regex",
      "proprietary": false,
      "creationTime": "2021-09-09T14:28:31.617043Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-09T14:27:43Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-12T12:52:37Z",
      "modificationTime": "2022-11-08T01:10:38.334810Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "grunt-contrib-compress@1.6.0",
        "iltorb@2.4.5",
        "prebuild-install@5.3.6",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "wide-align@1.1.3",
        "string-width@1.0.2",
        "strip-ansi@3.0.1",
        "ansi-regex@2.1.1"
      ],
      "upgradePath": [
        false,
        "grunt-contrib-compress@1.6.0",
        "iltorb@2.4.5",
        "prebuild-install@5.3.6",
        "npmlog@4.1.2",
        "gauge@2.7.4",
        "wide-align@1.1.3",
        "string-width@2.1.0",
        "strip-ansi@4.0.0",
        "ansi-regex@3.0.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "ansi-regex",
      "version": "2.1.1"
    },
    {
      "id": "SNYK-JS-ASYNC-2441827",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          ">=2.0.0 <2.6.4",
          ">=3.0.0 <3.2.2"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "2.6.4",
        "3.2.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "async",
      "references": [
        {
          "url": "https://github.com/caolan/async/pull/1828",
          "title": "GitHub Backport PR"
        },
        {
          "url": "https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d",
          "title": "GitHub Commit"
        },
        {
          "url": "https://jsfiddle.net/oz5twjd9/",
          "title": "PoC"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 7.8,
          "modificationTime": "2022-05-14T01:11:01.228151Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 7.8,
          "modificationTime": "2022-11-27T15:35:48.591671Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mapValues()` method, due to improper check in `createObjectIterator` function.\r\n\r\n## PoC\r\n\r\n```js\r\n//when objects are parsed, all properties are created as own (the objects can come from outside sources (http requests/ file))\r\nconst hasOwn = JSON.parse('{\"__proto__\": {\"isAdmin\": true}}');\r\n\r\n//does not have the property,  because it's inside object's own \"__proto__\"\r\nconsole.log(hasOwn.isAdmin);\r\n\r\nasync.mapValues(hasOwn, (val, key, cb) => cb(null, val), (error, result) => {\r\n  // after the method executes, hasOwn.__proto__ value (isAdmin: true) replaces the prototype of the newly created object, leading to potential exploits.\r\n  console.log(result.isAdmin);\r\n});\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `async` to version 2.6.4, 3.2.2 or higher.\n## References\n- [GitHub Backport PR](https://github.com/caolan/async/pull/1828)\n- [GitHub Commit](https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2)\n- [GitHub Commit](https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d)\n- [PoC](https://jsfiddle.net/oz5twjd9/)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-43138"
        ],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "async",
      "proprietary": false,
      "creationTime": "2022-04-07T07:58:38.528444Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-04-07T07:49:24Z",
      "packageManager": "npm",
      "publicationTime": "2022-04-07T14:22:18Z",
      "modificationTime": "2022-11-27T15:35:48.591671Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "portscanner@2.2.0",
        "async@2.6.3"
      ],
      "upgradePath": [
        false,
        "portscanner@2.2.0",
        "async@2.6.4"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "async",
      "version": "2.6.3"
    },
    {
      "id": "SNYK-JS-ASYNC-2441827",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          ">=2.0.0 <2.6.4",
          ">=3.0.0 <3.2.2"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "2.6.4",
        "3.2.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "async",
      "references": [
        {
          "url": "https://github.com/caolan/async/pull/1828",
          "title": "GitHub Backport PR"
        },
        {
          "url": "https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d",
          "title": "GitHub Commit"
        },
        {
          "url": "https://jsfiddle.net/oz5twjd9/",
          "title": "PoC"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 7.8,
          "modificationTime": "2022-05-14T01:11:01.228151Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 7.8,
          "modificationTime": "2022-11-27T15:35:48.591671Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mapValues()` method, due to improper check in `createObjectIterator` function.\r\n\r\n## PoC\r\n\r\n```js\r\n//when objects are parsed, all properties are created as own (the objects can come from outside sources (http requests/ file))\r\nconst hasOwn = JSON.parse('{\"__proto__\": {\"isAdmin\": true}}');\r\n\r\n//does not have the property,  because it's inside object's own \"__proto__\"\r\nconsole.log(hasOwn.isAdmin);\r\n\r\nasync.mapValues(hasOwn, (val, key, cb) => cb(null, val), (error, result) => {\r\n  // after the method executes, hasOwn.__proto__ value (isAdmin: true) replaces the prototype of the newly created object, leading to potential exploits.\r\n  console.log(result.isAdmin);\r\n});\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `async` to version 2.6.4, 3.2.2 or higher.\n## References\n- [GitHub Backport PR](https://github.com/caolan/async/pull/1828)\n- [GitHub Commit](https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2)\n- [GitHub Commit](https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d)\n- [PoC](https://jsfiddle.net/oz5twjd9/)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-43138"
        ],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "async",
      "proprietary": false,
      "creationTime": "2022-04-07T07:58:38.528444Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-04-07T07:49:24Z",
      "packageManager": "npm",
      "publicationTime": "2022-04-07T14:22:18Z",
      "modificationTime": "2022-11-27T15:35:48.591671Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "grunt-contrib-compress@1.6.0",
        "archiver@1.3.0",
        "async@2.6.3"
      ],
      "upgradePath": [
        false,
        "grunt-contrib-compress@1.6.0",
        "archiver@1.3.0",
        "async@2.6.4"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "async",
      "version": "2.6.3"
    },
    {
      "id": "SNYK-JS-ASYNC-2441827",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          ">=2.0.0 <2.6.4",
          ">=3.0.0 <3.2.2"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "2.6.4",
        "3.2.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "async",
      "references": [
        {
          "url": "https://github.com/caolan/async/pull/1828",
          "title": "GitHub Backport PR"
        },
        {
          "url": "https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d",
          "title": "GitHub Commit"
        },
        {
          "url": "https://jsfiddle.net/oz5twjd9/",
          "title": "PoC"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 7.8,
          "modificationTime": "2022-05-14T01:11:01.228151Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 7.8,
          "modificationTime": "2022-11-27T15:35:48.591671Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mapValues()` method, due to improper check in `createObjectIterator` function.\r\n\r\n## PoC\r\n\r\n```js\r\n//when objects are parsed, all properties are created as own (the objects can come from outside sources (http requests/ file))\r\nconst hasOwn = JSON.parse('{\"__proto__\": {\"isAdmin\": true}}');\r\n\r\n//does not have the property,  because it's inside object's own \"__proto__\"\r\nconsole.log(hasOwn.isAdmin);\r\n\r\nasync.mapValues(hasOwn, (val, key, cb) => cb(null, val), (error, result) => {\r\n  // after the method executes, hasOwn.__proto__ value (isAdmin: true) replaces the prototype of the newly created object, leading to potential exploits.\r\n  console.log(result.isAdmin);\r\n});\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `async` to version 2.6.4, 3.2.2 or higher.\n## References\n- [GitHub Backport PR](https://github.com/caolan/async/pull/1828)\n- [GitHub Commit](https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2)\n- [GitHub Commit](https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d)\n- [PoC](https://jsfiddle.net/oz5twjd9/)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-43138"
        ],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "async",
      "proprietary": false,
      "creationTime": "2022-04-07T07:58:38.528444Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-04-07T07:49:24Z",
      "packageManager": "npm",
      "publicationTime": "2022-04-07T14:22:18Z",
      "modificationTime": "2022-11-27T15:35:48.591671Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "juicy-chat-bot@0.6.5",
        "@nlpjs/lang-all@4.22.7",
        "@nlpjs/lang-ja@4.22.7",
        "kuromoji@0.1.2",
        "async@2.6.3"
      ],
      "upgradePath": [
        false,
        "juicy-chat-bot@0.6.5",
        "@nlpjs/lang-all@4.22.7",
        "@nlpjs/lang-ja@4.22.7",
        "kuromoji@0.1.2",
        "async@2.6.4"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "async",
      "version": "2.6.3"
    },
    {
      "id": "SNYK-JS-DECODEURICOMPONENT-3149970",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "KatsuragiCSL"
      ],
      "semver": {
        "vulnerable": [
          "<0.2.2"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "0.2.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "decode-uri-component",
      "references": [
        {
          "url": "https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/sindresorhus/query-string/issues/345",
          "title": "GitHub Issue"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-12-02T01:11:11.714842Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) due to improper input validation, when the hash string `# kun%ea%ba%5a%ba` is being parsed by `decodeUriComponent`.\r\n\r\n## PoC\r\n```js\r\nconst decodeUriComponent = require('decode-uri-component');\r\n\r\nvar x = decodeUriComponent('%ea%ba%5a%ba');\r\n\r\nconsole.log(x);\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `decode-uri-component` to version 0.2.2 or higher.\n## References\n- [GitHub Commit](https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152)\n- [GitHub Issue](https://github.com/SamVerschueren/decode-uri-component/issues/5)\n- [GitHub Issue](https://github.com/sindresorhus/query-string/issues/345)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-38900"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "decode-uri-component",
      "proprietary": false,
      "creationTime": "2022-11-28T14:24:36.010219Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-11-28T14:06:23Z",
      "packageManager": "npm",
      "publicationTime": "2022-11-28T16:12:34.614831Z",
      "modificationTime": "2022-12-02T09:02:03.162272Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "snapdragon@0.8.2",
        "source-map-resolve@0.5.3",
        "decode-uri-component@0.2.0"
      ],
      "upgradePath": [
        false,
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "snapdragon@0.8.2",
        "source-map-resolve@0.5.3",
        "decode-uri-component@0.2.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "decode-uri-component",
      "version": "0.2.0"
    },
    {
      "id": "SNYK-JS-DECODEURICOMPONENT-3149970",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "KatsuragiCSL"
      ],
      "semver": {
        "vulnerable": [
          "<0.2.2"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "0.2.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "decode-uri-component",
      "references": [
        {
          "url": "https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/sindresorhus/query-string/issues/345",
          "title": "GitHub Issue"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-12-02T01:11:11.714842Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) due to improper input validation, when the hash string `# kun%ea%ba%5a%ba` is being parsed by `decodeUriComponent`.\r\n\r\n## PoC\r\n```js\r\nconst decodeUriComponent = require('decode-uri-component');\r\n\r\nvar x = decodeUriComponent('%ea%ba%5a%ba');\r\n\r\nconsole.log(x);\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `decode-uri-component` to version 0.2.2 or higher.\n## References\n- [GitHub Commit](https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152)\n- [GitHub Issue](https://github.com/SamVerschueren/decode-uri-component/issues/5)\n- [GitHub Issue](https://github.com/sindresorhus/query-string/issues/345)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-38900"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "decode-uri-component",
      "proprietary": false,
      "creationTime": "2022-11-28T14:24:36.010219Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-11-28T14:06:23Z",
      "packageManager": "npm",
      "publicationTime": "2022-11-28T16:12:34.614831Z",
      "modificationTime": "2022-12-02T09:02:03.162272Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "download@8.0.0",
        "got@8.3.2",
        "cacheable-request@2.1.4",
        "normalize-url@2.0.1",
        "query-string@5.1.1",
        "decode-uri-component@0.2.0"
      ],
      "upgradePath": [
        false,
        "download@8.0.0",
        "got@8.3.2",
        "cacheable-request@2.1.4",
        "normalize-url@2.0.1",
        "query-string@5.1.1",
        "decode-uri-component@0.2.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "decode-uri-component",
      "version": "0.2.0"
    },
    {
      "id": "SNYK-JS-DECODEURICOMPONENT-3149970",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "KatsuragiCSL"
      ],
      "semver": {
        "vulnerable": [
          "<0.2.2"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "0.2.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "decode-uri-component",
      "references": [
        {
          "url": "https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/sindresorhus/query-string/issues/345",
          "title": "GitHub Issue"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-12-02T01:11:11.714842Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) due to improper input validation, when the hash string `# kun%ea%ba%5a%ba` is being parsed by `decodeUriComponent`.\r\n\r\n## PoC\r\n```js\r\nconst decodeUriComponent = require('decode-uri-component');\r\n\r\nvar x = decodeUriComponent('%ea%ba%5a%ba');\r\n\r\nconsole.log(x);\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `decode-uri-component` to version 0.2.2 or higher.\n## References\n- [GitHub Commit](https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152)\n- [GitHub Issue](https://github.com/SamVerschueren/decode-uri-component/issues/5)\n- [GitHub Issue](https://github.com/sindresorhus/query-string/issues/345)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-38900"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "decode-uri-component",
      "proprietary": false,
      "creationTime": "2022-11-28T14:24:36.010219Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-11-28T14:06:23Z",
      "packageManager": "npm",
      "publicationTime": "2022-11-28T16:12:34.614831Z",
      "modificationTime": "2022-12-02T09:02:03.162272Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "braces@2.3.2",
        "snapdragon@0.8.2",
        "source-map-resolve@0.5.3",
        "decode-uri-component@0.2.0"
      ],
      "upgradePath": [
        false,
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "braces@2.3.2",
        "snapdragon@0.8.2",
        "source-map-resolve@0.5.3",
        "decode-uri-component@0.2.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "decode-uri-component",
      "version": "0.2.0"
    },
    {
      "id": "SNYK-JS-DECODEURICOMPONENT-3149970",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "KatsuragiCSL"
      ],
      "semver": {
        "vulnerable": [
          "<0.2.2"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "0.2.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "decode-uri-component",
      "references": [
        {
          "url": "https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/sindresorhus/query-string/issues/345",
          "title": "GitHub Issue"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-12-02T01:11:11.714842Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) due to improper input validation, when the hash string `# kun%ea%ba%5a%ba` is being parsed by `decodeUriComponent`.\r\n\r\n## PoC\r\n```js\r\nconst decodeUriComponent = require('decode-uri-component');\r\n\r\nvar x = decodeUriComponent('%ea%ba%5a%ba');\r\n\r\nconsole.log(x);\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `decode-uri-component` to version 0.2.2 or higher.\n## References\n- [GitHub Commit](https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152)\n- [GitHub Issue](https://github.com/SamVerschueren/decode-uri-component/issues/5)\n- [GitHub Issue](https://github.com/sindresorhus/query-string/issues/345)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-38900"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "decode-uri-component",
      "proprietary": false,
      "creationTime": "2022-11-28T14:24:36.010219Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-11-28T14:06:23Z",
      "packageManager": "npm",
      "publicationTime": "2022-11-28T16:12:34.614831Z",
      "modificationTime": "2022-12-02T09:02:03.162272Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "extglob@2.0.4",
        "snapdragon@0.8.2",
        "source-map-resolve@0.5.3",
        "decode-uri-component@0.2.0"
      ],
      "upgradePath": [
        false,
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "extglob@2.0.4",
        "snapdragon@0.8.2",
        "source-map-resolve@0.5.3",
        "decode-uri-component@0.2.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "decode-uri-component",
      "version": "0.2.0"
    },
    {
      "id": "SNYK-JS-DECODEURICOMPONENT-3149970",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "KatsuragiCSL"
      ],
      "semver": {
        "vulnerable": [
          "<0.2.2"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "0.2.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "decode-uri-component",
      "references": [
        {
          "url": "https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/sindresorhus/query-string/issues/345",
          "title": "GitHub Issue"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-12-02T01:11:11.714842Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) due to improper input validation, when the hash string `# kun%ea%ba%5a%ba` is being parsed by `decodeUriComponent`.\r\n\r\n## PoC\r\n```js\r\nconst decodeUriComponent = require('decode-uri-component');\r\n\r\nvar x = decodeUriComponent('%ea%ba%5a%ba');\r\n\r\nconsole.log(x);\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `decode-uri-component` to version 0.2.2 or higher.\n## References\n- [GitHub Commit](https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152)\n- [GitHub Issue](https://github.com/SamVerschueren/decode-uri-component/issues/5)\n- [GitHub Issue](https://github.com/sindresorhus/query-string/issues/345)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-38900"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "decode-uri-component",
      "proprietary": false,
      "creationTime": "2022-11-28T14:24:36.010219Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-11-28T14:06:23Z",
      "packageManager": "npm",
      "publicationTime": "2022-11-28T16:12:34.614831Z",
      "modificationTime": "2022-12-02T09:02:03.162272Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "nanomatch@1.2.13",
        "snapdragon@0.8.2",
        "source-map-resolve@0.5.3",
        "decode-uri-component@0.2.0"
      ],
      "upgradePath": [
        false,
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "nanomatch@1.2.13",
        "snapdragon@0.8.2",
        "source-map-resolve@0.5.3",
        "decode-uri-component@0.2.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "decode-uri-component",
      "version": "0.2.0"
    },
    {
      "id": "SNYK-JS-DECODEURICOMPONENT-3149970",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "KatsuragiCSL"
      ],
      "semver": {
        "vulnerable": [
          "<0.2.2"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "0.2.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "decode-uri-component",
      "references": [
        {
          "url": "https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/sindresorhus/query-string/issues/345",
          "title": "GitHub Issue"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-12-02T01:11:11.714842Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) due to improper input validation, when the hash string `# kun%ea%ba%5a%ba` is being parsed by `decodeUriComponent`.\r\n\r\n## PoC\r\n```js\r\nconst decodeUriComponent = require('decode-uri-component');\r\n\r\nvar x = decodeUriComponent('%ea%ba%5a%ba');\r\n\r\nconsole.log(x);\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `decode-uri-component` to version 0.2.2 or higher.\n## References\n- [GitHub Commit](https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152)\n- [GitHub Issue](https://github.com/SamVerschueren/decode-uri-component/issues/5)\n- [GitHub Issue](https://github.com/sindresorhus/query-string/issues/345)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-38900"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "decode-uri-component",
      "proprietary": false,
      "creationTime": "2022-11-28T14:24:36.010219Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-11-28T14:06:23Z",
      "packageManager": "npm",
      "publicationTime": "2022-11-28T16:12:34.614831Z",
      "modificationTime": "2022-12-02T09:02:03.162272Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "extglob@2.0.4",
        "expand-brackets@2.1.4",
        "snapdragon@0.8.2",
        "source-map-resolve@0.5.3",
        "decode-uri-component@0.2.0"
      ],
      "upgradePath": [
        false,
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "extglob@2.0.4",
        "expand-brackets@2.1.4",
        "snapdragon@0.8.2",
        "source-map-resolve@0.5.3",
        "decode-uri-component@0.2.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "decode-uri-component",
      "version": "0.2.0"
    },
    {
      "id": "SNYK-JS-DECOMPRESSTAR-559095",
      "title": "Arbitrary File Write via Archive Extraction (Zip Slip)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:U/RC:C",
      "credit": [
        "Oscar Arnflo"
      ],
      "semver": {
        "vulnerable": [
          "*"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 6.3,
      "functions": [
        {
          "version": [
            "*"
          ],
          "functionId": {
            "filePath": "index.js",
            "className": null,
            "functionName": "module.exports"
          }
        }
      ],
      "malicious": false,
      "moduleName": "decompress-tar",
      "references": [
        {
          "url": "https://github.com/kevva/decompress/pull/73",
          "title": "GitHub Fix PR"
        },
        {
          "url": "https://github.com/kevva/decompress/issues/71",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/kevva/decompress-tar/pull/12",
          "title": "GitHub PR decompress-tar"
        },
        {
          "url": "https://www.npmjs.com/advisories/1217",
          "title": "NPM Advisory"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "critical",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 9.8,
          "modificationTime": "2022-01-03T18:04:12.459024Z"
        }
      ],
      "description": "## Overview\n[decompress-tar](https://github.com/kevva/decompress-tar) is a tar plugin for decompress.\n\nAffected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). It is possible to bypass the security measures provided by decompress  and conduct ZIP path traversal through symlinks.\r\n\r\n### PoC\r\n\r\n```\r\nconst decompress = require('decompress');\r\n\r\ndecompress('slip.tar.gz', 'dist').then(files => {\r\n\tconsole.log('done!');\r\n});\r\n```\n\n## Details\n\nIt is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a \"../../file.exe\" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a zip archive with one benign file and one malicious file. Extracting the malicous file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n\n+2018-04-15 22:04:29 ..... 19 19 good.txt\n\n+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n\n```\n\n## Remediation\nThere is no fixed version for `decompress-tar`.\n## References\n- [GitHub Fix PR](https://github.com/kevva/decompress/pull/73)\n- [GitHub Issue](https://github.com/kevva/decompress/issues/71)\n- [GitHub PR decompress-tar](https://github.com/kevva/decompress-tar/pull/12)\n- [NPM Advisory](https://www.npmjs.com/advisories/1217)\n",
      "identifiers": {
        "CVE": [
          "CVE-2020-12265"
        ],
        "CWE": [
          "CWE-29"
        ],
        "NSP": [
          "1217"
        ],
        "GHSA": [
          "GHSA-qgfr-5hqp-vrw9"
        ]
      },
      "packageName": "decompress-tar",
      "proprietary": false,
      "creationTime": "2020-03-02T11:17:35.161853Z",
      "functions_new": [
        {
          "version": [
            "*"
          ],
          "functionId": {
            "filePath": "index.js",
            "functionName": "module.exports"
          }
        }
      ],
      "alternativeIds": [],
      "disclosureTime": "2019-10-15T20:29:24Z",
      "packageManager": "npm",
      "publicationTime": "2020-02-27T13:28:41Z",
      "modificationTime": "2022-01-03T18:04:12.459024Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "download@8.0.0",
        "decompress@4.2.1",
        "decompress-tar@4.1.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "decompress-tar",
      "version": "4.1.1"
    },
    {
      "id": "SNYK-JS-DECOMPRESSTAR-559095",
      "title": "Arbitrary File Write via Archive Extraction (Zip Slip)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:U/RC:C",
      "credit": [
        "Oscar Arnflo"
      ],
      "semver": {
        "vulnerable": [
          "*"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 6.3,
      "functions": [
        {
          "version": [
            "*"
          ],
          "functionId": {
            "filePath": "index.js",
            "className": null,
            "functionName": "module.exports"
          }
        }
      ],
      "malicious": false,
      "moduleName": "decompress-tar",
      "references": [
        {
          "url": "https://github.com/kevva/decompress/pull/73",
          "title": "GitHub Fix PR"
        },
        {
          "url": "https://github.com/kevva/decompress/issues/71",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/kevva/decompress-tar/pull/12",
          "title": "GitHub PR decompress-tar"
        },
        {
          "url": "https://www.npmjs.com/advisories/1217",
          "title": "NPM Advisory"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "critical",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 9.8,
          "modificationTime": "2022-01-03T18:04:12.459024Z"
        }
      ],
      "description": "## Overview\n[decompress-tar](https://github.com/kevva/decompress-tar) is a tar plugin for decompress.\n\nAffected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). It is possible to bypass the security measures provided by decompress  and conduct ZIP path traversal through symlinks.\r\n\r\n### PoC\r\n\r\n```\r\nconst decompress = require('decompress');\r\n\r\ndecompress('slip.tar.gz', 'dist').then(files => {\r\n\tconsole.log('done!');\r\n});\r\n```\n\n## Details\n\nIt is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a \"../../file.exe\" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a zip archive with one benign file and one malicious file. Extracting the malicous file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n\n+2018-04-15 22:04:29 ..... 19 19 good.txt\n\n+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n\n```\n\n## Remediation\nThere is no fixed version for `decompress-tar`.\n## References\n- [GitHub Fix PR](https://github.com/kevva/decompress/pull/73)\n- [GitHub Issue](https://github.com/kevva/decompress/issues/71)\n- [GitHub PR decompress-tar](https://github.com/kevva/decompress-tar/pull/12)\n- [NPM Advisory](https://www.npmjs.com/advisories/1217)\n",
      "identifiers": {
        "CVE": [
          "CVE-2020-12265"
        ],
        "CWE": [
          "CWE-29"
        ],
        "NSP": [
          "1217"
        ],
        "GHSA": [
          "GHSA-qgfr-5hqp-vrw9"
        ]
      },
      "packageName": "decompress-tar",
      "proprietary": false,
      "creationTime": "2020-03-02T11:17:35.161853Z",
      "functions_new": [
        {
          "version": [
            "*"
          ],
          "functionId": {
            "filePath": "index.js",
            "functionName": "module.exports"
          }
        }
      ],
      "alternativeIds": [],
      "disclosureTime": "2019-10-15T20:29:24Z",
      "packageManager": "npm",
      "publicationTime": "2020-02-27T13:28:41Z",
      "modificationTime": "2022-01-03T18:04:12.459024Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "download@8.0.0",
        "decompress@4.2.1",
        "decompress-tarbz2@4.1.1",
        "decompress-tar@4.1.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "decompress-tar",
      "version": "4.1.1"
    },
    {
      "id": "SNYK-JS-DECOMPRESSTAR-559095",
      "title": "Arbitrary File Write via Archive Extraction (Zip Slip)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:U/RC:C",
      "credit": [
        "Oscar Arnflo"
      ],
      "semver": {
        "vulnerable": [
          "*"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 6.3,
      "functions": [
        {
          "version": [
            "*"
          ],
          "functionId": {
            "filePath": "index.js",
            "className": null,
            "functionName": "module.exports"
          }
        }
      ],
      "malicious": false,
      "moduleName": "decompress-tar",
      "references": [
        {
          "url": "https://github.com/kevva/decompress/pull/73",
          "title": "GitHub Fix PR"
        },
        {
          "url": "https://github.com/kevva/decompress/issues/71",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/kevva/decompress-tar/pull/12",
          "title": "GitHub PR decompress-tar"
        },
        {
          "url": "https://www.npmjs.com/advisories/1217",
          "title": "NPM Advisory"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "critical",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 9.8,
          "modificationTime": "2022-01-03T18:04:12.459024Z"
        }
      ],
      "description": "## Overview\n[decompress-tar](https://github.com/kevva/decompress-tar) is a tar plugin for decompress.\n\nAffected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). It is possible to bypass the security measures provided by decompress  and conduct ZIP path traversal through symlinks.\r\n\r\n### PoC\r\n\r\n```\r\nconst decompress = require('decompress');\r\n\r\ndecompress('slip.tar.gz', 'dist').then(files => {\r\n\tconsole.log('done!');\r\n});\r\n```\n\n## Details\n\nIt is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a \"../../file.exe\" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a zip archive with one benign file and one malicious file. Extracting the malicous file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n\n+2018-04-15 22:04:29 ..... 19 19 good.txt\n\n+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n\n```\n\n## Remediation\nThere is no fixed version for `decompress-tar`.\n## References\n- [GitHub Fix PR](https://github.com/kevva/decompress/pull/73)\n- [GitHub Issue](https://github.com/kevva/decompress/issues/71)\n- [GitHub PR decompress-tar](https://github.com/kevva/decompress-tar/pull/12)\n- [NPM Advisory](https://www.npmjs.com/advisories/1217)\n",
      "identifiers": {
        "CVE": [
          "CVE-2020-12265"
        ],
        "CWE": [
          "CWE-29"
        ],
        "NSP": [
          "1217"
        ],
        "GHSA": [
          "GHSA-qgfr-5hqp-vrw9"
        ]
      },
      "packageName": "decompress-tar",
      "proprietary": false,
      "creationTime": "2020-03-02T11:17:35.161853Z",
      "functions_new": [
        {
          "version": [
            "*"
          ],
          "functionId": {
            "filePath": "index.js",
            "functionName": "module.exports"
          }
        }
      ],
      "alternativeIds": [],
      "disclosureTime": "2019-10-15T20:29:24Z",
      "packageManager": "npm",
      "publicationTime": "2020-02-27T13:28:41Z",
      "modificationTime": "2022-01-03T18:04:12.459024Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "download@8.0.0",
        "decompress@4.2.1",
        "decompress-targz@4.1.1",
        "decompress-tar@4.1.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "decompress-tar",
      "version": "4.1.1"
    },
    {
      "id": "SNYK-JS-DICER-2311764",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C",
      "credit": [
        "Aras Abbasi"
      ],
      "semver": {
        "vulnerable": [
          "*"
        ]
      },
      "exploit": "Functional",
      "fixedIn": [],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "dicer",
      "references": [
        {
          "url": "https://github.com/mscdex/dicer/pull/22/commits/b7fca2e93e8e9d4439d8acc5c02f5e54a0112dac",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/mscdex/busboy/issues/250",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/mscdex/dicer/pull/22",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-06-07T13:11:23.181321Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.\r\n\r\n## PoC:\r\n```js\r\n    fetch('form-image', {\r\n      method: 'POST',\r\n      headers: {\r\n        ['content-type']: 'multipart/form-data; boundary=----WebKitFormBoundaryoo6vortfDzBsDiro',\r\n        ['content-length']: '145',\r\n        host: '127.0.0.1:8000',\r\n        connection: 'keep-alive',\r\n      },\r\n      body: '------WebKitFormBoundaryoo6vortfDzBsDiro\\r\\n Content-Disposition: form-data; name=\"bildbeschreibung\"\\r\\n\\r\\n\\r\\n------WebKitFormBoundaryoo6vortfDzBsDiro--'\r\n    });\r\n```\n## Remediation\nThere is no fixed version for `dicer`.\n## References\n- [GitHub Commit](https://github.com/mscdex/dicer/pull/22/commits/b7fca2e93e8e9d4439d8acc5c02f5e54a0112dac)\n- [GitHub Issue](https://github.com/mscdex/busboy/issues/250)\n- [GitHub PR](https://github.com/mscdex/dicer/pull/22)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-24434"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "dicer",
      "proprietary": true,
      "creationTime": "2021-12-07T14:51:46.208362Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-12-07T14:51:02Z",
      "packageManager": "npm",
      "publicationTime": "2022-05-19T10:52:23Z",
      "modificationTime": "2022-06-09T21:50:31.265376Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "multer@1.4.4",
        "busboy@0.2.14",
        "dicer@0.2.5"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "dicer",
      "version": "0.2.5"
    },
    {
      "id": "SNYK-JS-EIVINDFJELDSTADDOT-564434",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
      "credit": [
        "JHU System Security Lab"
      ],
      "semver": {
        "vulnerable": [
          "*"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 4.2,
      "functions": [],
      "malicious": false,
      "moduleName": "eivindfjeldstad-dot",
      "references": [
        {
          "url": "https://github.com/eivindfjeldstad/dot/commit/774e4b0c97ca35d2ae40df2cd14428d37dd07a0b",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "cvssV3BaseScore": 5.3,
          "modificationTime": "2022-01-03T18:10:07.420105Z"
        }
      ],
      "description": "## Overview\n[eivindfjeldstad-dot](https://www.npmjs.com/package/eivindfjeldstad-dot) is a module that Gets and sets object properties with dot notation.\r\n\r\n**Note:** this package has been deprecated and moved into `@eivifj/dot`.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The function `set` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.\r\n\r\n## PoC\r\n```\r\nvar a = require(\"eivindfjeldstad-dot\")\r\nvar path = \"__proto__.toString\";\r\na.set({},path,\"JHU\");\r\nconsole.log({}.toString);\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `eivindfjeldstad-dot`.\n## References\n- [GitHub Commit](https://github.com/eivindfjeldstad/dot/commit/774e4b0c97ca35d2ae40df2cd14428d37dd07a0b)\n",
      "identifiers": {
        "CVE": [
          "CVE-2020-7639"
        ],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "eivindfjeldstad-dot",
      "proprietary": true,
      "creationTime": "2020-04-05T14:48:43.897856Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2020-04-05T00:00:00Z",
      "packageManager": "npm",
      "publicationTime": "2020-04-05T00:00:00Z",
      "modificationTime": "2022-08-25T12:14:41.018488Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "yaml-schema-validator@1.2.3",
        "validate@4.5.1",
        "eivindfjeldstad-dot@0.0.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "eivindfjeldstad-dot",
      "version": "0.0.1"
    },
    {
      "id": "SNYK-JS-ENGINEIO-1056749",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:R",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<4.0.0"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "4.0.0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "engine.io",
      "references": [
        {
          "url": "https://github.com/socketio/engine.io/commit/734f9d1268840722c41219e69eb58318e0b2ac6b",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/bcaller/kill-engine-io",
          "title": "PoC"
        },
        {
          "url": "https://blog.caller.xyz/socketio-engineio-dos/",
          "title": "Research Blogpost"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-01-03T18:09:21.542175Z"
        }
      ],
      "description": "## Overview\n[engine.io](https://github.com/socketio/engine.io) is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via a POST request to the long polling transport.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `engine.io` to version 4.0.0 or higher.\n## References\n- [GitHub Commit](https://github.com/socketio/engine.io/commit/734f9d1268840722c41219e69eb58318e0b2ac6b)\n- [PoC](https://github.com/bcaller/kill-engine-io)\n- [Research Blogpost](https://blog.caller.xyz/socketio-engineio-dos/)\n",
      "identifiers": {
        "CVE": [
          "CVE-2020-36048"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "engine.io",
      "proprietary": false,
      "creationTime": "2021-01-08T10:58:56.558133Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-01-08T10:54:39Z",
      "packageManager": "npm",
      "publicationTime": "2021-01-08T16:03:18.114498Z",
      "modificationTime": "2022-01-03T18:09:21.542175Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "socket.io@2.4.1",
        "engine.io@3.5.0"
      ],
      "upgradePath": [
        false,
        "socket.io@3.0.0",
        "engine.io@4.0.0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "engine.io",
      "version": "3.5.0"
    },
    {
      "id": "SNYK-JS-ENGINEIO-3136336",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "Jonathan Neve"
      ],
      "semver": {
        "vulnerable": [
          "<3.6.1",
          ">=4.0.0 <6.2.1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.6.1",
        "6.2.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "engine.io",
      "references": [
        {
          "url": "https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/socketio/engine.io/pull/658",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 6.5,
          "modificationTime": "2022-11-26T13:10:42.027902Z"
        }
      ],
      "description": "## Overview\n[engine.io](https://github.com/socketio/engine.io) is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the `Node.js` process.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `engine.io` to version 3.6.1, 6.2.1 or higher.\n## References\n- [GitHub Commit](https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6)\n- [GitHub Commit](https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085)\n- [GitHub PR](https://github.com/socketio/engine.io/pull/658)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-41940"
        ],
        "CWE": [
          "CWE-400"
        ],
        "GHSA": [
          "GHSA-r7qp-cfhv-p84w"
        ]
      },
      "packageName": "engine.io",
      "proprietary": false,
      "creationTime": "2022-11-21T14:00:03.277453Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-11-21T13:55:28Z",
      "packageManager": "npm",
      "publicationTime": "2022-11-21T14:00:42.363779Z",
      "modificationTime": "2022-12-05T15:31:11.918126Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "socket.io@2.4.1",
        "engine.io@3.5.0"
      ],
      "upgradePath": [
        false,
        "socket.io@2.5.0",
        "engine.io@3.6.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "engine.io",
      "version": "3.5.0"
    },
    {
      "id": "SNYK-JS-EXPRESSJWT-575022",
      "title": "Authorization Bypass",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "credit": [
        "IST Group"
      ],
      "semver": {
        "vulnerable": [
          "<6.0.0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "6.0.0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.4,
      "functions": [],
      "malicious": false,
      "moduleName": "express-jwt",
      "references": [
        {
          "url": "https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "critical",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "cvssV3BaseScore": 9.1,
          "modificationTime": "2022-10-22T01:10:30.246806Z"
        }
      ],
      "description": "## Overview\n[express-jwt](https://www.npmjs.com/package/express-jwt) is a JWT authentication middleware.\n\nAffected versions of this package are vulnerable to Authorization Bypass. The `algorithms` entry to be specified in the configuration is not being enforced. When `algorithms` is not specified in the configuration, with the combination of `jwks-rsa`, it may lead to authorization bypass.\n## Remediation\nUpgrade `express-jwt` to version 6.0.0 or higher.\n## References\n- [GitHub Commit](https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef)\n",
      "identifiers": {
        "CVE": [
          "CVE-2020-15084"
        ],
        "CWE": [
          "CWE-285"
        ],
        "GHSA": [
          "GHSA-6g6m-m6h5-w9gf"
        ]
      },
      "packageName": "express-jwt",
      "proprietary": false,
      "creationTime": "2020-07-01T09:33:11.790635Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2020-07-01T09:30:03Z",
      "packageManager": "npm",
      "publicationTime": "2020-07-01T15:32:36Z",
      "modificationTime": "2022-10-22T01:10:30.246806Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "express-jwt@0.1.3"
      ],
      "upgradePath": [
        false,
        "express-jwt@6.0.0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "express-jwt",
      "version": "0.1.3"
    },
    {
      "id": "SNYK-JS-FILETYPE-2958042",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<16.5.4",
          ">=17.0.0 <17.1.3"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "16.5.4",
        "17.1.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "file-type",
      "references": [
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
          "title": "GitHub 16.5.4 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
          "title": "GitHub 17.1.3 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 5.5,
          "modificationTime": "2022-10-28T01:10:26.023002Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `file-type` to version 16.5.4, 17.1.3 or higher.\n## References\n- [GitHub 16.5.4 Release](https://github.com/sindresorhus/file-type/releases/tag/v16.5.4)\n- [GitHub 17.1.3 Release](https://github.com/sindresorhus/file-type/releases/tag/v17.1.3)\n- [GitHub Commit](https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-36313"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "file-type",
      "proprietary": false,
      "creationTime": "2022-07-22T06:18:14.062685Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-22T06:15:46Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-22T06:18:14Z",
      "modificationTime": "2022-10-28T01:10:26.023002Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "download@8.0.0",
        "archive-type@4.0.0",
        "file-type@4.4.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "file-type",
      "version": "4.4.0"
    },
    {
      "id": "SNYK-JS-FILETYPE-2958042",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<16.5.4",
          ">=17.0.0 <17.1.3"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "16.5.4",
        "17.1.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "file-type",
      "references": [
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
          "title": "GitHub 16.5.4 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
          "title": "GitHub 17.1.3 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 5.5,
          "modificationTime": "2022-10-28T01:10:26.023002Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `file-type` to version 16.5.4, 17.1.3 or higher.\n## References\n- [GitHub 16.5.4 Release](https://github.com/sindresorhus/file-type/releases/tag/v16.5.4)\n- [GitHub 17.1.3 Release](https://github.com/sindresorhus/file-type/releases/tag/v17.1.3)\n- [GitHub Commit](https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-36313"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "file-type",
      "proprietary": false,
      "creationTime": "2022-07-22T06:18:14.062685Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-22T06:15:46Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-22T06:18:14Z",
      "modificationTime": "2022-10-28T01:10:26.023002Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "download@8.0.0",
        "decompress@4.2.1",
        "decompress-tar@4.1.1",
        "file-type@5.2.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "file-type",
      "version": "5.2.0"
    },
    {
      "id": "SNYK-JS-FILETYPE-2958042",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<16.5.4",
          ">=17.0.0 <17.1.3"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "16.5.4",
        "17.1.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "file-type",
      "references": [
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
          "title": "GitHub 16.5.4 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
          "title": "GitHub 17.1.3 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 5.5,
          "modificationTime": "2022-10-28T01:10:26.023002Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `file-type` to version 16.5.4, 17.1.3 or higher.\n## References\n- [GitHub 16.5.4 Release](https://github.com/sindresorhus/file-type/releases/tag/v16.5.4)\n- [GitHub 17.1.3 Release](https://github.com/sindresorhus/file-type/releases/tag/v17.1.3)\n- [GitHub Commit](https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-36313"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "file-type",
      "proprietary": false,
      "creationTime": "2022-07-22T06:18:14.062685Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-22T06:15:46Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-22T06:18:14Z",
      "modificationTime": "2022-10-28T01:10:26.023002Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "download@8.0.0",
        "decompress@4.2.1",
        "decompress-targz@4.1.1",
        "file-type@5.2.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "file-type",
      "version": "5.2.0"
    },
    {
      "id": "SNYK-JS-FILETYPE-2958042",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<16.5.4",
          ">=17.0.0 <17.1.3"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "16.5.4",
        "17.1.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "file-type",
      "references": [
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
          "title": "GitHub 16.5.4 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
          "title": "GitHub 17.1.3 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 5.5,
          "modificationTime": "2022-10-28T01:10:26.023002Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `file-type` to version 16.5.4, 17.1.3 or higher.\n## References\n- [GitHub 16.5.4 Release](https://github.com/sindresorhus/file-type/releases/tag/v16.5.4)\n- [GitHub 17.1.3 Release](https://github.com/sindresorhus/file-type/releases/tag/v17.1.3)\n- [GitHub Commit](https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-36313"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "file-type",
      "proprietary": false,
      "creationTime": "2022-07-22T06:18:14.062685Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-22T06:15:46Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-22T06:18:14Z",
      "modificationTime": "2022-10-28T01:10:26.023002Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "download@8.0.0",
        "decompress@4.2.1",
        "decompress-tarbz2@4.1.1",
        "decompress-tar@4.1.1",
        "file-type@5.2.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "file-type",
      "version": "5.2.0"
    },
    {
      "id": "SNYK-JS-FILETYPE-2958042",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<16.5.4",
          ">=17.0.0 <17.1.3"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "16.5.4",
        "17.1.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "file-type",
      "references": [
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
          "title": "GitHub 16.5.4 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
          "title": "GitHub 17.1.3 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 5.5,
          "modificationTime": "2022-10-28T01:10:26.023002Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `file-type` to version 16.5.4, 17.1.3 or higher.\n## References\n- [GitHub 16.5.4 Release](https://github.com/sindresorhus/file-type/releases/tag/v16.5.4)\n- [GitHub 17.1.3 Release](https://github.com/sindresorhus/file-type/releases/tag/v17.1.3)\n- [GitHub Commit](https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-36313"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "file-type",
      "proprietary": false,
      "creationTime": "2022-07-22T06:18:14.062685Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-22T06:15:46Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-22T06:18:14Z",
      "modificationTime": "2022-10-28T01:10:26.023002Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "download@8.0.0",
        "decompress@4.2.1",
        "decompress-targz@4.1.1",
        "decompress-tar@4.1.1",
        "file-type@5.2.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "file-type",
      "version": "5.2.0"
    },
    {
      "id": "SNYK-JS-FILETYPE-2958042",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<16.5.4",
          ">=17.0.0 <17.1.3"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "16.5.4",
        "17.1.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "file-type",
      "references": [
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
          "title": "GitHub 16.5.4 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
          "title": "GitHub 17.1.3 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 5.5,
          "modificationTime": "2022-10-28T01:10:26.023002Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `file-type` to version 16.5.4, 17.1.3 or higher.\n## References\n- [GitHub 16.5.4 Release](https://github.com/sindresorhus/file-type/releases/tag/v16.5.4)\n- [GitHub 17.1.3 Release](https://github.com/sindresorhus/file-type/releases/tag/v17.1.3)\n- [GitHub Commit](https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-36313"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "file-type",
      "proprietary": false,
      "creationTime": "2022-07-22T06:18:14.062685Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-22T06:15:46Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-22T06:18:14Z",
      "modificationTime": "2022-10-28T01:10:26.023002Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "download@8.0.0",
        "decompress@4.2.1",
        "decompress-tarbz2@4.1.1",
        "file-type@6.2.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "file-type",
      "version": "6.2.0"
    },
    {
      "id": "SNYK-JS-FILETYPE-2958042",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<16.5.4",
          ">=17.0.0 <17.1.3"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "16.5.4",
        "17.1.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "file-type",
      "references": [
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
          "title": "GitHub 16.5.4 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
          "title": "GitHub 17.1.3 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 5.5,
          "modificationTime": "2022-10-28T01:10:26.023002Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `file-type` to version 16.5.4, 17.1.3 or higher.\n## References\n- [GitHub 16.5.4 Release](https://github.com/sindresorhus/file-type/releases/tag/v16.5.4)\n- [GitHub 17.1.3 Release](https://github.com/sindresorhus/file-type/releases/tag/v17.1.3)\n- [GitHub Commit](https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-36313"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "file-type",
      "proprietary": false,
      "creationTime": "2022-07-22T06:18:14.062685Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-22T06:15:46Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-22T06:18:14Z",
      "modificationTime": "2022-10-28T01:10:26.023002Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "download@8.0.0",
        "decompress@4.2.1",
        "decompress-unzip@4.0.1",
        "file-type@3.9.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "file-type",
      "version": "3.9.0"
    },
    {
      "id": "SNYK-JS-FILETYPE-2958042",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<16.5.4",
          ">=17.0.0 <17.1.3"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "16.5.4",
        "17.1.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "file-type",
      "references": [
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
          "title": "GitHub 16.5.4 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
          "title": "GitHub 17.1.3 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 5.5,
          "modificationTime": "2022-10-28T01:10:26.023002Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `file-type` to version 16.5.4, 17.1.3 or higher.\n## References\n- [GitHub 16.5.4 Release](https://github.com/sindresorhus/file-type/releases/tag/v16.5.4)\n- [GitHub 17.1.3 Release](https://github.com/sindresorhus/file-type/releases/tag/v17.1.3)\n- [GitHub Commit](https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-36313"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "file-type",
      "proprietary": false,
      "creationTime": "2022-07-22T06:18:14.062685Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-22T06:15:46Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-22T06:18:14Z",
      "modificationTime": "2022-10-28T01:10:26.023002Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "download@8.0.0",
        "file-type@11.1.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "file-type",
      "version": "11.1.0"
    },
    {
      "id": "SNYK-JS-FILETYPE-2958042",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<16.5.4",
          ">=17.0.0 <17.1.3"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "16.5.4",
        "17.1.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "file-type",
      "references": [
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v16.5.4",
          "title": "GitHub 16.5.4 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/releases/tag/v17.1.3",
          "title": "GitHub 17.1.3 Release"
        },
        {
          "url": "https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 5.5,
          "modificationTime": "2022-10-28T01:10:26.023002Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `file-type` to version 16.5.4, 17.1.3 or higher.\n## References\n- [GitHub 16.5.4 Release](https://github.com/sindresorhus/file-type/releases/tag/v16.5.4)\n- [GitHub 17.1.3 Release](https://github.com/sindresorhus/file-type/releases/tag/v17.1.3)\n- [GitHub Commit](https://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-36313"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "file-type",
      "proprietary": false,
      "creationTime": "2022-07-22T06:18:14.062685Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-22T06:15:46Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-22T06:18:14Z",
      "modificationTime": "2022-10-28T01:10:26.023002Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "file-type@12.4.2"
      ],
      "upgradePath": [
        false,
        "file-type@16.5.4"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "file-type",
      "version": "12.4.2"
    },
    {
      "id": "SNYK-JS-GOT-2932019",
      "title": "Open Redirect",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<11.8.5",
          ">=12.0.0 <12.1.0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "11.8.5",
        "12.1.0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.4,
      "functions": [],
      "malicious": false,
      "moduleName": "got",
      "references": [
        {
          "url": "https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0",
          "title": "GitHub Diff"
        },
        {
          "url": "https://github.com/sindresorhus/got/pull/2047",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "cvssV3BaseScore": 5.3,
          "modificationTime": "2022-06-29T01:11:26.531842Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "cvssV3BaseScore": 5.3,
          "modificationTime": "2022-11-19T20:57:05.871669Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Open Redirect due to missing verification of requested URLs. It allowed a victim to be redirected to a UNIX socket.\n## Remediation\nUpgrade `got` to version 11.8.5, 12.1.0 or higher.\n## References\n- [GitHub Diff](https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0)\n- [GitHub PR](https://github.com/sindresorhus/got/pull/2047)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-33987"
        ],
        "CWE": [
          "CWE-601"
        ]
      },
      "packageName": "got",
      "proprietary": false,
      "creationTime": "2022-06-19T09:23:24.210132Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-06-19T08:33:16Z",
      "packageManager": "npm",
      "publicationTime": "2022-06-19T15:33:44.269688Z",
      "modificationTime": "2022-11-19T20:57:05.871669Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "download@8.0.0",
        "got@8.3.2"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "got",
      "version": "8.3.2"
    },
    {
      "id": "SNYK-JS-GRUNT-2635969",
      "title": "Directory Traversal",
      "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P",
      "credit": [
        "haxatron"
      ],
      "semver": {
        "vulnerable": [
          "<1.5.0"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "1.5.0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 6.3,
      "functions": [],
      "malicious": false,
      "moduleName": "grunt",
      "references": [
        {
          "url": "https://github.com/gruntjs/grunt/commit/aad3d4521c3098fb255fb2db8f2e1d691a033665",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/gruntjs/grunt/pull/1740",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "cvssV3BaseScore": 5.5,
          "modificationTime": "2022-04-21T01:11:17.961366Z"
        }
      ],
      "description": "## Overview\n[grunt](https://www.npmjs.com/package/grunt) is a JavaScript task runner.\n\nAffected versions of this package are vulnerable to Directory Traversal via creation of a symlink to a restricted file, if a local attacker has `write` access to the source directory of `file.copy`\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `grunt` to version 1.5.0 or higher.\n## References\n- [GitHub Commit](https://github.com/gruntjs/grunt/commit/aad3d4521c3098fb255fb2db8f2e1d691a033665)\n- [GitHub PR](https://github.com/gruntjs/grunt/pull/1740)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-0436"
        ],
        "CWE": [
          "CWE-22"
        ]
      },
      "packageName": "grunt",
      "proprietary": false,
      "creationTime": "2022-04-13T12:47:39.206383Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-04-13T12:40:04Z",
      "packageManager": "npm",
      "publicationTime": "2022-04-13T12:57:58Z",
      "modificationTime": "2022-04-21T01:11:17.961366Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "grunt@1.4.1"
      ],
      "upgradePath": [
        false,
        "grunt@1.5.0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "grunt",
      "version": "1.4.1"
    },
    {
      "id": "SNYK-JS-GRUNT-2813632",
      "title": "Race Condition",
      "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H/E:P",
      "credit": [
        "haxatron"
      ],
      "semver": {
        "vulnerable": [
          "<1.5.3"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "1.5.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 6.5,
      "functions": [],
      "malicious": false,
      "moduleName": "grunt",
      "references": [
        {
          "url": "https://github.com/gruntjs/grunt/commit/58016ffac5ed9338b63ecc2a63710f5027362bae",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/gruntjs/grunt/pull/1745",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 7,
          "modificationTime": "2022-05-17T01:11:10.453582Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 7.8,
          "modificationTime": "2022-11-27T21:33:11.058635Z"
        }
      ],
      "description": "## Overview\n[grunt](https://www.npmjs.com/package/grunt) is a JavaScript task runner.\n\nAffected versions of this package are vulnerable to Race Condition via the `file.copy` operations. Exploiting this vulnerability leads to arbitrary file writing when an attacker can create a symlink just after deletion of the destination symlink, but right before the symlink is being written.\n## Remediation\nUpgrade `grunt` to version 1.5.3 or higher.\n## References\n- [GitHub Commit](https://github.com/gruntjs/grunt/commit/58016ffac5ed9338b63ecc2a63710f5027362bae)\n- [GitHub PR](https://github.com/gruntjs/grunt/pull/1745)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-1537"
        ],
        "CWE": [
          "CWE-362"
        ]
      },
      "packageName": "grunt",
      "proprietary": false,
      "creationTime": "2022-05-11T08:47:11.618638Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-05-11T08:34:08Z",
      "packageManager": "npm",
      "publicationTime": "2022-05-11T14:15:53Z",
      "modificationTime": "2022-11-27T21:33:11.058635Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "grunt@1.4.1"
      ],
      "upgradePath": [
        false,
        "grunt@1.5.3"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "grunt",
      "version": "1.4.1"
    },
    {
      "id": "SNYK-JS-LODASH-1018905",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P",
      "credit": [
        "Liyuan Chen"
      ],
      "semver": {
        "vulnerable": [
          "<4.17.21"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "4.17.21"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "lodash",
      "references": [
        {
          "url": "https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/lodash/lodash/pull/5065",
          "title": "GitHub Fix PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "cvssV3BaseScore": 5.3,
          "modificationTime": "2022-09-14T01:10:48.134557Z"
        }
      ],
      "description": "## Overview\n[lodash](https://www.npmjs.com/package/lodash) is a modern JavaScript utility library delivering modularity, performance, & extras.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions.\r\n\r\n### POC\r\n```\r\nvar lo = require('lodash');\r\n\r\nfunction build_blank (n) {\r\nvar ret = \"1\"\r\nfor (var i = 0; i < n; i++) {\r\nret += \" \"\r\n}\r\n\r\nreturn ret + \"1\";\r\n}\r\n\r\nvar s = build_blank(50000)\r\nvar time0 = Date.now();\r\nlo.trim(s)\r\nvar time_cost0 = Date.now() - time0;\r\nconsole.log(\"time_cost0: \" + time_cost0)\r\n\r\nvar time1 = Date.now();\r\nlo.toNumber(s)\r\nvar time_cost1 = Date.now() - time1;\r\nconsole.log(\"time_cost1: \" + time_cost1)\r\n\r\nvar time2 = Date.now();\r\nlo.trimEnd(s)\r\nvar time_cost2 = Date.now() - time2;\r\nconsole.log(\"time_cost2: \" + time_cost2)\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `lodash` to version 4.17.21 or higher.\n## References\n- [GitHub Commit](https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a)\n- [GitHub Fix PR](https://github.com/lodash/lodash/pull/5065)\n",
      "identifiers": {
        "CVE": [
          "CVE-2020-28500"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "lodash",
      "proprietary": true,
      "creationTime": "2020-10-16T16:48:40.985673Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2020-10-16T16:47:34Z",
      "packageManager": "npm",
      "publicationTime": "2021-02-15T11:50:49Z",
      "modificationTime": "2022-09-14T01:10:48.134557Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2",
        "lodash@2.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@1.7.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "lodash",
      "version": "2.4.2"
    },
    {
      "id": "SNYK-JS-LODASH-1040724",
      "title": "Command Injection",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C",
      "credit": [
        "Marc Hassan"
      ],
      "semver": {
        "vulnerable": [
          "<4.17.21"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "4.17.21"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.2,
      "functions": [],
      "malicious": false,
      "moduleName": "lodash",
      "references": [
        {
          "url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851",
          "title": "Vulnerable Code"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 7.2,
          "modificationTime": "2022-09-14T01:10:48.257735Z"
        }
      ],
      "description": "## Overview\n[lodash](https://www.npmjs.com/package/lodash) is a modern JavaScript utility library delivering modularity, performance, & extras.\n\nAffected versions of this package are vulnerable to Command Injection via `template`.\r\n\r\n### PoC\r\n```js\r\nvar _ = require('lodash');\r\n\r\n_.template('', { variable: '){console.log(process.env)}; with(obj' })()\r\n```\n## Remediation\nUpgrade `lodash` to version 4.17.21 or higher.\n## References\n- [GitHub Commit](https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c)\n- [Vulnerable Code](https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-23337"
        ],
        "CWE": [
          "CWE-78"
        ],
        "GHSA": [
          "GHSA-35jh-r3h4-6jhm"
        ]
      },
      "packageName": "lodash",
      "proprietary": true,
      "creationTime": "2020-11-17T14:07:17.048472Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2020-11-17T13:02:10Z",
      "packageManager": "npm",
      "publicationTime": "2021-02-15T11:50:50Z",
      "modificationTime": "2022-09-14T01:10:48.257735Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2",
        "lodash@2.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@1.7.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "lodash",
      "version": "2.4.2"
    },
    {
      "id": "SNYK-JS-LODASH-450202",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
      "credit": [
        "Snyk Security Team"
      ],
      "semver": {
        "vulnerable": [
          "<4.17.12"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "4.17.12"
      ],
      "patches": [
        {
          "id": "patch:SNYK-JS-LODASH-450202:0",
          "urls": [
            "https://snyk-patches.s3.amazonaws.com/npm/lodash/20190702/lodash_20190702_0_0_1f8ea07746963a535385a5befc19fa687a627d2b.patch"
          ],
          "version": "=4.17.11",
          "comments": [],
          "modificationTime": "2019-12-03T11:40:45.719849Z"
        }
      ],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.3,
      "functions": [
        {
          "version": [
            ">=4.17.3 <4.17.12"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "className": null,
            "functionName": "runInContext.customDefaultsMerge"
          }
        }
      ],
      "malicious": false,
      "moduleName": "lodash",
      "references": [
        {
          "url": "https://github.com/lodash/lodash/issues/4348",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/lodash/lodash/pull/4336",
          "title": "GitHub PR"
        },
        {
          "url": "https://github.com/lodash/lodash/pull/4355",
          "title": "GitHub PR"
        },
        {
          "url": "https://github.com/sailshq/lodash/pull/1",
          "title": "GitHub PR"
        },
        {
          "url": "https://www.npmjs.com/advisories/1065",
          "title": "Node Security Advisory"
        },
        {
          "url": "https://snyk.io/blog/snyk-research-team-discovers-severe-prototype-pollution-security-vulnerabilities-affecting-all-versions-of-lodash/",
          "title": "Snyk Blog"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "critical",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 9.1,
          "modificationTime": "2022-01-03T17:53:52.560412Z"
        }
      ],
      "description": "## Overview\n[lodash](https://www.npmjs.com/package/lodash) is a modern JavaScript utility library delivering modularity, performance, & extras.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The function `defaultsDeep` could be tricked into adding or modifying properties of `Object.prototype` using a `constructor` payload.\r\n\r\n## PoC by Snyk\r\n```\r\nconst mergeFn = require('lodash').defaultsDeep;\r\nconst payload = '{\"constructor\": {\"prototype\": {\"a0\": true}}}'\r\n\r\nfunction check() {\r\n    mergeFn({}, JSON.parse(payload));\r\n    if (({})[`a0`] === true) {\r\n        console.log(`Vulnerable to Prototype Pollution via ${payload}`);\r\n    }\r\n  }\r\n\r\ncheck();\r\n```\r\n\r\nFor more information, check out our [blog post](https://snyk.io/blog/snyk-research-team-discovers-severe-prototype-pollution-security-vulnerabilities-affecting-all-versions-of-lodash/)\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `lodash` to version 4.17.12 or higher.\n## References\n- [GitHub Issue](https://github.com/lodash/lodash/issues/4348)\n- [GitHub PR](https://github.com/lodash/lodash/pull/4336)\n- [GitHub PR](https://github.com/lodash/lodash/pull/4355)\n- [GitHub PR](https://github.com/sailshq/lodash/pull/1)\n- [Node Security Advisory](https://www.npmjs.com/advisories/1065)\n- [Snyk Blog](https://snyk.io/blog/snyk-research-team-discovers-severe-prototype-pollution-security-vulnerabilities-affecting-all-versions-of-lodash/)\n",
      "identifiers": {
        "CVE": [
          "CVE-2019-10744"
        ],
        "CWE": [
          "CWE-1321"
        ],
        "NSP": [
          "1065"
        ],
        "GHSA": [
          "GHSA-jf85-cpcp-j695"
        ]
      },
      "packageName": "lodash",
      "proprietary": true,
      "creationTime": "2019-06-19T12:04:21.040000Z",
      "functions_new": [
        {
          "version": [
            ">=4.17.3 <4.17.12"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "functionName": "runInContext.customDefaultsMerge"
          }
        }
      ],
      "alternativeIds": [],
      "disclosureTime": "2019-06-19T11:45:02Z",
      "packageManager": "npm",
      "publicationTime": "2019-07-02T11:45:01Z",
      "modificationTime": "2022-08-25T12:14:41.065285Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2",
        "lodash@2.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@1.7.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "lodash",
      "version": "2.4.2"
    },
    {
      "id": "SNYK-JS-LODASH-567746",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P/RL:U/RC:C",
      "credit": [
        "posix"
      ],
      "semver": {
        "vulnerable": [
          "<4.17.20"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "4.17.20"
      ],
      "patches": [
        {
          "id": "patch:SNYK-JS-LODASH-567746:0",
          "urls": [
            "https://snyk-patches.s3.amazonaws.com/npm/lodash/20200430/lodash_0_0_20200430_6baae67d501e4c45021280876d42efe351e77551.patch"
          ],
          "version": ">=4.14.2",
          "comments": [],
          "modificationTime": "2020-04-30T14:28:46.729327Z"
        }
      ],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 8.2,
      "functions": [],
      "malicious": false,
      "moduleName": "lodash",
      "references": [
        {
          "url": "https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/lodash/lodash/pull/4759",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2022-05-13T01:10:54.704725Z"
        }
      ],
      "description": "## Overview\n[lodash](https://www.npmjs.com/package/lodash) is a modern JavaScript utility library delivering modularity, performance, & extras.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The function `zipObjectDeep` can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects.\r\n\r\n## PoC\r\n```\r\nconst _ = require('lodash');\r\n_.zipObjectDeep(['__proto__.z'],[123])\r\nconsole.log(z) // 123\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `lodash` to version 4.17.20 or higher.\n## References\n- [GitHub Commit](https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12)\n- [GitHub PR](https://github.com/lodash/lodash/pull/4759)\n",
      "identifiers": {
        "CVE": [
          "CVE-2020-8203"
        ],
        "CWE": [
          "CWE-1321"
        ],
        "NSP": [
          "1523"
        ],
        "GHSA": [
          "GHSA-p6mc-m468-83gw"
        ]
      },
      "packageName": "lodash",
      "proprietary": false,
      "creationTime": "2020-04-28T14:32:13.683154Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2020-04-27T22:14:18Z",
      "packageManager": "npm",
      "publicationTime": "2020-04-28T14:59:14Z",
      "modificationTime": "2022-08-25T12:14:41.221655Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2",
        "lodash@2.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@1.7.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "lodash",
      "version": "2.4.2"
    },
    {
      "id": "SNYK-JS-LODASH-608086",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
      "credit": [
        "awarau"
      ],
      "semver": {
        "vulnerable": [
          "<4.17.17"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "4.17.17"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.3,
      "functions": [],
      "malicious": false,
      "moduleName": "lodash",
      "references": [
        {
          "url": "https://hackerone.com/reports/864701",
          "title": "HackerOne Report"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\n[lodash](https://www.npmjs.com/package/lodash) is a modern JavaScript utility library delivering modularity, performance, & extras.\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `setWith` and `set` functions.\r\n\r\n## PoC by awarau\r\n* Create a JS file with this contents:\r\n```\r\nlod = require('lodash')\r\nlod.setWith({}, \"__proto__[test]\", \"123\")\r\nlod.set({}, \"__proto__[test2]\", \"456\")\r\nconsole.log(Object.prototype)\r\n```\r\n* Execute it with `node`\r\n* Observe that `test` and `test2` is now in the `Object.prototype`.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `lodash` to version 4.17.17 or higher.\n## References\n- [HackerOne Report](https://hackerone.com/reports/864701)\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "lodash",
      "proprietary": false,
      "creationTime": "2020-08-21T12:52:58.443440Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2020-08-21T10:34:29Z",
      "packageManager": "npm",
      "publicationTime": "2020-08-21T12:53:03Z",
      "modificationTime": "2022-08-25T12:14:41.622393Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2",
        "lodash@2.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@1.7.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "lodash",
      "version": "2.4.2"
    },
    {
      "id": "SNYK-JS-LODASH-73638",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P",
      "credit": [
        "asgerf"
      ],
      "semver": {
        "vulnerable": [
          "<4.17.11"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "4.17.11"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.3,
      "functions": [
        {
          "version": [
            ">=4.17.5 <4.17.11"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "className": null,
            "functionName": "safeGet"
          }
        },
        {
          "version": [
            ">=4.0.0 <4.17.5"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "className": null,
            "functionName": "runInContext.baseMerge"
          }
        },
        {
          "version": [
            ">=4.0.0 <4.17.5"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "className": null,
            "functionName": "runInContext.baseMergeDeep"
          }
        },
        {
          "version": [
            ">=4.0.0 <4.17.5"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "className": null,
            "functionName": "runInContext.assignMergeValue"
          }
        },
        {
          "version": [
            ">=3.0.0 <4.0.0"
          ],
          "functionId": {
            "filePath": "index.js",
            "className": null,
            "functionName": "runInContext.baseMerge"
          }
        },
        {
          "version": [
            ">=3.0.0 <4.0.0"
          ],
          "functionId": {
            "filePath": "index.js",
            "className": null,
            "functionName": "runInContext.baseMergeDeep"
          }
        },
        {
          "version": [
            ">=4.0.0 <4.17.3"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "className": null,
            "functionName": "runInContext.mergeDefaults"
          }
        },
        {
          "version": [
            ">=2.0.0 <3.0.0"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "className": null,
            "functionName": "runInContext.merge"
          }
        },
        {
          "version": [
            ">=0.9.0 <1.0.0"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "className": null,
            "functionName": "merge"
          }
        },
        {
          "version": [
            ">=1.0.0 <1.0.3"
          ],
          "functionId": {
            "filePath": "dist/lodash.js",
            "className": null,
            "functionName": "merge"
          }
        },
        {
          "version": [
            ">=1.1.0 <2.0.0"
          ],
          "functionId": {
            "filePath": "dist/lodash.js",
            "className": null,
            "functionName": "runInContext.merge"
          }
        }
      ],
      "malicious": false,
      "moduleName": "lodash",
      "references": [
        {
          "url": "https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/lodash/lodash/pull/4337",
          "title": "GitHub PR"
        },
        {
          "url": "https://www.npmjs.com/advisories/1066",
          "title": "NPM Security Advisory"
        },
        {
          "url": "https://www.npmjs.com/advisories/1068",
          "title": "NPM Security Advisory"
        },
        {
          "url": "https://www.npmjs.com/advisories/1071",
          "title": "NPM Security Advisory"
        },
        {
          "url": "https://www.npmjs.com/advisories/782",
          "title": "NPM Security Advisory"
        },
        {
          "url": "https://hackerone.com/reports/380873",
          "title": "POC: HackerOne Report"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "cvssV3BaseScore": 5.6,
          "modificationTime": "2022-01-03T16:22:51.625949Z"
        }
      ],
      "description": "## Overview\n[lodash](https://www.npmjs.com/package/lodash) is a modern JavaScript utility library delivering modularity, performance, & extras.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The functions `merge`, `mergeWith`, and `defaultsDeep` could be tricked into adding or modifying properties of `Object.prototype`. This is due to an incomplete fix to `CVE-2018-3721`.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `lodash` to version 4.17.11 or higher.\n## References\n- [GitHub Commit](https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad)\n- [GitHub PR](https://github.com/lodash/lodash/pull/4337)\n- [NPM Security Advisory](https://www.npmjs.com/advisories/1066)\n- [NPM Security Advisory](https://www.npmjs.com/advisories/1068)\n- [NPM Security Advisory](https://www.npmjs.com/advisories/1071)\n- [NPM Security Advisory](https://www.npmjs.com/advisories/782)\n- [POC: HackerOne Report](https://hackerone.com/reports/380873)\n",
      "identifiers": {
        "CVE": [
          "CVE-2018-16487"
        ],
        "CWE": [
          "CWE-1321"
        ],
        "NSP": [
          "782",
          "1066",
          "1068",
          "1071"
        ],
        "GHSA": [
          "GHSA-4xc9-xhrj-v574"
        ]
      },
      "packageName": "lodash",
      "proprietary": true,
      "creationTime": "2019-02-03T09:06:37.726000Z",
      "functions_new": [
        {
          "version": [
            ">=4.17.5 <4.17.11"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "functionName": "safeGet"
          }
        },
        {
          "version": [
            ">=4.0.0 <4.17.5"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "functionName": "runInContext.baseMerge"
          }
        },
        {
          "version": [
            ">=4.0.0 <4.17.5"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "functionName": "runInContext.baseMergeDeep"
          }
        },
        {
          "version": [
            ">=4.0.0 <4.17.5"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "functionName": "runInContext.assignMergeValue"
          }
        },
        {
          "version": [
            ">=3.0.0 <4.0.0"
          ],
          "functionId": {
            "filePath": "index.js",
            "functionName": "runInContext.baseMerge"
          }
        },
        {
          "version": [
            ">=3.0.0 <4.0.0"
          ],
          "functionId": {
            "filePath": "index.js",
            "functionName": "runInContext.baseMergeDeep"
          }
        },
        {
          "version": [
            ">=4.0.0 <4.17.3"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "functionName": "runInContext.mergeDefaults"
          }
        },
        {
          "version": [
            ">=2.0.0 <3.0.0"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "functionName": "runInContext.merge"
          }
        },
        {
          "version": [
            ">=0.9.0 <1.0.0"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "functionName": "merge"
          }
        },
        {
          "version": [
            ">=1.0.0 <1.0.3"
          ],
          "functionId": {
            "filePath": "dist/lodash.js",
            "functionName": "merge"
          }
        },
        {
          "version": [
            ">=1.1.0 <2.0.0"
          ],
          "functionId": {
            "filePath": "dist/lodash.js",
            "functionName": "runInContext.merge"
          }
        }
      ],
      "alternativeIds": [],
      "disclosureTime": "2018-08-31T18:21:00Z",
      "packageManager": "npm",
      "publicationTime": "2019-02-01T18:21:00Z",
      "modificationTime": "2022-09-13T14:35:06.157983Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2",
        "lodash@2.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@1.7.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "lodash",
      "version": "2.4.2"
    },
    {
      "id": "SNYK-JS-LODASH-73639",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "cristianstaicu"
      ],
      "semver": {
        "vulnerable": [
          "<4.17.11"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "4.17.11"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 4.4,
      "functions": [
        {
          "version": [
            ">=4.15.0 <4.17.11"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "className": null,
            "functionName": "hasUnicodeWord"
          }
        }
      ],
      "malicious": false,
      "moduleName": "lodash",
      "references": [
        {
          "url": "https://github.com/lodash/lodash/commit/5c08f18d365b64063bfbfa686cbb97cdd6267347",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/lodash/lodash/pull/4450",
          "title": "GitHub PR"
        },
        {
          "url": "https://github.com/lodash/lodash/issues/3359",
          "title": "POC: GitHub Issue"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 6.5,
          "modificationTime": "2022-01-03T17:53:28.079217Z"
        }
      ],
      "description": "## Overview\n[lodash](https://www.npmjs.com/package/lodash) is a modern JavaScript utility library delivering modularity, performance, & extras.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). It parses dates using regex strings, which may cause a slowdown of 2 seconds per 50k characters.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `lodash` to version 4.17.11 or higher.\n## References\n- [GitHub Commit](https://github.com/lodash/lodash/commit/5c08f18d365b64063bfbfa686cbb97cdd6267347)\n- [GitHub PR](https://github.com/lodash/lodash/pull/4450)\n- [POC: GitHub Issue](https://github.com/lodash/lodash/issues/3359)\n",
      "identifiers": {
        "CVE": [
          "CVE-2019-1010266"
        ],
        "CWE": [
          "CWE-185"
        ]
      },
      "packageName": "lodash",
      "proprietary": false,
      "creationTime": "2019-02-03T09:18:05.060741Z",
      "functions_new": [
        {
          "version": [
            ">=4.15.0 <4.17.11"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "functionName": "hasUnicodeWord"
          }
        }
      ],
      "alternativeIds": [],
      "disclosureTime": "2017-09-05T09:14:29Z",
      "packageManager": "npm",
      "publicationTime": "2019-04-05T09:14:22Z",
      "modificationTime": "2022-04-05T12:27:32.267901Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2",
        "lodash@2.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@1.7.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "lodash",
      "version": "2.4.2"
    },
    {
      "id": "npm:lodash:20180130",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P",
      "credit": [
        "Olivier Arteau (HoLyVieR)"
      ],
      "semver": {
        "vulnerable": [
          "<4.17.5"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "4.17.5"
      ],
      "patches": [
        {
          "id": "patch:npm:lodash:20180130:0",
          "urls": [
            "https://snyk-patches.s3.amazonaws.com/npm/lodash/20180130/20180130_0_0_lodash_d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a.patch"
          ],
          "version": "=3.10.1",
          "comments": [],
          "modificationTime": "2019-12-03T11:40:45.883000Z"
        }
      ],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 6.3,
      "functions": [
        {
          "version": [
            ">=4.0.0 <4.17.5"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "className": null,
            "functionName": "runInContext.baseMerge"
          }
        },
        {
          "version": [
            ">=4.0.0 <4.17.5"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "className": null,
            "functionName": "runInContext.baseMergeDeep"
          }
        },
        {
          "version": [
            ">=3.0.0 <4.0.0"
          ],
          "functionId": {
            "filePath": "index.js",
            "className": null,
            "functionName": "runInContext.baseMergeDeep"
          }
        },
        {
          "version": [
            ">=2.0.0 <3.0.0"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "className": null,
            "functionName": "runInContext.merge"
          }
        },
        {
          "version": [
            ">=1.1.0 <2.0.0"
          ],
          "functionId": {
            "filePath": "dist/lodash.js",
            "className": null,
            "functionName": "runInContext.merge"
          }
        },
        {
          "version": [
            ">=0.9.0 <1.0.0"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "className": null,
            "functionName": "merge"
          }
        },
        {
          "version": [
            ">= 1.0.0 <1.0.3"
          ],
          "functionId": {
            "filePath": "dist/lodash.js",
            "className": null,
            "functionName": "merge"
          }
        }
      ],
      "malicious": false,
      "moduleName": "lodash",
      "references": [
        {
          "url": "https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/lodash/lodash/pull/4337",
          "title": "GitHub PR"
        },
        {
          "url": "https://hackerone.com/reports/310443",
          "title": "HackerOne Report"
        },
        {
          "url": "https://www.npmjs.com/advisories/1067",
          "title": "NPM Security Advisory"
        },
        {
          "url": "https://www.npmjs.com/advisories/1069",
          "title": "NPM Security Advisory"
        },
        {
          "url": "https://www.npmjs.com/advisories/1070",
          "title": "NPM Security Advisory"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "cvssV3BaseScore": 6.5,
          "modificationTime": "2022-01-03T16:27:45.509249Z"
        }
      ],
      "description": "## Overview\n[lodash](https://www.npmjs.com/package/lodash) is a modern JavaScript utility library delivering modularity, performance, & extras.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The utilities function allow modification of the `Object` prototype. If an attacker can control part of the structure passed to this function, they could add or modify an existing property.  \r\n\r\n## PoC by Olivier Arteau (HoLyVieR)\r\n```js\r\nvar _= require('lodash');\r\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\r\n\r\nvar a = {};\r\nconsole.log(\"Before : \" + a.oops);\r\n_.merge({}, JSON.parse(malicious_payload));\r\nconsole.log(\"After : \" + a.oops);\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `lodash` to version 4.17.5 or higher.\n## References\n- [GitHub Commit](https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a)\n- [GitHub PR](https://github.com/lodash/lodash/pull/4337)\n- [HackerOne Report](https://hackerone.com/reports/310443)\n- [NPM Security Advisory](https://www.npmjs.com/advisories/1067)\n- [NPM Security Advisory](https://www.npmjs.com/advisories/1069)\n- [NPM Security Advisory](https://www.npmjs.com/advisories/1070)\n",
      "identifiers": {
        "CVE": [
          "CVE-2018-3721"
        ],
        "CWE": [
          "CWE-1321"
        ],
        "NSP": [
          "577",
          "1067",
          "1069",
          "1070"
        ],
        "GHSA": [
          "GHSA-fvqr-27wr-82fm",
          "GHSA-5947-m4fg-xhqg",
          "GHSA-46fh-8fc5-xcwx",
          "GHSA-2m96-9w4j-wgv7"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-LODASH-174180"
        ]
      },
      "packageName": "lodash",
      "proprietary": true,
      "creationTime": "2018-02-12T22:28:27.654000Z",
      "functions_new": [
        {
          "version": [
            ">=4.0.0 <4.17.5"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "functionName": "runInContext.baseMerge"
          }
        },
        {
          "version": [
            ">=4.0.0 <4.17.5"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "functionName": "runInContext.baseMergeDeep"
          }
        },
        {
          "version": [
            ">=3.0.0 <4.0.0"
          ],
          "functionId": {
            "filePath": "index.js",
            "functionName": "runInContext.baseMergeDeep"
          }
        },
        {
          "version": [
            ">=2.0.0 <3.0.0"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "functionName": "runInContext.merge"
          }
        },
        {
          "version": [
            ">=1.1.0 <2.0.0"
          ],
          "functionId": {
            "filePath": "dist/lodash.js",
            "functionName": "runInContext.merge"
          }
        },
        {
          "version": [
            ">=0.9.0 <1.0.0"
          ],
          "functionId": {
            "filePath": "lodash.js",
            "functionName": "merge"
          }
        },
        {
          "version": [
            ">= 1.0.0 <1.0.3"
          ],
          "functionId": {
            "filePath": "dist/lodash.js",
            "functionName": "merge"
          }
        }
      ],
      "alternativeIds": [
        "SNYK-JS-LODASH-174180"
      ],
      "disclosureTime": "2018-01-30T22:28:27Z",
      "packageManager": "npm",
      "publicationTime": "2018-02-14T13:22:50Z",
      "modificationTime": "2022-08-25T12:14:41.090425Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2",
        "lodash@2.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@1.7.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "lodash",
      "version": "2.4.2"
    },
    {
      "id": "SNYK-JS-LODASHSET-1320032",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
      "credit": [
        "awarau"
      ],
      "semver": {
        "vulnerable": [
          "*"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.3,
      "functions": [],
      "malicious": false,
      "moduleName": "lodash.set",
      "references": [
        {
          "url": "https://hackerone.com/reports/864701",
          "title": "HackerOne Report"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\n[lodash.set](https://www.npmjs.com/package/lodash.set) is a lodash method _.set exported as a Node.js module.\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `setWith` and `set` functions.\r\n\r\n## PoC by awarau\r\n* Create a JS file with this contents:\r\n```\r\nlod = require('lodash')\r\nlod.setWith({}, \"__proto__[test]\", \"123\")\r\nlod.set({}, \"__proto__[test2]\", \"456\")\r\nconsole.log(Object.prototype)\r\n```\r\n* Execute it with `node`\r\n* Observe that `test` and `test2` is now in the `Object.prototype`.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nThere is no fixed version for `lodash.set`.\n## References\n- [HackerOne Report](https://hackerone.com/reports/864701)\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "lodash.set",
      "proprietary": false,
      "creationTime": "2021-07-19T12:00:32.890460Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2020-08-21T10:34:29Z",
      "packageManager": "npm",
      "publicationTime": "2020-08-21T12:53:03Z",
      "modificationTime": "2022-08-25T12:14:41.622393Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "grunt-replace-json@0.1.0",
        "lodash.set@4.3.2"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "lodash.set",
      "version": "4.3.2"
    },
    {
      "id": "SNYK-JS-MARSDB-480405",
      "title": "Arbitrary Code Injection",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "credit": [
        "Francois Gauthier"
      ],
      "semver": {
        "vulnerable": [
          "*"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "critical",
      "cvssScore": 9.8,
      "functions": [],
      "malicious": false,
      "moduleName": "marsdb",
      "references": [
        {
          "url": "https://www.npmjs.com/advisories/1122",
          "title": "NPM Security Advisory"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\n[marsdb](https://github.com/c58/marsdb) is a MarsDB is a lightweight client-side database.\n\nAffected versions of this package are vulnerable to Arbitrary Code Injection. In the `DocumentMatcher` class, selectors on `$where` clauses are passed to a Function constructor unsanitized. This allows attackers to run arbitrary commands in the system when the function is executed.\n## Remediation\nThere is no fixed version for `marsdb`.\n## References\n- [NPM Security Advisory](https://www.npmjs.com/advisories/1122)\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-94"
        ],
        "NSP": [
          "1122"
        ],
        "GHSA": [
          "GHSA-5mrr-rgp6-x4gr"
        ]
      },
      "packageName": "marsdb",
      "proprietary": false,
      "creationTime": "2019-11-06T09:43:57.923159Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2019-08-29T17:53:27Z",
      "packageManager": "npm",
      "publicationTime": "2019-11-06T11:41:52Z",
      "modificationTime": "2020-12-14T14:41:11.223902Z",
      "socialTrendAlert": false,
      "severityWithCritical": "critical",
      "from": [
        "juice-shop@12.3.0",
        "marsdb@0.6.11"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "marsdb",
      "version": "0.6.11"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "glob@7.2.0",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "glob@7.2.0",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "grunt@1.4.1",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "grunt@1.4.1",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "replace@1.2.1",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "replace@1.2.2",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "grunt@1.4.1",
        "glob@7.1.7",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "grunt@1.4.1",
        "glob@7.1.7",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "grunt@1.4.1",
        "rimraf@3.0.2",
        "glob@7.2.0",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "grunt@1.4.1",
        "rimraf@3.0.2",
        "glob@7.2.0",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "grunt-contrib-compress@1.6.0",
        "archiver@1.3.0",
        "glob@7.2.0",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "grunt-contrib-compress@1.6.0",
        "archiver@1.3.0",
        "glob@7.2.0",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "node-pre-gyp@0.15.0",
        "rimraf@2.7.1",
        "glob@7.2.0",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "node-pre-gyp@0.15.0",
        "rimraf@2.7.1",
        "glob@7.2.0",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "glob@7.2.0",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "glob@7.2.0",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "grunt@1.4.1",
        "findup-sync@0.3.0",
        "glob@5.0.15",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "grunt@1.4.1",
        "findup-sync@0.3.0",
        "glob@5.0.15",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "node-pre-gyp@0.15.0",
        "npm-packlist@1.4.8",
        "ignore-walk@3.0.4",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "node-pre-gyp@0.15.0",
        "npm-packlist@1.4.8",
        "ignore-walk@3.0.4",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "libxmljs2@0.26.7",
        "@mapbox/node-pre-gyp@1.0.8",
        "rimraf@3.0.2",
        "glob@7.2.0",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "libxmljs2@0.26.7",
        "@mapbox/node-pre-gyp@1.0.8",
        "rimraf@3.0.2",
        "glob@7.2.0",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "grunt-contrib-compress@1.6.0",
        "archiver@1.3.0",
        "archiver-utils@1.3.0",
        "glob@7.2.0",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "grunt-contrib-compress@1.6.0",
        "archiver@1.3.0",
        "archiver-utils@1.3.0",
        "glob@7.2.0",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "unzipper@0.9.15",
        "fstream@1.0.12",
        "rimraf@2.7.1",
        "glob@7.2.0",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "unzipper@0.9.15",
        "fstream@1.0.12",
        "rimraf@2.7.1",
        "glob@7.2.0",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "rimraf@2.7.1",
        "glob@7.2.0",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "rimraf@2.7.1",
        "glob@7.2.0",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-pre-gyp@0.11.0",
        "rimraf@2.7.1",
        "glob@7.2.0",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.2",
        "node-pre-gyp@0.11.0",
        "rimraf@2.7.1",
        "glob@7.2.0",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-pre-gyp@0.11.0",
        "npm-packlist@1.4.8",
        "ignore-walk@3.0.4",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.2",
        "node-pre-gyp@0.11.0",
        "npm-packlist@1.4.8",
        "ignore-walk@3.0.4",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "grunt-contrib-compress@1.6.0",
        "archiver@1.3.0",
        "zip-stream@1.2.0",
        "archiver-utils@1.3.0",
        "glob@7.2.0",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "grunt-contrib-compress@1.6.0",
        "archiver@1.3.0",
        "zip-stream@1.2.0",
        "archiver-utils@1.3.0",
        "glob@7.2.0",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "fstream@1.0.12",
        "rimraf@2.7.1",
        "glob@7.2.0",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "fstream@1.0.12",
        "rimraf@2.7.1",
        "glob@7.2.0",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMATCH-3050818",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.5"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.5"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "minimatch",
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:40:17.490683Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-20T01:10:31.056597Z"
        }
      ],
      "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `braceExpand` function in `minimatch.js`.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-3517"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "minimatch",
      "proprietary": false,
      "creationTime": "2022-10-18T06:10:47.980262Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-18T06:00:25Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-18T06:29:18.078950Z",
      "modificationTime": "2022-11-27T21:40:17.490683Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "tar@2.2.2",
        "fstream@1.0.12",
        "rimraf@2.7.1",
        "glob@7.2.0",
        "minimatch@3.0.4"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "tar@2.2.2",
        "fstream@1.0.12",
        "rimraf@2.7.1",
        "glob@7.2.0",
        "minimatch@3.0.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "minimatch",
      "version": "3.0.4"
    },
    {
      "id": "SNYK-JS-MINIMIST-2429795",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<1.2.6"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "1.2.6"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "low",
      "cvssScore": 3.7,
      "functions": [],
      "malicious": false,
      "moduleName": "minimist",
      "references": [
        {
          "url": "https://github.com/substack/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d",
          "title": "Fix Commit"
        },
        {
          "url": "https://github.com/substack/minimist/issues/164",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/substack/minimist/blob/master/index.js%23L69",
          "title": "Vulnerable Code"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "cvssV3BaseScore": 5.6,
          "modificationTime": "2022-05-18T11:05:33.152638Z"
        },
        {
          "assigner": "NVD",
          "severity": "critical",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 9.8,
          "modificationTime": "2022-04-13T01:10:15.021168Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 8.1,
          "modificationTime": "2022-11-25T14:17:13.977821Z"
        }
      ],
      "description": "## Overview\n[minimist](https://www.npmjs.com/package/minimist) is a parse argument options module.\n\nAffected versions of this package are vulnerable to Prototype Pollution due to a missing handler to `Function.prototype`.\r\n\r\n**Notes:** \r\n\r\n- This vulnerability is a bypass to [CVE-2020-7598](https://security.snyk.io/vuln/SNYK-JS-MINIMIST-559764)\r\n\r\n- The reason for the different CVSS between CVE-2021-44906 to CVE-2020-7598, is that CVE-2020-7598 can pollute objects, while CVE-2021-44906 can pollute only function.\r\n\r\n\r\n## PoC by Snyk\r\n```js\r\nrequire('minimist')('--_.constructor.constructor.prototype.foo bar'.split(' '));\r\nconsole.log((function(){}).foo); // bar\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `minimist` to version 1.2.6 or higher.\n## References\n- [Fix Commit](https://github.com/substack/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d)\n- [GitHub Issue](https://github.com/substack/minimist/issues/164)\n- [Vulnerable Code](https://github.com/substack/minimist/blob/master/index.js#L69)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-44906"
        ],
        "CWE": [
          "CWE-1321"
        ],
        "SNYK": [
          "SNYK-JS-MINIMIST-559764"
        ]
      },
      "packageName": "minimist",
      "proprietary": false,
      "creationTime": "2022-03-18T13:02:08.840039Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-03-18T12:24:05Z",
      "packageManager": "npm",
      "publicationTime": "2022-03-21T12:09:35Z",
      "modificationTime": "2022-11-25T14:17:13.977821Z",
      "socialTrendAlert": false,
      "severityWithCritical": "low",
      "from": [
        "juice-shop@12.3.0",
        "check-dependencies@1.1.0",
        "bower-config@1.4.3",
        "minimist@0.2.1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "minimist",
      "version": "0.2.1"
    },
    {
      "id": "SNYK-JS-MOMENT-2440688",
      "title": "Directory Traversal",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<2.29.2"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.29.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "moment",
      "references": [
        {
          "url": "https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-07-30T13:11:10.093622Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:37:12.591335Z"
        }
      ],
      "description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Directory Traversal when a user provides a locale string which is directly used to switch moment locale.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `moment` to version 2.29.2 or higher.\n## References\n- [GitHub Commit](https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-24785"
        ],
        "CWE": [
          "CWE-22"
        ],
        "GHSA": [
          "GHSA-8hfj-j24r-96c4"
        ]
      },
      "packageName": "moment",
      "proprietary": false,
      "creationTime": "2022-04-05T08:46:07.677588Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-04-05T08:39:23Z",
      "packageManager": "npm",
      "publicationTime": "2022-04-05T12:30:50.878091Z",
      "modificationTime": "2022-11-27T21:37:12.591335Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "express-jwt@0.1.3",
        "jsonwebtoken@0.1.0",
        "moment@2.0.0"
      ],
      "upgradePath": [
        false,
        "express-jwt@0.1.4",
        "jsonwebtoken@0.3.0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "moment",
      "version": "2.0.0"
    },
    {
      "id": "npm:moment:20160126",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Adam Baldwin"
      ],
      "semver": {
        "vulnerable": [
          "<2.11.2"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.11.2"
      ],
      "patches": [
        {
          "id": "patch:npm:moment:20160126:0",
          "urls": [
            "https://snyk-patches.s3.amazonaws.com/npm/moment/20160126/moment_20160126_0_0_34af63b8b21208a949dfaf42d228502c73d20ec0.patch"
          ],
          "version": "<=2.11.1 >2.10.6",
          "comments": [],
          "modificationTime": "2019-12-03T11:40:45.800167Z"
        },
        {
          "id": "patch:npm:moment:20160126:1",
          "urls": [
            "https://snyk-patches.s3.amazonaws.com/npm/moment/20160126/moment_20160126_0_1_34af63b8b21208a949dfaf42d228502c73d20ec0.patch"
          ],
          "version": "<=2.10.6 >2.9.0",
          "comments": [],
          "modificationTime": "2019-12-03T11:40:45.801226Z"
        },
        {
          "id": "patch:npm:moment:20160126:2",
          "urls": [
            "https://snyk-patches.s3.amazonaws.com/npm/moment/20160126/moment_20160126_0_2_34af63b8b21208a949dfaf42d228502c73d20ec0.patch"
          ],
          "version": "<=2.9.0 >2.2.1",
          "comments": [],
          "modificationTime": "2019-12-03T11:40:45.802270Z"
        },
        {
          "id": "patch:npm:moment:20160126:3",
          "urls": [
            "https://snyk-patches.s3.amazonaws.com/npm/moment/20160126/moment_20160126_0_3_34af63b8b21208a949dfaf42d228502c73d20ec0.patch"
          ],
          "version": "=2.2.1",
          "comments": [],
          "modificationTime": "2019-12-03T11:40:45.803327Z"
        },
        {
          "id": "patch:npm:moment:20160126:4",
          "urls": [
            "https://snyk-patches.s3.amazonaws.com/npm/moment/20160126/moment_20160126_0_4_34af63b8b21208a949dfaf42d228502c73d20ec0.patch"
          ],
          "version": "<2.2.1 >2.0.0",
          "comments": [],
          "modificationTime": "2019-12-03T11:40:45.804441Z"
        }
      ],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "moment",
      "references": [
        {
          "url": "https://github.com/moment/moment/commit/52a807b961ead925be11ff5e632c8f7325a9ce36",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/moment/moment/issues/2936",
          "title": "GitHub Issue"
        },
        {
          "url": "https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS",
          "title": "OWASP ReDoS"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 6.5,
          "modificationTime": "2022-06-07T01:11:12.229583Z"
        }
      ],
      "description": "## Overview\r\n[`moment`](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\r\n\r\nAn attacker can provide a long value to the `duration` function, which nearly matches the pattern being matched. This will cause the regular expression matching to take a long time, all the while occupying the event loop and preventing it from processing other requests and making the server unavailable (a Denial of Service attack).\r\n\r\n## Details\r\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\r\n\r\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\r\n\r\nLet’s take the following regular expression as an example:\r\n```js\r\nregex = /A(B|C+)+D/\r\n```\r\n\r\nThis regular expression accomplishes the following:\r\n- `A` The string must start with the letter 'A'\r\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\r\n- `D` Finally, we ensure this section of the string ends with a 'D'\r\n\r\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\r\n\r\nIt most cases, it doesn't take very long for a regex engine to find a match:\r\n\r\n```bash\r\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\r\n0.04s user 0.01s system 95% cpu 0.052 total\r\n\r\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\r\n1.79s user 0.02s system 99% cpu 1.812 total\r\n```\r\n\r\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\r\n\r\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\r\n\r\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\r\n1. CCC\r\n2. CC+C\r\n3. C+CC\r\n4. C+C+C.\r\n\r\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\r\n\r\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\r\n\r\n| String | Number of C's | Number of steps |\r\n| -------|-------------:| -----:|\r\n| ACCCX | 3 | 38\r\n| ACCCCX | 4 | 71\r\n| ACCCCCX | 5 | 136\r\n| ACCCCCCCCCCCCCCX | 14 | 65,553\r\n\r\n\r\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\r\n\r\n\r\n## Remediation\r\nUpgrade `moment` to version `2.11.2` or greater.\r\n\r\n## References\r\n- [OWASP ReDoS](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS)\r\n- [GitHub Commit](https://github.com/moment/moment/commit/52a807b961ead925be11ff5e632c8f7325a9ce36)\r\n- [GitHub Issue](https://github.com/moment/moment/issues/2936)",
      "identifiers": {
        "CVE": [
          "CVE-2016-4055"
        ],
        "CWE": [
          "CWE-400"
        ],
        "NSP": [
          "55"
        ],
        "GHSA": [
          "GHSA-87vv-r9j6-g5qv"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-MOMENT-10084"
        ]
      },
      "packageName": "moment",
      "proprietary": false,
      "creationTime": "2016-02-01T19:00:03.862000Z",
      "functions_new": [],
      "alternativeIds": [
        "SNYK-JS-MOMENT-10084"
      ],
      "disclosureTime": "2016-01-26T20:04:21Z",
      "packageManager": "npm",
      "publicationTime": "2016-02-01T19:00:03Z",
      "modificationTime": "2022-06-07T01:11:12.229583Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "express-jwt@0.1.3",
        "jsonwebtoken@0.1.0",
        "moment@2.0.0"
      ],
      "upgradePath": [
        false,
        "express-jwt@0.1.4",
        "jsonwebtoken@0.3.0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "moment",
      "version": "2.0.0"
    },
    {
      "id": "npm:moment:20161019",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "Snyk Security Research Team"
      ],
      "semver": {
        "vulnerable": [
          "<2.15.2"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.15.2"
      ],
      "patches": [
        {
          "id": "patch:npm:moment:20161019:0",
          "urls": [
            "https://snyk-patches.s3.amazonaws.com/npm/moment/20161019/moment_20161019_0_1.patch"
          ],
          "version": "<2.15.2 >=2.14.0",
          "comments": [],
          "modificationTime": "2019-12-03T11:40:45.848228Z"
        },
        {
          "id": "patch:npm:moment:20161019:1",
          "urls": [
            "https://snyk-patches.s3.amazonaws.com/npm/moment/20161019/moment_20161019_0_0.patch"
          ],
          "version": "<2.14.0 >=2.12.0",
          "comments": [],
          "modificationTime": "2019-12-03T11:40:45.849308Z"
        }
      ],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.9,
      "functions": [],
      "malicious": false,
      "moduleName": "moment",
      "references": [
        {
          "url": "https://github.com/moment/moment/commit/663f33e333212b3800b63592cd8e237ac8fabdb9",
          "title": "GitHub Commit"
        },
        {
          "url": "https://gist.github.com/grnd/50192ce22681848a7de812d95241b7fc",
          "title": "Proof of concept"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\r\n[`moment`](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\r\n\r\nAffected versions of the package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks for any locale that has separate format and standalone options and `format` input can be controlled by the user.\r\n\r\nAn attacker can provide a specially crafted input to the `format` function, which nearly matches the pattern being matched. This will cause the regular expression matching to take a long time, all the while occupying the event loop and preventing it from processing other requests and making the server unavailable (a Denial of Service attack).\r\n\r\n## Disclosure Timeline\r\n- October 19th, 2016 - Reported the issue to package owner.\r\n- October 19th, 2016 - Issue acknowledged by package owner.\r\n- October 24th, 2016 - Issue fixed and version `2.15.2` released.\r\n\r\n## Details\r\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\r\n\r\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\r\n\r\nLet’s take the following regular expression as an example:\r\n```js\r\nregex = /A(B|C+)+D/\r\n```\r\n\r\nThis regular expression accomplishes the following:\r\n- `A` The string must start with the letter 'A'\r\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\r\n- `D` Finally, we ensure this section of the string ends with a 'D'\r\n\r\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\r\n\r\nIt most cases, it doesn't take very long for a regex engine to find a match:\r\n\r\n```bash\r\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\r\n0.04s user 0.01s system 95% cpu 0.052 total\r\n\r\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\r\n1.79s user 0.02s system 99% cpu 1.812 total\r\n```\r\n\r\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\r\n\r\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\r\n\r\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\r\n1. CCC\r\n2. CC+C\r\n3. C+CC\r\n4. C+C+C.\r\n\r\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\r\n\r\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\r\n\r\n| String | Number of C's | Number of steps |\r\n| -------|-------------:| -----:|\r\n| ACCCX | 3 | 38\r\n| ACCCCX | 4 | 71\r\n| ACCCCCX | 5 | 136\r\n| ACCCCCCCCCCCCCCX | 14 | 65,553\r\n\r\n\r\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\r\n\r\n\r\n## References\r\n- [Proof of concept](https://gist.github.com/grnd/50192ce22681848a7de812d95241b7fc)\r\n- [Fix commit](https://github.com/moment/moment/commit/663f33e333212b3800b63592cd8e237ac8fabdb9)",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-400"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-MOMENT-10164"
        ]
      },
      "packageName": "moment",
      "proprietary": true,
      "creationTime": "2016-10-23T06:57:59.675000Z",
      "functions_new": [],
      "alternativeIds": [
        "SNYK-JS-MOMENT-10164"
      ],
      "disclosureTime": "2016-10-18T21:00:00Z",
      "packageManager": "npm",
      "publicationTime": "2016-10-24T06:57:59Z",
      "modificationTime": "2020-12-14T14:41:49.306035Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "express-jwt@0.1.3",
        "jsonwebtoken@0.1.0",
        "moment@2.0.0"
      ],
      "upgradePath": [
        false,
        "express-jwt@0.1.4",
        "jsonwebtoken@0.3.0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "moment",
      "version": "2.0.0"
    },
    {
      "id": "npm:moment:20170905",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Cristian-Alexandru Staicu"
      ],
      "semver": {
        "vulnerable": [
          "<2.19.3"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.19.3"
      ],
      "patches": [
        {
          "id": "patch:npm:moment:20170905:0",
          "urls": [
            "https://snyk-patches.s3.amazonaws.com/npm/moment/20170905/moment_0_0_69ed9d44957fa6ab12b73d2ae29d286a857b80eb.patch"
          ],
          "version": "<2.19.3 >=2.16.0",
          "comments": [],
          "modificationTime": "2019-12-03T11:40:45.878422Z"
        }
      ],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "low",
      "cvssScore": 3.7,
      "functions": [
        {
          "version": [
            "<2.19.3"
          ],
          "functionId": {
            "filePath": "moment.js",
            "className": null,
            "functionName": "monthsShortRegex"
          }
        },
        {
          "version": [
            "<2.19.3"
          ],
          "functionId": {
            "filePath": "moment.js",
            "className": null,
            "functionName": "monthsRegex"
          }
        },
        {
          "version": [
            ">=2.13.0 <2.19.3"
          ],
          "functionId": {
            "filePath": "moment.js",
            "className": null,
            "functionName": "weekdaysRegex"
          }
        },
        {
          "version": [
            ">=2.13.0 <2.19.3"
          ],
          "functionId": {
            "filePath": "moment.js",
            "className": null,
            "functionName": "weekdaysShortRegex"
          }
        },
        {
          "version": [
            ">=2.13.0 <2.19.3"
          ],
          "functionId": {
            "filePath": "moment.js",
            "className": null,
            "functionName": "weekdaysMinRegex"
          }
        }
      ],
      "malicious": false,
      "moduleName": "moment",
      "references": [
        {
          "url": "https://github.com/moment/moment/issues/4163",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/moment/moment/pull/4326",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-02-15T04:10:25.236941Z"
        }
      ],
      "description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). It used a regular expression (`/[0-9]*['a-z\\u00A0-\\u05FF\\u0700-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFEF]+|[\\u0600-\\u06FF\\/]+(\\s*?[\\u0600-\\u06FF]+){1,2}/i`) in order to parse dates specified as strings. This can cause a very low impact of about 2 seconds matching time for data 50k characters long.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `moment` to version 2.19.3 or higher.\n## References\n- [GitHub Issue](https://github.com/moment/moment/issues/4163)\n- [GitHub PR](https://github.com/moment/moment/pull/4326)\n",
      "identifiers": {
        "CVE": [
          "CVE-2017-18214"
        ],
        "CWE": [
          "CWE-400"
        ],
        "NSP": [
          "532"
        ],
        "GHSA": [
          "GHSA-446m-mv8f-q348"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-MOMENT-10841"
        ]
      },
      "packageName": "moment",
      "proprietary": false,
      "creationTime": "2017-09-13T07:55:05.106000Z",
      "functions_new": [
        {
          "version": [
            "<2.19.3"
          ],
          "functionId": {
            "filePath": "moment.js",
            "functionName": "monthsShortRegex"
          }
        },
        {
          "version": [
            "<2.19.3"
          ],
          "functionId": {
            "filePath": "moment.js",
            "functionName": "monthsRegex"
          }
        },
        {
          "version": [
            ">=2.13.0 <2.19.3"
          ],
          "functionId": {
            "filePath": "moment.js",
            "functionName": "weekdaysRegex"
          }
        },
        {
          "version": [
            ">=2.13.0 <2.19.3"
          ],
          "functionId": {
            "filePath": "moment.js",
            "functionName": "weekdaysShortRegex"
          }
        },
        {
          "version": [
            ">=2.13.0 <2.19.3"
          ],
          "functionId": {
            "filePath": "moment.js",
            "functionName": "weekdaysMinRegex"
          }
        }
      ],
      "alternativeIds": [
        "SNYK-JS-MOMENT-10841"
      ],
      "disclosureTime": "2017-09-05T21:00:00Z",
      "packageManager": "npm",
      "publicationTime": "2017-11-28T14:47:22Z",
      "modificationTime": "2022-02-15T04:10:25.236941Z",
      "socialTrendAlert": false,
      "severityWithCritical": "low",
      "from": [
        "juice-shop@12.3.0",
        "express-jwt@0.1.3",
        "jsonwebtoken@0.1.0",
        "moment@2.0.0"
      ],
      "upgradePath": [
        false,
        "express-jwt@0.1.4",
        "jsonwebtoken@0.3.0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "moment",
      "version": "2.0.0"
    },
    {
      "id": "SNYK-JS-MOMENT-2440688",
      "title": "Directory Traversal",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<2.29.2"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.29.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "moment",
      "references": [
        {
          "url": "https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-07-30T13:11:10.093622Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:37:12.591335Z"
        }
      ],
      "description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Directory Traversal when a user provides a locale string which is directly used to switch moment locale.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `moment` to version 2.29.2 or higher.\n## References\n- [GitHub Commit](https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-24785"
        ],
        "CWE": [
          "CWE-22"
        ],
        "GHSA": [
          "GHSA-8hfj-j24r-96c4"
        ]
      },
      "packageName": "moment",
      "proprietary": false,
      "creationTime": "2022-04-05T08:46:07.677588Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-04-05T08:39:23Z",
      "packageManager": "npm",
      "publicationTime": "2022-04-05T12:30:50.878091Z",
      "modificationTime": "2022-11-27T21:37:12.591335Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "file-stream-rotator@0.5.7",
        "moment@2.29.1"
      ],
      "upgradePath": [
        false,
        "file-stream-rotator@0.5.7",
        "moment@2.29.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "moment",
      "version": "2.29.1"
    },
    {
      "id": "SNYK-JS-MOMENT-2944238",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "Khang Vo"
      ],
      "semver": {
        "vulnerable": [
          ">=2.18.0 <2.29.4"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "2.29.4"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "moment",
      "references": [
        {
          "url": "https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/moment/moment/issues/6012",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/moment/moment/pull/6015",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-28T01:10:31.309052Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-19T20:56:45.261178Z"
        }
      ],
      "description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `preprocessRFC2822()` function in `from-string.js`, when processing a very long crafted string (over 10k characters).\r\n\r\n\r\n\r\n## PoC:\r\n```js\r\nmoment(\"(\".repeat(500000))\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `moment` to version 2.29.4 or higher.\n## References\n- [GitHub Commit](https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3)\n- [GitHub Issue](https://github.com/moment/moment/issues/6012)\n- [GitHub PR](https://github.com/moment/moment/pull/6015)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-31129"
        ],
        "CWE": [
          "CWE-1333"
        ],
        "GHSA": [
          "GHSA-wc69-rhjr-hc9g"
        ]
      },
      "packageName": "moment",
      "proprietary": false,
      "creationTime": "2022-07-07T06:05:46.236101Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-06T18:38:49Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-07T07:32:53Z",
      "modificationTime": "2022-11-19T20:56:45.261178Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "file-stream-rotator@0.5.7",
        "moment@2.29.1"
      ],
      "upgradePath": [
        false,
        "file-stream-rotator@0.5.7",
        "moment@2.29.4"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "moment",
      "version": "2.29.1"
    },
    {
      "id": "SNYK-JS-MOMENT-2440688",
      "title": "Directory Traversal",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<2.29.2"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.29.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "moment",
      "references": [
        {
          "url": "https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-07-30T13:11:10.093622Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:37:12.591335Z"
        }
      ],
      "description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Directory Traversal when a user provides a locale string which is directly used to switch moment locale.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `moment` to version 2.29.2 or higher.\n## References\n- [GitHub Commit](https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-24785"
        ],
        "CWE": [
          "CWE-22"
        ],
        "GHSA": [
          "GHSA-8hfj-j24r-96c4"
        ]
      },
      "packageName": "moment",
      "proprietary": false,
      "creationTime": "2022-04-05T08:46:07.677588Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-04-05T08:39:23Z",
      "packageManager": "npm",
      "publicationTime": "2022-04-05T12:30:50.878091Z",
      "modificationTime": "2022-11-27T21:37:12.591335Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "finale-rest@1.1.1",
        "moment@2.29.1"
      ],
      "upgradePath": [
        false,
        "finale-rest@1.1.1",
        "moment@2.29.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "moment",
      "version": "2.29.1"
    },
    {
      "id": "SNYK-JS-MOMENT-2944238",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "Khang Vo"
      ],
      "semver": {
        "vulnerable": [
          ">=2.18.0 <2.29.4"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "2.29.4"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "moment",
      "references": [
        {
          "url": "https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/moment/moment/issues/6012",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/moment/moment/pull/6015",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-28T01:10:31.309052Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-19T20:56:45.261178Z"
        }
      ],
      "description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `preprocessRFC2822()` function in `from-string.js`, when processing a very long crafted string (over 10k characters).\r\n\r\n\r\n\r\n## PoC:\r\n```js\r\nmoment(\"(\".repeat(500000))\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `moment` to version 2.29.4 or higher.\n## References\n- [GitHub Commit](https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3)\n- [GitHub Issue](https://github.com/moment/moment/issues/6012)\n- [GitHub PR](https://github.com/moment/moment/pull/6015)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-31129"
        ],
        "CWE": [
          "CWE-1333"
        ],
        "GHSA": [
          "GHSA-wc69-rhjr-hc9g"
        ]
      },
      "packageName": "moment",
      "proprietary": false,
      "creationTime": "2022-07-07T06:05:46.236101Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-06T18:38:49Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-07T07:32:53Z",
      "modificationTime": "2022-11-19T20:56:45.261178Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "finale-rest@1.1.1",
        "moment@2.29.1"
      ],
      "upgradePath": [
        false,
        "finale-rest@1.1.1",
        "moment@2.29.4"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "moment",
      "version": "2.29.1"
    },
    {
      "id": "SNYK-JS-MOMENT-2440688",
      "title": "Directory Traversal",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<2.29.2"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.29.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "moment",
      "references": [
        {
          "url": "https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-07-30T13:11:10.093622Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:37:12.591335Z"
        }
      ],
      "description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Directory Traversal when a user provides a locale string which is directly used to switch moment locale.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `moment` to version 2.29.2 or higher.\n## References\n- [GitHub Commit](https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-24785"
        ],
        "CWE": [
          "CWE-22"
        ],
        "GHSA": [
          "GHSA-8hfj-j24r-96c4"
        ]
      },
      "packageName": "moment",
      "proprietary": false,
      "creationTime": "2022-04-05T08:46:07.677588Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-04-05T08:39:23Z",
      "packageManager": "npm",
      "publicationTime": "2022-04-05T12:30:50.878091Z",
      "modificationTime": "2022-11-27T21:37:12.591335Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sequelize@5.22.5",
        "moment@2.29.1"
      ],
      "upgradePath": [
        false,
        "sequelize@5.22.5",
        "moment@2.29.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "moment",
      "version": "2.29.1"
    },
    {
      "id": "SNYK-JS-MOMENT-2944238",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "Khang Vo"
      ],
      "semver": {
        "vulnerable": [
          ">=2.18.0 <2.29.4"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "2.29.4"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "moment",
      "references": [
        {
          "url": "https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/moment/moment/issues/6012",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/moment/moment/pull/6015",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-28T01:10:31.309052Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-19T20:56:45.261178Z"
        }
      ],
      "description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `preprocessRFC2822()` function in `from-string.js`, when processing a very long crafted string (over 10k characters).\r\n\r\n\r\n\r\n## PoC:\r\n```js\r\nmoment(\"(\".repeat(500000))\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `moment` to version 2.29.4 or higher.\n## References\n- [GitHub Commit](https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3)\n- [GitHub Issue](https://github.com/moment/moment/issues/6012)\n- [GitHub PR](https://github.com/moment/moment/pull/6015)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-31129"
        ],
        "CWE": [
          "CWE-1333"
        ],
        "GHSA": [
          "GHSA-wc69-rhjr-hc9g"
        ]
      },
      "packageName": "moment",
      "proprietary": false,
      "creationTime": "2022-07-07T06:05:46.236101Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-06T18:38:49Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-07T07:32:53Z",
      "modificationTime": "2022-11-19T20:56:45.261178Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sequelize@5.22.5",
        "moment@2.29.1"
      ],
      "upgradePath": [
        false,
        "sequelize@5.22.5",
        "moment@2.29.4"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "moment",
      "version": "2.29.1"
    },
    {
      "id": "SNYK-JS-MOMENT-2440688",
      "title": "Directory Traversal",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<2.29.2"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.29.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "moment",
      "references": [
        {
          "url": "https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-07-30T13:11:10.093622Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-27T21:37:12.591335Z"
        }
      ],
      "description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Directory Traversal when a user provides a locale string which is directly used to switch moment locale.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 .....           19           19  good.txt\n2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `moment` to version 2.29.2 or higher.\n## References\n- [GitHub Commit](https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-24785"
        ],
        "CWE": [
          "CWE-22"
        ],
        "GHSA": [
          "GHSA-8hfj-j24r-96c4"
        ]
      },
      "packageName": "moment",
      "proprietary": false,
      "creationTime": "2022-04-05T08:46:07.677588Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-04-05T08:39:23Z",
      "packageManager": "npm",
      "publicationTime": "2022-04-05T12:30:50.878091Z",
      "modificationTime": "2022-11-27T21:37:12.591335Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sequelize@5.22.5",
        "moment-timezone@0.5.34",
        "moment@2.29.1"
      ],
      "upgradePath": [
        false,
        "sequelize@5.22.5",
        "moment-timezone@0.5.34",
        "moment@2.29.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "moment",
      "version": "2.29.1"
    },
    {
      "id": "SNYK-JS-MOMENT-2944238",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "Khang Vo"
      ],
      "semver": {
        "vulnerable": [
          ">=2.18.0 <2.29.4"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "2.29.4"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "moment",
      "references": [
        {
          "url": "https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/moment/moment/issues/6012",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/moment/moment/pull/6015",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-28T01:10:31.309052Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-19T20:56:45.261178Z"
        }
      ],
      "description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `preprocessRFC2822()` function in `from-string.js`, when processing a very long crafted string (over 10k characters).\r\n\r\n\r\n\r\n## PoC:\r\n```js\r\nmoment(\"(\".repeat(500000))\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `moment` to version 2.29.4 or higher.\n## References\n- [GitHub Commit](https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3)\n- [GitHub Issue](https://github.com/moment/moment/issues/6012)\n- [GitHub PR](https://github.com/moment/moment/pull/6015)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-31129"
        ],
        "CWE": [
          "CWE-1333"
        ],
        "GHSA": [
          "GHSA-wc69-rhjr-hc9g"
        ]
      },
      "packageName": "moment",
      "proprietary": false,
      "creationTime": "2022-07-07T06:05:46.236101Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-06T18:38:49Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-07T07:32:53Z",
      "modificationTime": "2022-11-19T20:56:45.261178Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sequelize@5.22.5",
        "moment-timezone@0.5.34",
        "moment@2.29.1"
      ],
      "upgradePath": [
        false,
        "sequelize@5.22.5",
        "moment-timezone@0.5.34",
        "moment@2.29.4"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "moment",
      "version": "2.29.1"
    },
    {
      "id": "SNYK-JS-MOUT-2342654",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "P.Adithya Srinivas",
        "Masudul Hasan Masud Bhuiyan",
        "Cristian-Alexandru Staicu"
      ],
      "semver": {
        "vulnerable": [
          "<1.2.4"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "1.2.4"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "mout",
      "references": [
        {
          "url": "https://github.com/mout/mout/blob/master/src/object/deepFillIn.js",
          "title": "GitHub Additional Information"
        },
        {
          "url": "https://github.com/mout/mout/blob/master/src/object/deepMixIn.js",
          "title": "GitHub Additional Information"
        },
        {
          "url": "https://github.com/mout/mout/commit/17ffdc2a96417a63a0147156dc045e90d0d14c64",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/mout/mout/pull/279",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-06-29T01:11:24.754541Z"
        }
      ],
      "description": "## Overview\n[mout](https://www.npmjs.com/package/mout) is a Modular Utilities\n\nAffected versions of this package are vulnerable to Prototype Pollution. The `deepFillIn` function can be used to 'fill missing properties recursively', while the `deepMixIn` mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively is not checked, leading to exploiting this vulnerability.\r\n\r\n**Note:**  This vulnerability derives from an incomplete fix of [CVE-2020-7792](https://security.snyk.io/vuln/SNYK-JS-MOUT-1014544).\r\n\r\n\r\n## PoC\r\n```javascript\r\nlet mout = require(\"mout\")\r\nlet b = {};\r\nlet payload = JSON.parse('[\"constructor.prototype.polluted\"]');\r\nmout.object.set(b, payload, \"success\");\r\nconsole.log(polluted);\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `mout` to version 1.2.4 or higher.\n## References\n- [GitHub Additional Information](https://github.com/mout/mout/blob/master/src/object/deepFillIn.js)\n- [GitHub Additional Information](https://github.com/mout/mout/blob/master/src/object/deepMixIn.js)\n- [GitHub Commit](https://github.com/mout/mout/commit/17ffdc2a96417a63a0147156dc045e90d0d14c64)\n- [GitHub PR](https://github.com/mout/mout/pull/279)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-21213"
        ],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "mout",
      "proprietary": true,
      "creationTime": "2022-01-19T08:32:39.145148Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-01-19T08:32:37Z",
      "packageManager": "npm",
      "publicationTime": "2022-06-15T15:27:59Z",
      "modificationTime": "2022-09-20T10:50:08.788220Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "check-dependencies@1.1.0",
        "bower-config@1.4.3",
        "mout@1.2.3"
      ],
      "upgradePath": [
        false,
        "check-dependencies@1.1.0",
        "bower-config@1.4.3",
        "mout@1.2.4"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "mout",
      "version": "1.2.3"
    },
    {
      "id": "SNYK-JS-NODEFETCH-2342118",
      "title": "Information Exposure",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<2.6.7",
          ">=3.0.0 <3.1.1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.6.7",
        "3.1.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 6.5,
      "functions": [],
      "malicious": false,
      "moduleName": "node-fetch",
      "references": [
        {
          "url": "https://github.com/node-fetch/node-fetch/commit/1ef4b560a17e644a02a3bfdea7631ffeee578b35",
          "title": "Github Commit"
        },
        {
          "url": "https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/node-fetch/node-fetch/pull/1449/commits/5c32f002fdd65b1c6a8f1e3620210813d45c7e60",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/node-fetch/node-fetch/pull/1449",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "cvssV3BaseScore": 6.1,
          "modificationTime": "2022-05-18T11:06:23.475047Z"
        },
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cvssV3BaseScore": 6.1,
          "modificationTime": "2022-10-29T01:10:37.609069Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "cvssV3BaseScore": 6.1,
          "modificationTime": "2022-11-27T21:31:03.384329Z"
        }
      ],
      "description": "## Overview\n[node-fetch](https://www.npmjs.com/package/node-fetch) is a light-weight module that brings window.fetch to node.js\n\nAffected versions of this package are vulnerable to Information Exposure when fetching a remote url with Cookie, if it get a `Location` response header, it will follow that url and try to fetch that url with provided cookie. This can lead to forwarding secure headers to 3th party.\n## Remediation\nUpgrade `node-fetch` to version 2.6.7, 3.1.1 or higher.\n## References\n- [Github Commit](https://github.com/node-fetch/node-fetch/commit/1ef4b560a17e644a02a3bfdea7631ffeee578b35)\n- [GitHub Commit](https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10)\n- [GitHub Commit](https://github.com/node-fetch/node-fetch/pull/1449/commits/5c32f002fdd65b1c6a8f1e3620210813d45c7e60)\n- [GitHub PR](https://github.com/node-fetch/node-fetch/pull/1449)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-0235",
          "CVE-2022-1365"
        ],
        "CWE": [
          "CWE-200"
        ]
      },
      "packageName": "node-fetch",
      "proprietary": false,
      "creationTime": "2022-01-17T12:08:00.675849Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-01-17T12:00:01Z",
      "packageManager": "npm",
      "publicationTime": "2022-01-17T16:25:00Z",
      "modificationTime": "2022-11-27T21:31:03.384329Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "libxmljs2@0.26.7",
        "@mapbox/node-pre-gyp@1.0.8",
        "node-fetch@2.6.6"
      ],
      "upgradePath": [
        false,
        "libxmljs2@0.26.7",
        "@mapbox/node-pre-gyp@1.0.8",
        "node-fetch@2.6.7"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "node-fetch",
      "version": "2.6.6"
    },
    {
      "id": "SNYK-JS-NOTEVIL-2385946",
      "title": "Sandbox Bypass",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P",
      "credit": [
        "Cristian-Alexandru Staicu",
        "Abdullah Alhamdan"
      ],
      "semver": {
        "vulnerable": [
          "*"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 6.5,
      "functions": [],
      "malicious": false,
      "moduleName": "notevil",
      "references": [],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "cvssV3BaseScore": 6.5,
          "modificationTime": "2022-03-24T13:10:40.225450Z"
        }
      ],
      "description": "## Overview\n[notevil](https://www.npmjs.com/package/notevil) is a module uses esprima to parse the javascript AST then walks each node and evaluates the result\r\n**Note:**This package has been deprecated.\n\nAffected versions of this package are vulnerable to Sandbox Bypass. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype.\r\n\r\n**Note:**  This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878).\r\n\r\n## PoC:\r\n```js\r\nvar safeEval = require('notevil')\r\n\r\nsafeEval(`  \r\nObject.defineProperty(({})[[\"__proto__\"]][[\"__proto__\"]], 'polluted', {\r\n  value: 'success'\r\n});`);\r\n\r\nconsole.log(polluted);\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nThere is no fixed version for `notevil`.\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-23771"
        ],
        "CWE": [
          "CWE-1321",
          "CWE-265"
        ]
      },
      "packageName": "notevil",
      "proprietary": true,
      "creationTime": "2022-01-27T15:00:51.139678Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-01-27T15:00:48Z",
      "packageManager": "npm",
      "publicationTime": "2022-02-14T16:21:53.819915Z",
      "modificationTime": "2022-03-24T13:10:40.225450Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "notevil@1.3.3"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "notevil",
      "version": "1.3.3"
    },
    {
      "id": "SNYK-JS-QS-3153490",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "Nathan Braun"
      ],
      "semver": {
        "vulnerable": [
          "<6.2.4",
          ">=6.3.0 <6.3.3",
          ">=6.4.0 <6.4.1",
          ">=6.5.0 <6.5.3",
          ">=6.6.0 <6.6.1",
          ">=6.7.0 <6.7.3",
          ">=6.8.0 <6.8.3",
          ">=6.9.0 <6.9.7",
          ">=6.10.0 <6.10.3"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "6.2.4",
        "6.3.3",
        "6.4.1",
        "6.5.3",
        "6.6.1",
        "6.7.3",
        "6.8.3",
        "6.9.7",
        "6.10.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "qs",
      "references": [
        {
          "url": "https://github.com/ljharb/qs/pull/428",
          "title": "GitHub PR"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323",
          "title": "RedHat Bugzilla Bug"
        },
        {
          "url": "https://github.com/n8tz/CVE-2022-24999",
          "title": "Researcher Advisory"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-29T01:11:13.913238Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-12-03T13:46:25.900727Z"
        }
      ],
      "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Prototype Pollution which allows attackers to cause a Node process hang.\r\n\r\n**Note:** In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b&a[__proto__]&a[length]=100000000`.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `qs` to version 6.2.4, 6.3.3, 6.4.1, 6.5.3, 6.6.1, 6.7.3, 6.8.3, 6.9.7, 6.10.3 or higher.\n## References\n- [GitHub PR](https://github.com/ljharb/qs/pull/428)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2150323)\n- [Researcher Advisory](https://github.com/n8tz/CVE-2022-24999)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-24999"
        ],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "qs",
      "proprietary": false,
      "creationTime": "2022-12-04T11:01:47.782869Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-11-26T00:00:00Z",
      "packageManager": "npm",
      "publicationTime": "2022-12-04T12:24:32.307833Z",
      "modificationTime": "2022-12-04T12:24:32.309972Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "body-parser@1.19.1",
        "qs@6.9.6"
      ],
      "upgradePath": [
        false,
        "body-parser@1.19.2",
        "qs@6.9.7"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "qs",
      "version": "6.9.6"
    },
    {
      "id": "SNYK-JS-QS-3153490",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "Nathan Braun"
      ],
      "semver": {
        "vulnerable": [
          "<6.2.4",
          ">=6.3.0 <6.3.3",
          ">=6.4.0 <6.4.1",
          ">=6.5.0 <6.5.3",
          ">=6.6.0 <6.6.1",
          ">=6.7.0 <6.7.3",
          ">=6.8.0 <6.8.3",
          ">=6.9.0 <6.9.7",
          ">=6.10.0 <6.10.3"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "6.2.4",
        "6.3.3",
        "6.4.1",
        "6.5.3",
        "6.6.1",
        "6.7.3",
        "6.8.3",
        "6.9.7",
        "6.10.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "qs",
      "references": [
        {
          "url": "https://github.com/ljharb/qs/pull/428",
          "title": "GitHub PR"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323",
          "title": "RedHat Bugzilla Bug"
        },
        {
          "url": "https://github.com/n8tz/CVE-2022-24999",
          "title": "Researcher Advisory"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-29T01:11:13.913238Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-12-03T13:46:25.900727Z"
        }
      ],
      "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Prototype Pollution which allows attackers to cause a Node process hang.\r\n\r\n**Note:** In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b&a[__proto__]&a[length]=100000000`.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `qs` to version 6.2.4, 6.3.3, 6.4.1, 6.5.3, 6.6.1, 6.7.3, 6.8.3, 6.9.7, 6.10.3 or higher.\n## References\n- [GitHub PR](https://github.com/ljharb/qs/pull/428)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2150323)\n- [Researcher Advisory](https://github.com/n8tz/CVE-2022-24999)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-24999"
        ],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "qs",
      "proprietary": false,
      "creationTime": "2022-12-04T11:01:47.782869Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-11-26T00:00:00Z",
      "packageManager": "npm",
      "publicationTime": "2022-12-04T12:24:32.307833Z",
      "modificationTime": "2022-12-04T12:24:32.309972Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "express@4.17.2",
        "qs@6.9.6"
      ],
      "upgradePath": [
        false,
        "express@4.17.3",
        "qs@6.9.7"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "qs",
      "version": "6.9.6"
    },
    {
      "id": "SNYK-JS-QS-3153490",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "Nathan Braun"
      ],
      "semver": {
        "vulnerable": [
          "<6.2.4",
          ">=6.3.0 <6.3.3",
          ">=6.4.0 <6.4.1",
          ">=6.5.0 <6.5.3",
          ">=6.6.0 <6.6.1",
          ">=6.7.0 <6.7.3",
          ">=6.8.0 <6.8.3",
          ">=6.9.0 <6.9.7",
          ">=6.10.0 <6.10.3"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "6.2.4",
        "6.3.3",
        "6.4.1",
        "6.5.3",
        "6.6.1",
        "6.7.3",
        "6.8.3",
        "6.9.7",
        "6.10.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "qs",
      "references": [
        {
          "url": "https://github.com/ljharb/qs/pull/428",
          "title": "GitHub PR"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150323",
          "title": "RedHat Bugzilla Bug"
        },
        {
          "url": "https://github.com/n8tz/CVE-2022-24999",
          "title": "Researcher Advisory"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-11-29T01:11:13.913238Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-12-03T13:46:25.900727Z"
        }
      ],
      "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Prototype Pollution which allows attackers to cause a Node process hang.\r\n\r\n**Note:** In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b&a[__proto__]&a[length]=100000000`.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `qs` to version 6.2.4, 6.3.3, 6.4.1, 6.5.3, 6.6.1, 6.7.3, 6.8.3, 6.9.7, 6.10.3 or higher.\n## References\n- [GitHub PR](https://github.com/ljharb/qs/pull/428)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2150323)\n- [Researcher Advisory](https://github.com/n8tz/CVE-2022-24999)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-24999"
        ],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "qs",
      "proprietary": false,
      "creationTime": "2022-12-04T11:01:47.782869Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-11-26T00:00:00Z",
      "packageManager": "npm",
      "publicationTime": "2022-12-04T12:24:32.307833Z",
      "modificationTime": "2022-12-04T12:24:32.309972Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "express@4.17.2",
        "body-parser@1.19.1",
        "qs@6.9.6"
      ],
      "upgradePath": [
        false,
        "express@4.17.3",
        "body-parser@1.19.2",
        "qs@6.9.7"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "qs",
      "version": "6.9.6"
    },
    {
      "id": "SNYK-JS-SANITIZEHTML-1070780",
      "title": "Validation Bypass",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P",
      "credit": [
        "Ron Masas",
        "Checkmarx"
      ],
      "semver": {
        "vulnerable": [
          "<2.3.2"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "2.3.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 6.5,
      "functions": [],
      "malicious": false,
      "moduleName": "sanitize-html",
      "references": [
        {
          "url": "https://github.com/apostrophecms/sanitize-html/commit/6012524e7824a2c8f6782b2bc5f93b1261723403",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/apostrophecms/sanitize-html/pull/460",
          "title": "GitHub PR"
        },
        {
          "url": "https://advisory.checkmarx.net/advisory/CX-2021-4309",
          "title": "POC: Potential Exploit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "cvssV3BaseScore": 5.3,
          "modificationTime": "2022-01-03T16:36:59.234021Z"
        }
      ],
      "description": "## Overview\n[sanitize-html](https://github.com/punkave/sanitize-html) is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis\n\nAffected versions of this package are vulnerable to Validation Bypass. There is no proper validation of the hostnames set by the `allowedIframeHostnames` option when the `allowIframeRelativeUrls` is set to `true`. This allows attackers to bypass the hostname whitelist for the iframe element.\n## Details\n\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\n\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\n\nInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\n\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\n \nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \n\n### Types of attacks\nThere are a few methods by which XSS can be manipulated:\n\n|Type|Origin|Description|\n|--|--|--|\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\n\n### Affected environments\nThe following environments are susceptible to an XSS attack:\n\n* Web servers\n* Application servers\n* Web application environments\n\n### How to prevent\nThis section describes the top best practices designed to specifically protect your code: \n\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \n* Give users the option to disable client-side scripts.\n* Redirect invalid requests.\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n## Remediation\nUpgrade `sanitize-html` to version 2.3.2 or higher.\n## References\n- [GitHub Commit](https://github.com/apostrophecms/sanitize-html/commit/6012524e7824a2c8f6782b2bc5f93b1261723403)\n- [GitHub PR](https://github.com/apostrophecms/sanitize-html/pull/460)\n- [POC: Potential Exploit](https://advisory.checkmarx.net/advisory/CX-2021-4309)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-26540"
        ],
        "CWE": [
          "CWE-20"
        ],
        "GHSA": [
          "GHSA-mjxr-4v3x-q3m4"
        ]
      },
      "packageName": "sanitize-html",
      "proprietary": false,
      "creationTime": "2021-02-09T08:21:52.232749Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-02-09T08:07:33Z",
      "packageManager": "npm",
      "publicationTime": "2021-02-09T16:34:45.881363Z",
      "modificationTime": "2022-01-03T16:36:59.234021Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@2.3.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "sanitize-html",
      "version": "1.4.2"
    },
    {
      "id": "SNYK-JS-SANITIZEHTML-1070786",
      "title": "Access Restriction Bypass",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "credit": [
        "Ron Masas",
        "Checkmarx"
      ],
      "semver": {
        "vulnerable": [
          "<2.3.1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.3.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 6.5,
      "functions": [],
      "malicious": false,
      "moduleName": "sanitize-html",
      "references": [
        {
          "url": "https://github.com/apostrophecms/sanitize-html/pull/458",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "cvssV3BaseScore": 5.3,
          "modificationTime": "2022-04-27T01:10:36.338203Z"
        }
      ],
      "description": "## Overview\n[sanitize-html](https://github.com/punkave/sanitize-html) is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis\n\nAffected versions of this package are vulnerable to Access Restriction Bypass. Internationalized domain name (IDN) is not properly handled. This allows attackers to bypass hostname whitelist validation set by the `allowedIframeHostnames` option.\n## Remediation\nUpgrade `sanitize-html` to version 2.3.1 or higher.\n## References\n- [GitHub PR](https://github.com/apostrophecms/sanitize-html/pull/458)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-26539"
        ],
        "CWE": [
          "CWE-20"
        ],
        "GHSA": [
          "GHSA-rjqq-98f6-6j3r"
        ]
      },
      "packageName": "sanitize-html",
      "proprietary": false,
      "creationTime": "2021-02-09T08:37:16.368073Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-02-09T08:21:55Z",
      "packageManager": "npm",
      "publicationTime": "2021-02-09T16:34:49Z",
      "modificationTime": "2022-04-27T01:10:36.338203Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@2.3.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "sanitize-html",
      "version": "1.4.2"
    },
    {
      "id": "SNYK-JS-SANITIZEHTML-2957526",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "credit": [
        "Nariyoshi Chida of NTT Security Japan"
      ],
      "semver": {
        "vulnerable": [
          "<2.7.1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.7.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.3,
      "functions": [],
      "malicious": false,
      "moduleName": "sanitize-html",
      "references": [
        {
          "url": "https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/apostrophecms/sanitize-html/pull/557",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-09-02T01:11:51.670814Z"
        }
      ],
      "description": "## Overview\n[sanitize-html](https://github.com/punkave/sanitize-html) is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `sanitize-html` to version 2.7.1 or higher.\n## References\n- [GitHub Commit](https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c)\n- [GitHub PR](https://github.com/apostrophecms/sanitize-html/pull/557)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-25887"
        ],
        "CWE": [
          "CWE-1333"
        ]
      },
      "packageName": "sanitize-html",
      "proprietary": true,
      "creationTime": "2022-07-21T08:00:56.827849Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-21T07:37:40Z",
      "packageManager": "npm",
      "publicationTime": "2022-08-29T13:28:12.439235Z",
      "modificationTime": "2022-09-02T01:11:51.670814Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@2.7.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "sanitize-html",
      "version": "1.4.2"
    },
    {
      "id": "SNYK-JS-SANITIZEHTML-585892",
      "title": "Arbitrary Code Execution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
      "credit": [
        "mikesamuel"
      ],
      "semver": {
        "vulnerable": [
          "<2.0.0-beta"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.0.0-beta"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "critical",
      "cvssScore": 9.4,
      "functions": [],
      "malicious": false,
      "moduleName": "sanitize-html",
      "references": [
        {
          "url": "https://github.com/apostrophecms/sanitize-html/pull/156",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\n[sanitize-html](https://github.com/punkave/sanitize-html) is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis\n\nAffected versions of this package are vulnerable to Arbitrary Code Execution. Tag transformations which turn an attribute value into a text node using `transformTags` could be vulnerable to code execution.\n## Remediation\nUpgrade `sanitize-html` to version 2.0.0-beta or higher.\n## References\n- [GitHub PR](https://github.com/apostrophecms/sanitize-html/pull/156)\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-94"
        ]
      },
      "packageName": "sanitize-html",
      "proprietary": false,
      "creationTime": "2020-07-17T15:02:43.082824Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2020-09-07T09:46:18Z",
      "packageManager": "npm",
      "publicationTime": "2020-09-07T09:46:10Z",
      "modificationTime": "2020-09-07T15:37:06.961614Z",
      "socialTrendAlert": false,
      "severityWithCritical": "critical",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@2.0.0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "sanitize-html",
      "version": "1.4.2"
    },
    {
      "id": "npm:sanitize-html:20141024",
      "title": "Cross-site Scripting (XSS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<1.4.3"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "1.4.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 4.3,
      "functions": [],
      "malicious": false,
      "moduleName": "sanitize-html",
      "references": [
        {
          "url": "https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json",
          "title": "CVE"
        },
        {
          "url": "https://github.com/punkave/sanitize-html/issues/29",
          "title": "GitHub Issue"
        },
        {
          "url": "https://nodesecurity.io/advisories/135",
          "title": "Node Security Advisories"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cvssV3BaseScore": 6.1,
          "modificationTime": "2022-01-03T17:40:52.414772Z"
        }
      ],
      "description": "## Overview\r\n\r\nSince the sanitize-html module trusts 'text' coming from htmlparser2, and outputs it without further escaping (because htmlparser2 does not decode entities in text before delivering it), this results in an XSS attack vector if sanitize-html ignores the img tag (according to user-configured filter rules) but passes the text intact, as it must do to keep any text in documents.\r\n\r\n\r\n## References\r\n- https://github.com/punkave/sanitize-html/issues/29",
      "identifiers": {
        "CVE": [
          "CVE-2016-1000237"
        ],
        "CWE": [
          "CWE-79"
        ],
        "GHSA": [
          "GHSA-3j7m-hmh3-9jmp"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-SANITIZEHTML-10048"
        ]
      },
      "packageName": "sanitize-html",
      "proprietary": false,
      "creationTime": "2015-11-06T02:09:36.180000Z",
      "functions_new": [],
      "alternativeIds": [
        "SNYK-JS-SANITIZEHTML-10048"
      ],
      "disclosureTime": "2015-11-06T02:09:36Z",
      "packageManager": "npm",
      "publicationTime": "2015-11-06T02:09:36Z",
      "modificationTime": "2022-01-03T17:40:52.414772Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@1.4.3"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "sanitize-html",
      "version": "1.4.2"
    },
    {
      "id": "npm:sanitize-html:20160801",
      "title": "Cross-site Scripting (XSS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
      "credit": [
        "Björn Kimminich"
      ],
      "semver": {
        "vulnerable": [
          "<=1.4.2"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 4.7,
      "functions": [],
      "malicious": false,
      "moduleName": "sanitize-html",
      "references": [
        {
          "url": "https://github.com/punkave/sanitize-html/commit/762fbc7bba389f3f789cc291c1eb2b64f60f2caf",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/punkave/sanitize-html/issues/29",
          "title": "GitHub Issue"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\nSanitization of HTML strings is not applied recursively to input, allowing an attacker to potentially inject script and other markup.\n\nSource: _Node Security Project_\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n\n## Remediation\nUpgrade `sanitize-html` to `1.4.3` or later\n\n## References\n- https://github.com/punkave/sanitize-html/issues/29\n- https://github.com/punkave/sanitize-html/commit/762fbc7bba389f3f789cc291c1eb2b64f60f2caf\n\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-79"
        ],
        "NSP": [
          "135"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-SANITIZEHTML-10127"
        ]
      },
      "packageName": "sanitize-html",
      "proprietary": false,
      "creationTime": "2016-08-02T08:28:08.097000Z",
      "functions_new": [],
      "alternativeIds": [
        "SNYK-JS-SANITIZEHTML-10127"
      ],
      "disclosureTime": "2016-08-01T18:02:31Z",
      "packageManager": "npm",
      "publicationTime": "2016-08-01T18:02:31Z",
      "modificationTime": "2020-12-14T14:41:17.951016Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@1.4.3"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "sanitize-html",
      "version": "1.4.2"
    },
    {
      "id": "npm:sanitize-html:20161026",
      "title": "Cross-site Scripting (XSS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C",
      "credit": [
        "Andrew Krasichkov"
      ],
      "semver": {
        "vulnerable": [
          "<1.11.4"
        ]
      },
      "exploit": "Functional",
      "fixedIn": [
        "1.11.4"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "medium",
      "cvssScore": 5.4,
      "functions": [],
      "malicious": false,
      "moduleName": "sanitize-html",
      "references": [
        {
          "url": "https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/punkave/sanitize-html/issues/100",
          "title": "GitHub Issue"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cvssV3BaseScore": 6.1,
          "modificationTime": "2022-01-03T16:21:19.197646Z"
        }
      ],
      "description": "## Overview\n[`sanitize-html`](https://www.npmjs.com/package/sanitize-html) is a library for scrubbing html input of malicious values.\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks. If at least one `nonTextTags` tag is allowed, a malicious user may potentially conduct an XSS attack.\n\n**PoC:**\n```js\nvar sanitizeHtml = require('sanitize-html');\n\nvar dirty = '!<textarea>&lt;/textarea&gt;<svg/onload=prompt`xs`&gt;</textarea>!';\nvar clean = sanitizeHtml(dirty, {\n    allowedTags: [ 'textarea' ]\n});\n\nconsole.log(clean);\n\n// !<textarea></textarea><svg/onload=prompt`xs`></textarea>!\n```\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n\n## Remediation\nUpgrade `sanitize-html` to version 1.11.4 or later.\n\n## References\n- [GitHub Issue](https://github.com/punkave/sanitize-html/issues/100)\n- [GitHub Commit](https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403)\n",
      "identifiers": {
        "CVE": [
          "CVE-2017-16016"
        ],
        "CWE": [
          "CWE-79"
        ],
        "NSP": [
          "154"
        ],
        "GHSA": [
          "GHSA-xc6g-ggrc-qq4r"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-SANITIZEHTML-10461"
        ]
      },
      "packageName": "sanitize-html",
      "proprietary": false,
      "creationTime": "2017-04-12T10:49:58.283000Z",
      "functions_new": [],
      "alternativeIds": [
        "SNYK-JS-SANITIZEHTML-10461"
      ],
      "disclosureTime": "2016-03-26T23:49:58.283000Z",
      "packageManager": "npm",
      "publicationTime": "2017-04-12T11:00:58.283000Z",
      "modificationTime": "2022-01-03T16:21:19.197646Z",
      "socialTrendAlert": false,
      "severityWithCritical": "medium",
      "from": [
        "juice-shop@12.3.0",
        "sanitize-html@1.4.2"
      ],
      "upgradePath": [
        false,
        "sanitize-html@1.11.4"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "sanitize-html",
      "version": "1.4.2"
    },
    {
      "id": "SNYK-JS-SEQUELIZE-2932027",
      "title": "SQL Injection",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H/E:P",
      "credit": [
        "unknown"
      ],
      "semver": {
        "vulnerable": [
          "<6.19.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "6.19.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "critical",
      "cvssScore": 9.4,
      "functions": [],
      "malicious": false,
      "moduleName": "sequelize",
      "references": [
        {
          "url": "https://github.com/sequelize/sequelize/issues/14519",
          "title": "Github Issues"
        },
        {
          "url": "https://github.com/sequelize/sequelize/releases/tag/v6.19.1",
          "title": "Github Releases"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\n[sequelize](http://docs.sequelizejs.com/) is a promise-based Node.js ORM for Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server.\n\nAffected versions of this package are vulnerable to SQL Injection via the `replacements` statement. It allowed a malicious actor to pass dangerous values such as `OR true; DROP TABLE` users through replacements which would result in arbitrary SQL execution.\n## Remediation\nUpgrade `sequelize` to version 6.19.1 or higher.\n## References\n- [Github Issues](https://github.com/sequelize/sequelize/issues/14519)\n- [Github Releases](https://github.com/sequelize/sequelize/releases/tag/v6.19.1)\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-89"
        ]
      },
      "packageName": "sequelize",
      "proprietary": false,
      "creationTime": "2022-06-19T12:09:54.177599Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-06-19T11:53:15Z",
      "packageManager": "npm",
      "publicationTime": "2022-06-19T15:47:56.935707Z",
      "modificationTime": "2022-06-19T15:47:56.937664Z",
      "socialTrendAlert": false,
      "severityWithCritical": "critical",
      "from": [
        "juice-shop@12.3.0",
        "sequelize@5.22.5"
      ],
      "upgradePath": [
        false,
        "sequelize@6.19.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "sequelize",
      "version": "5.22.5"
    },
    {
      "id": "SNYK-JS-SEQUELIZE-2959225",
      "title": "SQL Injection",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
      "credit": [
        "claytoneast"
      ],
      "semver": {
        "vulnerable": [
          "<6.21.2"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "6.21.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7,
      "functions": [],
      "malicious": false,
      "moduleName": "sequelize",
      "references": [
        {
          "url": "https://github.com/sequelize/sequelize/commit/7bb60e3531127da684cc1f75307410c53dfc9c8c",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/sequelize/sequelize/issues/14601",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/sequelize/sequelize/pull/14678",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\n[sequelize](http://docs.sequelizejs.com/) is a promise-based Node.js ORM for Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server.\n\nAffected versions of this package are vulnerable to SQL Injection due to an improper escaping for multiple appearances of `$` in a string.\n## Remediation\nUpgrade `sequelize` to version 6.21.2 or higher.\n## References\n- [GitHub Commit](https://github.com/sequelize/sequelize/commit/7bb60e3531127da684cc1f75307410c53dfc9c8c)\n- [GitHub Issue](https://github.com/sequelize/sequelize/issues/14601)\n- [GitHub PR](https://github.com/sequelize/sequelize/pull/14678)\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-89"
        ]
      },
      "packageName": "sequelize",
      "proprietary": false,
      "creationTime": "2022-07-22T12:54:48.967133Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-07-22T12:54:09Z",
      "packageManager": "npm",
      "publicationTime": "2022-07-22T12:55:28Z",
      "modificationTime": "2022-08-05T10:47:08.112158Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sequelize@5.22.5"
      ],
      "upgradePath": [
        false,
        "sequelize@6.21.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "sequelize",
      "version": "5.22.5"
    },
    {
      "id": "SNYK-JS-SIMPLEGET-2361683",
      "title": "Information Exposure",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P",
      "credit": [
        "Unknown"
      ],
      "semver": {
        "vulnerable": [
          "<2.8.2",
          ">=3.0.0 <3.1.1",
          ">=4.0.0 <4.0.1"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "2.8.2",
        "3.1.1",
        "4.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 8.8,
      "functions": [],
      "malicious": false,
      "moduleName": "simple-get",
      "references": [
        {
          "url": "https://github.com/feross/simple-get/commit/43c272db3e4b1383cb03d80338dba3e08c451641",
          "title": "Github Commit"
        },
        {
          "url": "https://github.com/feross/simple-get/commit/6eb82c090e30e7146fa5e9ae7212ca16b24b08b4",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/feross/simple-get/commit/e4af095e06cd69a9235013e8507e220a79b9684f",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-02-02T04:10:10.987374Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Information Exposure. When getting `Location response` header after fetching a remote url with Cookie, it will follow that url and fetch it with the provided cookie which will be then leaked to the attacker .\n## Remediation\nUpgrade `simple-get` to version 2.8.2, 3.1.1, 4.0.1 or higher.\n## References\n- [Github Commit](https://github.com/feross/simple-get/commit/43c272db3e4b1383cb03d80338dba3e08c451641)\n- [GitHub Commit](https://github.com/feross/simple-get/commit/6eb82c090e30e7146fa5e9ae7212ca16b24b08b4)\n- [GitHub Commit](https://github.com/feross/simple-get/commit/e4af095e06cd69a9235013e8507e220a79b9684f)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-0355"
        ],
        "CWE": [
          "CWE-200"
        ]
      },
      "packageName": "simple-get",
      "proprietary": false,
      "creationTime": "2022-01-26T09:25:03.374211Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-01-26T09:13:34Z",
      "packageManager": "npm",
      "publicationTime": "2022-01-26T16:17:22Z",
      "modificationTime": "2022-02-03T08:12:41.755229Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "grunt-contrib-compress@1.6.0",
        "iltorb@2.4.5",
        "prebuild-install@5.3.6",
        "simple-get@3.1.0"
      ],
      "upgradePath": [
        false,
        "grunt-contrib-compress@1.6.0",
        "iltorb@2.4.5",
        "prebuild-install@5.3.6",
        "simple-get@3.1.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "simple-get",
      "version": "3.1.0"
    },
    {
      "id": "SNYK-JS-SOCKETIOPARSER-3091012",
      "title": "Improper Input Validation",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "credit": [
        "Thomas Rinsma"
      ],
      "semver": {
        "vulnerable": [
          "<3.3.3",
          ">=3.4.0 <3.4.2",
          ">=4.0.0 <4.0.5",
          ">=4.1.0 <4.2.1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.3.3",
        "3.4.2",
        "4.0.5",
        "4.2.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "critical",
      "cvssScore": 9.8,
      "functions": [],
      "malicious": false,
      "moduleName": "socket.io-parser",
      "references": [
        {
          "url": "https://github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8de7fa94a80d4",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/socketio/socket.io-parser/commit/b5d0cb7dc56a0601a09b056beaeeb0e43b160050",
          "title": "GitHub Commit"
        },
        {
          "url": "https://csirt.divd.nl/cases/DIVD-2022-00045",
          "title": "Vulnerability Report"
        },
        {
          "url": "https://csirt.divd.nl/cves/CVE-2022-2421",
          "title": "Vulnerability Report"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "critical",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 9.8,
          "modificationTime": "2022-11-03T01:10:50.144673Z"
        }
      ],
      "description": "## Overview\n\n[socket.io-parser](https://www.npmjs.org/package/socket.io-parser) is a socket.io protocol parser\n\n\nAffected versions of this package are vulnerable to Improper Input Validation.\nwhen parsing attachments containing untrusted user input. Attackers can overwrite the `_placeholder` object to place references to functions in query objects.\r\n\r\n## PoC\r\n\r\n```js\r\nconst decoder = new Decoder();\r\n\r\ndecoder.on(\"decoded\", (packet) => {\r\n  console.log(packet.data); // prints [ 'hello', [Function: splice] ]\r\n})\r\n\r\ndecoder.add('51-[\"hello\",{\"_placeholder\":true,\"num\":\"splice\"}]');\r\ndecoder.add(Buffer.from(\"world\"));\r\n```\n\n## Remediation\n\nUpgrade `socket.io-parser` to version 3.3.3, 3.4.2, 4.0.5, 4.2.1 or higher.\n\n\n## References\n\n- [GitHub Commit](https://github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8de7fa94a80d4)\n\n- [GitHub Commit](https://github.com/socketio/socket.io-parser/commit/b5d0cb7dc56a0601a09b056beaeeb0e43b160050)\n\n- [Vulnerability Report](https://csirt.divd.nl/cases/DIVD-2022-00045)\n\n- [Vulnerability Report](https://csirt.divd.nl/cves/CVE-2022-2421)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-2421"
        ],
        "CWE": [
          "CWE-89"
        ],
        "GHSA": [
          "GHSA-qm95-pgcg-qqfq"
        ]
      },
      "packageName": "socket.io-parser",
      "proprietary": false,
      "creationTime": "2022-10-30T11:44:09.888401Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-26T12:57:39Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-30T12:46:06.853890Z",
      "modificationTime": "2022-11-15T14:07:51.338748Z",
      "socialTrendAlert": false,
      "severityWithCritical": "critical",
      "from": [
        "juice-shop@12.3.0",
        "socket.io@2.4.1",
        "socket.io-client@2.4.0",
        "socket.io-parser@3.3.2"
      ],
      "upgradePath": [
        false,
        "socket.io@2.4.1",
        "socket.io-client@2.4.0",
        "socket.io-parser@3.3.3"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "socket.io-parser",
      "version": "3.3.2"
    },
    {
      "id": "SNYK-JS-SOCKETIOPARSER-3091012",
      "title": "Improper Input Validation",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "credit": [
        "Thomas Rinsma"
      ],
      "semver": {
        "vulnerable": [
          "<3.3.3",
          ">=3.4.0 <3.4.2",
          ">=4.0.0 <4.0.5",
          ">=4.1.0 <4.2.1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.3.3",
        "3.4.2",
        "4.0.5",
        "4.2.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "critical",
      "cvssScore": 9.8,
      "functions": [],
      "malicious": false,
      "moduleName": "socket.io-parser",
      "references": [
        {
          "url": "https://github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8de7fa94a80d4",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/socketio/socket.io-parser/commit/b5d0cb7dc56a0601a09b056beaeeb0e43b160050",
          "title": "GitHub Commit"
        },
        {
          "url": "https://csirt.divd.nl/cases/DIVD-2022-00045",
          "title": "Vulnerability Report"
        },
        {
          "url": "https://csirt.divd.nl/cves/CVE-2022-2421",
          "title": "Vulnerability Report"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "critical",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 9.8,
          "modificationTime": "2022-11-03T01:10:50.144673Z"
        }
      ],
      "description": "## Overview\n\n[socket.io-parser](https://www.npmjs.org/package/socket.io-parser) is a socket.io protocol parser\n\n\nAffected versions of this package are vulnerable to Improper Input Validation.\nwhen parsing attachments containing untrusted user input. Attackers can overwrite the `_placeholder` object to place references to functions in query objects.\r\n\r\n## PoC\r\n\r\n```js\r\nconst decoder = new Decoder();\r\n\r\ndecoder.on(\"decoded\", (packet) => {\r\n  console.log(packet.data); // prints [ 'hello', [Function: splice] ]\r\n})\r\n\r\ndecoder.add('51-[\"hello\",{\"_placeholder\":true,\"num\":\"splice\"}]');\r\ndecoder.add(Buffer.from(\"world\"));\r\n```\n\n## Remediation\n\nUpgrade `socket.io-parser` to version 3.3.3, 3.4.2, 4.0.5, 4.2.1 or higher.\n\n\n## References\n\n- [GitHub Commit](https://github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8de7fa94a80d4)\n\n- [GitHub Commit](https://github.com/socketio/socket.io-parser/commit/b5d0cb7dc56a0601a09b056beaeeb0e43b160050)\n\n- [Vulnerability Report](https://csirt.divd.nl/cases/DIVD-2022-00045)\n\n- [Vulnerability Report](https://csirt.divd.nl/cves/CVE-2022-2421)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-2421"
        ],
        "CWE": [
          "CWE-89"
        ],
        "GHSA": [
          "GHSA-qm95-pgcg-qqfq"
        ]
      },
      "packageName": "socket.io-parser",
      "proprietary": false,
      "creationTime": "2022-10-30T11:44:09.888401Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-10-26T12:57:39Z",
      "packageManager": "npm",
      "publicationTime": "2022-10-30T12:46:06.853890Z",
      "modificationTime": "2022-11-15T14:07:51.338748Z",
      "socialTrendAlert": false,
      "severityWithCritical": "critical",
      "from": [
        "juice-shop@12.3.0",
        "socket.io@2.4.1",
        "socket.io-parser@3.4.1"
      ],
      "upgradePath": [
        false,
        "socket.io@2.4.1",
        "socket.io-parser@3.4.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "socket.io-parser",
      "version": "3.4.1"
    },
    {
      "id": "SNYK-JS-SQLITE3-2388645",
      "title": "Denial of Service (DoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
      "credit": [
        "Cristian-Alexandru Staicu"
      ],
      "semver": {
        "vulnerable": [
          "<5.0.3"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "5.0.3"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "sqlite3",
      "references": [
        {
          "url": "https://github.com/TryGhost/node-sqlite3/commit/593c9d498be2510d286349134537e3bf89401c4a",
          "title": "Github Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-05-12T01:10:45.656851Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2022-10-27T03:36:39.996011Z"
        }
      ],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.\r\n\r\n## PoC\r\n```js\r\nlet sqlite3 = require('sqlite3').verbose(); \r\nlet db = new sqlite3.Database(':memory:'); \r\ndb.serialize(function() { \r\n  db.run(\"CREATE TABLE lorem (info TEXT)\"); \r\n  db.run(\"INSERT INTO lorem VALUES (?)\", [{toString: 23}]);  \r\n});\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `sqlite3` to version 5.0.3 or higher.\n## References\n- [Github Commit](https://github.com/TryGhost/node-sqlite3/commit/593c9d498be2510d286349134537e3bf89401c4a)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-21227"
        ],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "sqlite3",
      "proprietary": true,
      "creationTime": "2022-01-31T15:28:38.353219Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-01-31T15:04:53Z",
      "packageManager": "npm",
      "publicationTime": "2022-04-28T12:02:38.111917Z",
      "modificationTime": "2022-10-27T03:36:39.996011Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.3"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "sqlite3",
      "version": "5.0.2"
    },
    {
      "id": "SNYK-JS-TAR-1536528",
      "title": "Arbitrary File Overwrite",
      "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "credit": [
        "ginkoid",
        "chen-robert"
      ],
      "semver": {
        "vulnerable": [
          "<3.2.3",
          ">=4.0.0 <4.4.15",
          ">=5.0.0 <5.0.7",
          ">=6.0.0 <6.1.2"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.2.3",
        "4.4.15",
        "5.0.7",
        "6.1.2"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 8.2,
      "functions": [],
      "malicious": false,
      "moduleName": "tar",
      "references": [
        {
          "url": "https://github.com/npm/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 8.1,
          "modificationTime": "2022-07-03T01:10:57.821855Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 8.1,
          "modificationTime": "2022-05-18T11:03:10.716138Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 8.1,
          "modificationTime": "2022-11-27T21:12:46.430209Z"
        }
      ],
      "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Arbitrary File Overwrite. This is due to insufficient symlink protection.\r\n`node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks.  Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created.\r\n\r\nThis logic is insufficient when extracting tar files that contain both a directory and a symlink with the same name as the directory. This order of operations results in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to `mkdir` for that directory are skipped.\r\nHowever, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it is possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location.\n## Remediation\nUpgrade `tar` to version 3.2.3, 4.4.15, 5.0.7, 6.1.2 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-32803"
        ],
        "CWE": [
          "CWE-22"
        ],
        "NSP": [
          "1771"
        ],
        "GHSA": [
          "GHSA-r628-mhmh-qjhw"
        ]
      },
      "packageName": "tar",
      "proprietary": false,
      "creationTime": "2021-08-04T06:32:44.747650Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-08-04T06:13:39Z",
      "packageManager": "npm",
      "publicationTime": "2021-08-04T07:24:54.942553Z",
      "modificationTime": "2022-11-27T21:12:46.430209Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "tar@2.2.2"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.3",
        "node-gyp@8.0.0",
        "tar@6.1.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "tar",
      "version": "2.2.2"
    },
    {
      "id": "SNYK-JS-TAR-1536531",
      "title": "Arbitrary File Overwrite",
      "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "credit": [
        "ginkoid",
        "chen-robert"
      ],
      "semver": {
        "vulnerable": [
          "<3.2.2",
          ">=4.0.0 <4.4.14",
          ">=5.0.0 <5.0.6",
          ">=6.0.0 <6.1.1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.2.2",
        "4.4.14",
        "5.0.6",
        "6.1.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 8.2,
      "functions": [],
      "malicious": false,
      "moduleName": "tar",
      "references": [
        {
          "url": "https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 8.1,
          "modificationTime": "2022-05-18T11:04:11.840455Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 8.1,
          "modificationTime": "2022-04-26T01:10:35.141363Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 8.1,
          "modificationTime": "2022-11-27T21:12:26.283913Z"
        }
      ],
      "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Arbitrary File Overwrite. This is due to insufficient absolute path sanitization.\r\n\r\n`node-tar` aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example, the path `/home/user/.bashrc` would turn into `home/user/.bashrc`.\r\n\r\nThis logic is insufficient when file paths contain repeated path roots such as `////home/user/.bashrc`. `node-tar` only strips a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) still resolves to an absolute path.\n## Remediation\nUpgrade `tar` to version 3.2.2, 4.4.14, 5.0.6, 6.1.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-32804"
        ],
        "CWE": [
          "CWE-22"
        ],
        "NSP": [
          "1770"
        ],
        "GHSA": [
          "GHSA-3jfq-g458-7qm9"
        ]
      },
      "packageName": "tar",
      "proprietary": false,
      "creationTime": "2021-08-04T06:40:36.725155Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-08-04T06:33:52Z",
      "packageManager": "npm",
      "publicationTime": "2021-08-04T07:24:55.599985Z",
      "modificationTime": "2022-11-27T21:12:26.283913Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "tar@2.2.2"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.3",
        "node-gyp@8.0.0",
        "tar@6.1.1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "tar",
      "version": "2.2.2"
    },
    {
      "id": "SNYK-JS-TAR-1536758",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:R",
      "credit": [
        "@isaacs"
      ],
      "semver": {
        "vulnerable": [
          ">=6.0.0 <6.1.4",
          ">=5.0.0 <5.0.8",
          "<4.4.16"
        ]
      },
      "exploit": "Unproven",
      "fixedIn": [
        "6.1.4",
        "5.0.8",
        "4.4.16"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "low",
      "cvssScore": 3.7,
      "functions": [],
      "malicious": false,
      "moduleName": "tar",
      "references": [
        {
          "url": "https://github.com/npm/node-tar/commit/06cbde5935aa7643f578f874de84a7da2a74fe3a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/npm/node-tar/commit/adf35115dbc6e7a479fe3c38f859baf6ffff7a7a",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/npm/node-tar/commit/d3d5a4e4560f18131e64fc62f5a281b238ef2ecf",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). When stripping the trailing slash from `files` arguments, the  `f.replace(/\\/+$/, '')` performance of this function can exponentially degrade when `f` contains many `/` characters resulting in ReDoS. \r\n\r\nThis vulnerability is not likely to be exploitable as it requires that the untrusted input is being passed into the `tar.extract()` or `tar.list()` array of entries to parse/extract, which would be unusual.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `tar` to version 6.1.4, 5.0.8, 4.4.16 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/node-tar/commit/06cbde5935aa7643f578f874de84a7da2a74fe3a)\n- [GitHub Commit](https://github.com/npm/node-tar/commit/adf35115dbc6e7a479fe3c38f859baf6ffff7a7a)\n- [GitHub Commit](https://github.com/npm/node-tar/commit/d3d5a4e4560f18131e64fc62f5a281b238ef2ecf)\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-400"
        ]
      },
      "packageName": "tar",
      "proprietary": false,
      "creationTime": "2021-08-05T12:41:27.304655Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-08-05T12:38:55Z",
      "packageManager": "npm",
      "publicationTime": "2021-08-05T14:33:10Z",
      "modificationTime": "2021-08-11T16:47:34.347918Z",
      "socialTrendAlert": false,
      "severityWithCritical": "low",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "tar@2.2.2"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.3",
        "node-gyp@8.0.0",
        "tar@6.1.4"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "tar",
      "version": "2.2.2"
    },
    {
      "id": "SNYK-JS-TAR-1579147",
      "title": "Arbitrary File Write",
      "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
      "credit": [
        "ginkoid",
        "chen-robert"
      ],
      "semver": {
        "vulnerable": [
          ">=6.0.0 <6.1.7",
          ">=5.0.0 <5.0.8",
          "<4.4.16"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "6.1.7",
        "5.0.8",
        "4.4.16"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 8.5,
      "functions": [],
      "malicious": false,
      "moduleName": "tar",
      "references": [
        {
          "url": "https://github.com/npm/node-tar/commit/53602669f58ddbeb3294d7196b3320aaaed22728",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "cvssV3BaseScore": 8.6,
          "modificationTime": "2022-04-26T01:10:35.689720Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 8.1,
          "modificationTime": "2022-05-03T21:17:39.668619Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 8.1,
          "modificationTime": "2022-09-13T21:08:20.388255Z"
        }
      ],
      "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Arbitrary File Write. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.\r\n\r\nThis logic was insufficient when extracting `tar` files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both `\\` and `/` characters as path separators. However, `\\` is a valid filename character on posix systems.\r\n\r\nBy first creating a directory, and then replacing that directory with a symlink, it is possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted `tar` file to symlink into an arbitrary location. This can lead to extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.\r\n\r\nAdditionally, a similar confusion could arise on case-insensitive filesystems. If a `tar` archive contained a directory at `FOO`, followed by a symbolic link named `foo`, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the `FOO` directory would then be placed in the target of the symbolic link, thinking that the directory had already been created.\n## Remediation\nUpgrade `tar` to version 6.1.7, 5.0.8, 4.4.16 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/node-tar/commit/53602669f58ddbeb3294d7196b3320aaaed22728)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-37701"
        ],
        "CWE": [
          "CWE-22"
        ],
        "NSP": [
          "1779"
        ],
        "GHSA": [
          "GHSA-9r2w-394v-53qc"
        ]
      },
      "packageName": "tar",
      "proprietary": false,
      "creationTime": "2021-09-01T05:55:13.724747Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-01T05:45:02Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-01T07:55:13.009873Z",
      "modificationTime": "2022-09-13T21:08:20.388255Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "tar@2.2.2"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.3",
        "node-gyp@8.0.0",
        "tar@6.1.7"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "tar",
      "version": "2.2.2"
    },
    {
      "id": "SNYK-JS-TAR-1579152",
      "title": "Arbitrary File Write",
      "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
      "credit": [
        "ginkoid",
        "chen-robert",
        "JarLob"
      ],
      "semver": {
        "vulnerable": [
          ">=6.0.0 <6.1.9",
          ">=5.0.0 <5.0.10",
          "<4.4.18"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "6.1.9",
        "5.0.10",
        "4.4.18"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 8.5,
      "functions": [],
      "malicious": false,
      "moduleName": "tar",
      "references": [
        {
          "url": "https://github.com/npm/node-tar/commit/b6162c7fafe797f856564ef37f4b82747f051455",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "cvssV3BaseScore": 8.6,
          "modificationTime": "2022-04-26T01:10:35.782070Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 8.1,
          "modificationTime": "2022-05-03T21:18:09.683772Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 8.1,
          "modificationTime": "2022-09-13T18:47:58.237883Z"
        }
      ],
      "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Arbitrary File Write. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.\r\n\r\nThis logic is insufficient when extracting `tar` files that contain two directories and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 \"short path\" counterparts.\r\nA specially crafted `tar` archive can include directories with two forms of the path that resolve to the same file system entity, followed by a symbolic link with a name in the first form, lastly followed by a file using the second form. This leads to bypassing `node-tar` symlink checks on directories, essentially allowing an untrusted `tar` file to symlink into an arbitrary location and extracting arbitrary files into that location.\n## Remediation\nUpgrade `tar` to version 6.1.9, 5.0.10, 4.4.18 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/node-tar/commit/b6162c7fafe797f856564ef37f4b82747f051455)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-37712"
        ],
        "CWE": [
          "CWE-22"
        ],
        "NSP": [
          "1780"
        ],
        "GHSA": [
          "GHSA-qq89-hq3f-393p"
        ]
      },
      "packageName": "tar",
      "proprietary": false,
      "creationTime": "2021-09-01T06:04:41.432860Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-01T05:57:49Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-01T07:55:12.359155Z",
      "modificationTime": "2022-09-13T18:47:58.237883Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "tar@2.2.2"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.3",
        "node-gyp@8.0.0",
        "tar@6.1.9"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "tar",
      "version": "2.2.2"
    },
    {
      "id": "SNYK-JS-TAR-1579155",
      "title": "Arbitrary File Write",
      "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
      "credit": [
        "ginkoid",
        "chen-robert",
        "JarLob"
      ],
      "semver": {
        "vulnerable": [
          ">=6.0.0 <6.1.9",
          ">=5.0.0 <5.0.10",
          "<4.4.18"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "6.1.9",
        "5.0.10",
        "4.4.18"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": "This vulnerability is only applicable on Windows operating system"
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 8.5,
      "functions": [],
      "malicious": false,
      "moduleName": "tar",
      "references": [
        {
          "url": "https://github.com/npm/node-tar/commit/875a37e3ec031186fc6599f6807341f56c584598",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
          "cvssV3BaseScore": 8.2,
          "modificationTime": "2022-05-03T21:18:12.740276Z"
        },
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "cvssV3BaseScore": 8.6,
          "modificationTime": "2022-04-26T01:10:36.631320Z"
        }
      ],
      "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Arbitrary File Write. `node-tar` aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory.\r\n\r\nThis logic is insufficient on Windows systems when extracting `tar` files that contain a path that is not an absolute path, but specify a drive letter different from the extraction target, such as `C:some\\path`. If the drive letter does not match the extraction target, for example `D:\\extraction\\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` resolves against the current working directory on the `C:` drive, rather than the extraction target directory.\r\n\r\nAdditionally, a `..` portion of the path can occur immediately after the drive letter, such as `C:../foo`, and is not properly sanitized by the logic that checks for `..` within the normalized and split portions of the path.\r\n\r\n**Note:** This only affects users of `node-tar` on Windows systems.\n## Remediation\nUpgrade `tar` to version 6.1.9, 5.0.10, 4.4.18 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/node-tar/commit/875a37e3ec031186fc6599f6807341f56c584598)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-37713"
        ],
        "CWE": [
          "CWE-22"
        ],
        "NSP": [
          "1781"
        ],
        "GHSA": [
          "GHSA-5955-9wpr-37jh"
        ]
      },
      "packageName": "tar",
      "proprietary": false,
      "creationTime": "2021-09-01T06:09:32.775270Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-01T06:05:10Z",
      "packageManager": "npm",
      "publicationTime": "2021-09-01T07:55:11.707292Z",
      "modificationTime": "2022-06-23T09:38:04.790680Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "sqlite3@5.0.2",
        "node-gyp@3.8.0",
        "tar@2.2.2"
      ],
      "upgradePath": [
        false,
        "sqlite3@5.0.3",
        "node-gyp@8.0.0",
        "tar@6.1.9"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "tar",
      "version": "2.2.2"
    },
    {
      "id": "SNYK-JS-UNSETVALUE-2400660",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "khizar"
      ],
      "semver": {
        "vulnerable": [
          "<2.0.1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "unset-value",
      "references": [
        {
          "url": "https://github.com/jonschlinkert/unset-value/pull/12/commits/abb534769f6ea62c3dd988f5ce0a4ebd1f91b561",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/issues/11",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/pull/12",
          "title": "GitHub PR"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/releases",
          "title": "GitHub Release"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `unset` function in `index.js`, because it allows access to object prototype properties.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `unset-value` to version 2.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/jonschlinkert/unset-value/pull/12/commits/abb534769f6ea62c3dd988f5ce0a4ebd1f91b561)\n- [GitHub Issue](https://github.com/jonschlinkert/unset-value/issues/11)\n- [GitHub PR](https://github.com/jonschlinkert/unset-value/pull/12)\n- [GitHub Release](https://github.com/jonschlinkert/unset-value/releases)\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "unset-value",
      "proprietary": false,
      "creationTime": "2022-02-13T14:46:07.185334Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-02-13T14:44:04Z",
      "packageManager": "npm",
      "publicationTime": "2022-02-13T15:26:38.063549Z",
      "modificationTime": "2022-02-13T15:26:38.065734Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "snapdragon@0.8.2",
        "base@0.11.2",
        "cache-base@1.0.1",
        "unset-value@1.0.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "unset-value",
      "version": "1.0.0"
    },
    {
      "id": "SNYK-JS-UNSETVALUE-2400660",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "khizar"
      ],
      "semver": {
        "vulnerable": [
          "<2.0.1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "unset-value",
      "references": [
        {
          "url": "https://github.com/jonschlinkert/unset-value/pull/12/commits/abb534769f6ea62c3dd988f5ce0a4ebd1f91b561",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/issues/11",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/pull/12",
          "title": "GitHub PR"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/releases",
          "title": "GitHub Release"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `unset` function in `index.js`, because it allows access to object prototype properties.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `unset-value` to version 2.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/jonschlinkert/unset-value/pull/12/commits/abb534769f6ea62c3dd988f5ce0a4ebd1f91b561)\n- [GitHub Issue](https://github.com/jonschlinkert/unset-value/issues/11)\n- [GitHub PR](https://github.com/jonschlinkert/unset-value/pull/12)\n- [GitHub Release](https://github.com/jonschlinkert/unset-value/releases)\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "unset-value",
      "proprietary": false,
      "creationTime": "2022-02-13T14:46:07.185334Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-02-13T14:44:04Z",
      "packageManager": "npm",
      "publicationTime": "2022-02-13T15:26:38.063549Z",
      "modificationTime": "2022-02-13T15:26:38.065734Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "braces@2.3.2",
        "snapdragon@0.8.2",
        "base@0.11.2",
        "cache-base@1.0.1",
        "unset-value@1.0.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "unset-value",
      "version": "1.0.0"
    },
    {
      "id": "SNYK-JS-UNSETVALUE-2400660",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "khizar"
      ],
      "semver": {
        "vulnerable": [
          "<2.0.1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "unset-value",
      "references": [
        {
          "url": "https://github.com/jonschlinkert/unset-value/pull/12/commits/abb534769f6ea62c3dd988f5ce0a4ebd1f91b561",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/issues/11",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/pull/12",
          "title": "GitHub PR"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/releases",
          "title": "GitHub Release"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `unset` function in `index.js`, because it allows access to object prototype properties.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `unset-value` to version 2.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/jonschlinkert/unset-value/pull/12/commits/abb534769f6ea62c3dd988f5ce0a4ebd1f91b561)\n- [GitHub Issue](https://github.com/jonschlinkert/unset-value/issues/11)\n- [GitHub PR](https://github.com/jonschlinkert/unset-value/pull/12)\n- [GitHub Release](https://github.com/jonschlinkert/unset-value/releases)\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "unset-value",
      "proprietary": false,
      "creationTime": "2022-02-13T14:46:07.185334Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-02-13T14:44:04Z",
      "packageManager": "npm",
      "publicationTime": "2022-02-13T15:26:38.063549Z",
      "modificationTime": "2022-02-13T15:26:38.065734Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "extglob@2.0.4",
        "snapdragon@0.8.2",
        "base@0.11.2",
        "cache-base@1.0.1",
        "unset-value@1.0.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "unset-value",
      "version": "1.0.0"
    },
    {
      "id": "SNYK-JS-UNSETVALUE-2400660",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "khizar"
      ],
      "semver": {
        "vulnerable": [
          "<2.0.1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "unset-value",
      "references": [
        {
          "url": "https://github.com/jonschlinkert/unset-value/pull/12/commits/abb534769f6ea62c3dd988f5ce0a4ebd1f91b561",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/issues/11",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/pull/12",
          "title": "GitHub PR"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/releases",
          "title": "GitHub Release"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `unset` function in `index.js`, because it allows access to object prototype properties.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `unset-value` to version 2.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/jonschlinkert/unset-value/pull/12/commits/abb534769f6ea62c3dd988f5ce0a4ebd1f91b561)\n- [GitHub Issue](https://github.com/jonschlinkert/unset-value/issues/11)\n- [GitHub PR](https://github.com/jonschlinkert/unset-value/pull/12)\n- [GitHub Release](https://github.com/jonschlinkert/unset-value/releases)\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "unset-value",
      "proprietary": false,
      "creationTime": "2022-02-13T14:46:07.185334Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-02-13T14:44:04Z",
      "packageManager": "npm",
      "publicationTime": "2022-02-13T15:26:38.063549Z",
      "modificationTime": "2022-02-13T15:26:38.065734Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "nanomatch@1.2.13",
        "snapdragon@0.8.2",
        "base@0.11.2",
        "cache-base@1.0.1",
        "unset-value@1.0.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "unset-value",
      "version": "1.0.0"
    },
    {
      "id": "SNYK-JS-UNSETVALUE-2400660",
      "title": "Prototype Pollution",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "khizar"
      ],
      "semver": {
        "vulnerable": [
          "<2.0.1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "2.0.1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "unset-value",
      "references": [
        {
          "url": "https://github.com/jonschlinkert/unset-value/pull/12/commits/abb534769f6ea62c3dd988f5ce0a4ebd1f91b561",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/issues/11",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/pull/12",
          "title": "GitHub PR"
        },
        {
          "url": "https://github.com/jonschlinkert/unset-value/releases",
          "title": "GitHub Release"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `unset` function in `index.js`, because it allows access to object prototype properties.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `unset-value` to version 2.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/jonschlinkert/unset-value/pull/12/commits/abb534769f6ea62c3dd988f5ce0a4ebd1f91b561)\n- [GitHub Issue](https://github.com/jonschlinkert/unset-value/issues/11)\n- [GitHub PR](https://github.com/jonschlinkert/unset-value/pull/12)\n- [GitHub Release](https://github.com/jonschlinkert/unset-value/releases)\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-1321"
        ]
      },
      "packageName": "unset-value",
      "proprietary": false,
      "creationTime": "2022-02-13T14:46:07.185334Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-02-13T14:44:04Z",
      "packageManager": "npm",
      "publicationTime": "2022-02-13T15:26:38.063549Z",
      "modificationTime": "2022-02-13T15:26:38.065734Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "check-dependencies@1.1.0",
        "findup-sync@2.0.0",
        "micromatch@3.1.10",
        "extglob@2.0.4",
        "expand-brackets@2.1.4",
        "snapdragon@0.8.2",
        "base@0.11.2",
        "cache-base@1.0.1",
        "unset-value@1.0.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "unset-value",
      "version": "1.0.0"
    },
    {
      "id": "SNYK-JS-VM2-1585918",
      "title": "Sandbox Bypass",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
      "credit": [
        "Cris Staicu",
        "Abdullah Alhamdan"
      ],
      "semver": {
        "vulnerable": [
          "<3.9.4"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.9.4"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "critical",
      "cvssScore": 9.8,
      "functions": [],
      "malicious": false,
      "moduleName": "vm2",
      "references": [
        {
          "url": "https://github.com/patriksimek/vm2/commit/b4f6e2bd2c4a1ef52fc4483d8e35f28bc4481886",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/patriksimek/vm2/issues/363",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/patriksimek/vm2/releases/tag/3.9.4",
          "title": "GitHub Release"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "critical",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "cvssV3BaseScore": 10,
          "modificationTime": "2022-01-03T16:36:16.083301Z"
        }
      ],
      "description": "## Overview\n[vm2](https://github.com/patriksimek/vm2#readme) is a sandbox that can run untrusted code with whitelisted Node's built-in modules.\n\nAffected versions of this package are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine.\r\n\r\n### PoC\r\n```\r\nconst {VM} = require(\"vm2\");\r\nlet vmInstance = new VM();\r\n\r\nlet code = `    \r\n    res = eval('import(\\\\'./foo.js\\\\');')    \r\n    res.__proto__.__proto__.polluted = res.__proto__.__proto__.toString.constructor(\"return this\")().process.mainModule.require(\"child_process\").execSync(\"touch HACKED\").toString();\r\n`;\r\nvmInstance.run(code);\r\nconsole.log(polluted);\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `vm2` to version 3.9.4 or higher.\n## References\n- [GitHub Commit](https://github.com/patriksimek/vm2/commit/b4f6e2bd2c4a1ef52fc4483d8e35f28bc4481886)\n- [GitHub Issue](https://github.com/patriksimek/vm2/issues/363)\n- [GitHub Release](https://github.com/patriksimek/vm2/releases/tag/3.9.4)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-23449"
        ],
        "CWE": [
          "CWE-1321",
          "CWE-265"
        ]
      },
      "packageName": "vm2",
      "proprietary": true,
      "creationTime": "2021-09-17T11:06:24.631831Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-09-17T11:04:42Z",
      "packageManager": "npm",
      "publicationTime": "2021-10-15T16:00:55Z",
      "modificationTime": "2022-11-15T15:33:06.501964Z",
      "socialTrendAlert": false,
      "severityWithCritical": "critical",
      "from": [
        "juice-shop@12.3.0",
        "juicy-chat-bot@0.6.5",
        "vm2@3.9.3"
      ],
      "upgradePath": [
        false,
        "juicy-chat-bot@0.6.6",
        "vm2@3.9.11"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "vm2",
      "version": "3.9.3"
    },
    {
      "id": "SNYK-JS-VM2-2309905",
      "title": "Sandbox Bypass",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
      "credit": [
        "Cris Staicu",
        "Abdullah Alhamdan"
      ],
      "semver": {
        "vulnerable": [
          "<3.9.6"
        ]
      },
      "exploit": "Proof of Concept",
      "fixedIn": [
        "3.9.6"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "critical",
      "cvssScore": 9.8,
      "functions": [],
      "malicious": false,
      "moduleName": "vm2",
      "references": [
        {
          "url": "https://github.com/patriksimek/vm2/commit/532120d5cdec7da8225fc6242e154ebabc63fe4d",
          "title": "GitHub Commit"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "critical",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 9.8,
          "modificationTime": "2022-02-23T04:10:17.711579Z"
        }
      ],
      "description": "## Overview\n[vm2](https://github.com/patriksimek/vm2#readme) is a sandbox that can run untrusted code with whitelisted Node's built-in modules.\n\nAffected versions of this package are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.\r\n\r\n## PoC 1\r\n```js\r\n// tested on Node.js 16.10.0\r\nconst {VM} = require('vm2');\r\n\r\nvmInstance = new VM();    \r\n\r\nconsole.log(vmInstance.run(`    \r\nfunction foo(ref) {\r\n    new Error().stack;    \r\n}\r\nlet obj = {};\r\nObject.defineProperty(Object.prototype, 0, {\r\n    set: function () {                        \r\n        foo(this);\r\n        try {      \r\n            obj[0] = 0;\r\n        } catch (e) {\r\n            e.__proto__.__proto__.__proto__.polluted = 'success';            \r\n        }\r\n    }\r\n})\r\n`));\r\nconsole.log(polluted);\r\n```\r\n\r\n## PoC 2\r\n```js\r\n// tested with Node.js 17.1.0 and latest vm2 version\r\n// generated from \"/home/cris/work/js-isolation/analysis/Dataset/1V8/regress/regress-672041.js\", partially with the support of the generator\r\nconst {VM} = require('vm2');\r\n\r\nvmInstance = new VM();    \r\n\r\nvmInstance.run(`\r\nfunction getRootPrototype(obj) {        \r\n    while (obj.__proto__) {\r\n        obj = obj.__proto__;\r\n    }\r\n    return obj;    \r\n}\r\nfunction stack(ref, cb) {\r\n    let stack = new Error().stack;\r\n    stack.match(/checkReferenceRecursive/g);        \r\n}\r\ntry {            \r\n    global.temp0 = RegExp.prototype.__defineGetter__('global', () => {    \r\n        getRootPrototype(this);                \r\n        stack(this);        \r\n        return true;\r\n    }), function functionInvocationAnalysis(r) {        \r\n        stack(r);\r\n    }(temp0), global.temp0;\r\n    RegExp.prototype.exec = function (str) {        \r\n        stack(arguments);        \r\n    };    \r\n} catch (e) {    \r\n    getRootPrototype(e).polluted = \"success\";   \r\n}\r\n`);\r\n\r\nconsole.log(polluted);\r\n```\n## Remediation\nUpgrade `vm2` to version 3.9.6 or higher.\n## References\n- [GitHub Commit](https://github.com/patriksimek/vm2/commit/532120d5cdec7da8225fc6242e154ebabc63fe4d)\n",
      "identifiers": {
        "CVE": [
          "CVE-2021-23555"
        ],
        "CWE": [
          "CWE-1321",
          "CWE-265"
        ]
      },
      "packageName": "vm2",
      "proprietary": true,
      "creationTime": "2021-12-06T11:33:11.244579Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2021-12-06T11:32:46Z",
      "packageManager": "npm",
      "publicationTime": "2022-02-09T17:20:21Z",
      "modificationTime": "2022-11-15T15:32:48.489106Z",
      "socialTrendAlert": false,
      "severityWithCritical": "critical",
      "from": [
        "juice-shop@12.3.0",
        "juicy-chat-bot@0.6.5",
        "vm2@3.9.3"
      ],
      "upgradePath": [
        false,
        "juicy-chat-bot@0.6.6",
        "vm2@3.9.11"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "vm2",
      "version": "3.9.3"
    },
    {
      "id": "SNYK-JS-VM2-3018201",
      "title": "Sandbox Bypass",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "credit": [
        "Oxeye"
      ],
      "semver": {
        "vulnerable": [
          "<3.9.11"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.9.11"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "critical",
      "cvssScore": 9.9,
      "functions": [],
      "malicious": false,
      "moduleName": "vm2",
      "references": [
        {
          "url": "https://github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873%23diff-b1a515a627d820118e76d0e323fe2f0589ed50a1eacb490f6c3278fe3698f164",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/patriksimek/vm2/issues/467",
          "title": "GitHub Issue"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "critical",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "cvssV3BaseScore": 10,
          "modificationTime": "2022-11-08T13:10:48.047566Z"
        }
      ],
      "description": "## Overview\n[vm2](https://github.com/patriksimek/vm2#readme) is a sandbox that can run untrusted code with whitelisted Node's built-in modules.\n\nAffected versions of this package are vulnerable to Sandbox Bypass via indirect access to `host.Object` during preparation of stacktraces, which can lead to execution of arbitrary code on the host machine.\n## Remediation\nUpgrade `vm2` to version 3.9.11 or higher.\n## References\n- [GitHub Commit](https://github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873#diff-b1a515a627d820118e76d0e323fe2f0589ed50a1eacb490f6c3278fe3698f164)\n- [GitHub Issue](https://github.com/patriksimek/vm2/issues/467)\n",
      "identifiers": {
        "CVE": [
          "CVE-2022-36067"
        ],
        "CWE": [
          "CWE-265"
        ],
        "GHSA": [
          "GHSA-mrgp-mrhc-5jrq"
        ]
      },
      "packageName": "vm2",
      "proprietary": false,
      "creationTime": "2022-09-07T11:36:26.891879Z",
      "functions_new": [],
      "alternativeIds": [],
      "disclosureTime": "2022-09-07T11:22:42Z",
      "packageManager": "npm",
      "publicationTime": "2022-09-07T15:09:22Z",
      "modificationTime": "2022-11-29T15:25:01.479013Z",
      "socialTrendAlert": false,
      "severityWithCritical": "critical",
      "from": [
        "juice-shop@12.3.0",
        "juicy-chat-bot@0.6.5",
        "vm2@3.9.3"
      ],
      "upgradePath": [
        false,
        "juicy-chat-bot@0.6.6",
        "vm2@3.9.11"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "vm2",
      "version": "3.9.3"
    },
    {
      "id": "npm:base64url:20180511",
      "title": "Uninitialized Memory Exposure",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H/E:F/RL:O/RC:C",
      "credit": [
        "ChALkeR"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.0"
        ]
      },
      "exploit": "Functional",
      "fixedIn": [
        "3.0.0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.1,
      "functions": [
        {
          "version": [
            "<=1.0.6"
          ],
          "functionId": {
            "filePath": "index.js",
            "className": null,
            "functionName": "padString"
          }
        },
        {
          "version": [
            ">=2.0.0 <3.0.0"
          ],
          "functionId": {
            "filePath": "dist/pad-string.js",
            "className": null,
            "functionName": "padString"
          }
        }
      ],
      "malicious": false,
      "moduleName": "base64url",
      "references": [
        {
          "url": "https://github.com/brianloveswords/base64url/commit/4355cb294123e86171daa9389f7afe6d2b2b9dae",
          "title": "GitHub Commit"
        },
        {
          "url": "https://hackerone.com/reports/321687",
          "title": "HackerOne Report"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\r\n[base64url](https://www.npmjs.com/package/base64url) Converting to, and from, base64url.\r\n\r\nAffected versions of this package are vulnerable to Uninitialized Memory Exposure. An attacker could extract sensitive data from uninitialized memory or may cause a Denial of Service (DoS) by passing in a large number, in setups where typed user input can be passed (e.g. from JSON).\r\n\r\n## Details\r\nThe Buffer class on Node.js is a mutable array of binary data, and can be initialized with a string, array or number.\r\n```js\r\nconst buf1 = new Buffer([1,2,3]);\r\n// creates a buffer containing [01, 02, 03]\r\nconst buf2 = new Buffer('test');\r\n// creates a buffer containing ASCII bytes [74, 65, 73, 74]\r\nconst buf3 = new Buffer(10);\r\n// creates a buffer of length 10\r\n```\r\n\r\nThe first two variants simply create a binary representation of the value it received. The last one, however, pre-allocates a buffer of the specified size, making it a useful buffer, especially when reading data from a stream.\r\nWhen using the number constructor of Buffer, it will allocate the memory, but will not fill it with zeros. Instead, the allocated buffer will hold whatever was in memory at the time. If the buffer is not `zeroed` by using `buf.fill(0)`, it may leak sensitive information like keys, source code, and system info.\r\n\r\n\r\n## Remediation\r\nUpgrade `base64url` to version 3.0.0 or higher.\r\n**Note** This is vulnerable only for Node <=4\r\n\r\n## References\r\n- [HackerOne Report](https://hackerone.com/reports/321687)\r\n- [GitHub Commit](https://github.com/brianloveswords/base64url/commit/4355cb294123e86171daa9389f7afe6d2b2b9dae)",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-201"
        ],
        "NSP": [
          "658"
        ],
        "GHSA": [
          "GHSA-rvg8-pwq2-xj7q"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-BASE64URL-12139"
        ]
      },
      "packageName": "base64url",
      "proprietary": false,
      "creationTime": "2018-03-04T08:54:39.014000Z",
      "functions_new": [
        {
          "version": [
            "<=1.0.6"
          ],
          "functionId": {
            "filePath": "index.js",
            "functionName": "padString"
          }
        },
        {
          "version": [
            ">=2.0.0 <3.0.0"
          ],
          "functionId": {
            "filePath": "dist/pad-string.js",
            "functionName": "padString"
          }
        }
      ],
      "alternativeIds": [
        "SNYK-JS-BASE64URL-12139"
      ],
      "disclosureTime": "2018-05-11T08:54:39Z",
      "packageManager": "npm",
      "publicationTime": "2018-05-13T14:26:26Z",
      "modificationTime": "2020-12-14T14:41:50.915405Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "jsonwebtoken@0.4.0",
        "jws@0.2.6",
        "base64url@0.0.6"
      ],
      "upgradePath": [
        false,
        "jsonwebtoken@5.0.0",
        "jws@3.1.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "base64url",
      "version": "0.0.6"
    },
    {
      "id": "npm:base64url:20180511",
      "title": "Uninitialized Memory Exposure",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H/E:F/RL:O/RC:C",
      "credit": [
        "ChALkeR"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.0"
        ]
      },
      "exploit": "Functional",
      "fixedIn": [
        "3.0.0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.1,
      "functions": [
        {
          "version": [
            "<=1.0.6"
          ],
          "functionId": {
            "filePath": "index.js",
            "className": null,
            "functionName": "padString"
          }
        },
        {
          "version": [
            ">=2.0.0 <3.0.0"
          ],
          "functionId": {
            "filePath": "dist/pad-string.js",
            "className": null,
            "functionName": "padString"
          }
        }
      ],
      "malicious": false,
      "moduleName": "base64url",
      "references": [
        {
          "url": "https://github.com/brianloveswords/base64url/commit/4355cb294123e86171daa9389f7afe6d2b2b9dae",
          "title": "GitHub Commit"
        },
        {
          "url": "https://hackerone.com/reports/321687",
          "title": "HackerOne Report"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\r\n[base64url](https://www.npmjs.com/package/base64url) Converting to, and from, base64url.\r\n\r\nAffected versions of this package are vulnerable to Uninitialized Memory Exposure. An attacker could extract sensitive data from uninitialized memory or may cause a Denial of Service (DoS) by passing in a large number, in setups where typed user input can be passed (e.g. from JSON).\r\n\r\n## Details\r\nThe Buffer class on Node.js is a mutable array of binary data, and can be initialized with a string, array or number.\r\n```js\r\nconst buf1 = new Buffer([1,2,3]);\r\n// creates a buffer containing [01, 02, 03]\r\nconst buf2 = new Buffer('test');\r\n// creates a buffer containing ASCII bytes [74, 65, 73, 74]\r\nconst buf3 = new Buffer(10);\r\n// creates a buffer of length 10\r\n```\r\n\r\nThe first two variants simply create a binary representation of the value it received. The last one, however, pre-allocates a buffer of the specified size, making it a useful buffer, especially when reading data from a stream.\r\nWhen using the number constructor of Buffer, it will allocate the memory, but will not fill it with zeros. Instead, the allocated buffer will hold whatever was in memory at the time. If the buffer is not `zeroed` by using `buf.fill(0)`, it may leak sensitive information like keys, source code, and system info.\r\n\r\n\r\n## Remediation\r\nUpgrade `base64url` to version 3.0.0 or higher.\r\n**Note** This is vulnerable only for Node <=4\r\n\r\n## References\r\n- [HackerOne Report](https://hackerone.com/reports/321687)\r\n- [GitHub Commit](https://github.com/brianloveswords/base64url/commit/4355cb294123e86171daa9389f7afe6d2b2b9dae)",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-201"
        ],
        "NSP": [
          "658"
        ],
        "GHSA": [
          "GHSA-rvg8-pwq2-xj7q"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-BASE64URL-12139"
        ]
      },
      "packageName": "base64url",
      "proprietary": false,
      "creationTime": "2018-03-04T08:54:39.014000Z",
      "functions_new": [
        {
          "version": [
            "<=1.0.6"
          ],
          "functionId": {
            "filePath": "index.js",
            "functionName": "padString"
          }
        },
        {
          "version": [
            ">=2.0.0 <3.0.0"
          ],
          "functionId": {
            "filePath": "dist/pad-string.js",
            "functionName": "padString"
          }
        }
      ],
      "alternativeIds": [
        "SNYK-JS-BASE64URL-12139"
      ],
      "disclosureTime": "2018-05-11T08:54:39Z",
      "packageManager": "npm",
      "publicationTime": "2018-05-13T14:26:26Z",
      "modificationTime": "2020-12-14T14:41:50.915405Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "jsonwebtoken@0.4.0",
        "jws@0.2.6",
        "jwa@0.0.1",
        "base64url@0.0.6"
      ],
      "upgradePath": [
        false,
        "jsonwebtoken@5.0.0",
        "jws@3.1.0",
        "jwa@1.1.6"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "base64url",
      "version": "0.0.6"
    },
    {
      "id": "npm:base64url:20180511",
      "title": "Uninitialized Memory Exposure",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H/E:F/RL:O/RC:C",
      "credit": [
        "ChALkeR"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.0"
        ]
      },
      "exploit": "Functional",
      "fixedIn": [
        "3.0.0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.1,
      "functions": [
        {
          "version": [
            "<=1.0.6"
          ],
          "functionId": {
            "filePath": "index.js",
            "className": null,
            "functionName": "padString"
          }
        },
        {
          "version": [
            ">=2.0.0 <3.0.0"
          ],
          "functionId": {
            "filePath": "dist/pad-string.js",
            "className": null,
            "functionName": "padString"
          }
        }
      ],
      "malicious": false,
      "moduleName": "base64url",
      "references": [
        {
          "url": "https://github.com/brianloveswords/base64url/commit/4355cb294123e86171daa9389f7afe6d2b2b9dae",
          "title": "GitHub Commit"
        },
        {
          "url": "https://hackerone.com/reports/321687",
          "title": "HackerOne Report"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\r\n[base64url](https://www.npmjs.com/package/base64url) Converting to, and from, base64url.\r\n\r\nAffected versions of this package are vulnerable to Uninitialized Memory Exposure. An attacker could extract sensitive data from uninitialized memory or may cause a Denial of Service (DoS) by passing in a large number, in setups where typed user input can be passed (e.g. from JSON).\r\n\r\n## Details\r\nThe Buffer class on Node.js is a mutable array of binary data, and can be initialized with a string, array or number.\r\n```js\r\nconst buf1 = new Buffer([1,2,3]);\r\n// creates a buffer containing [01, 02, 03]\r\nconst buf2 = new Buffer('test');\r\n// creates a buffer containing ASCII bytes [74, 65, 73, 74]\r\nconst buf3 = new Buffer(10);\r\n// creates a buffer of length 10\r\n```\r\n\r\nThe first two variants simply create a binary representation of the value it received. The last one, however, pre-allocates a buffer of the specified size, making it a useful buffer, especially when reading data from a stream.\r\nWhen using the number constructor of Buffer, it will allocate the memory, but will not fill it with zeros. Instead, the allocated buffer will hold whatever was in memory at the time. If the buffer is not `zeroed` by using `buf.fill(0)`, it may leak sensitive information like keys, source code, and system info.\r\n\r\n\r\n## Remediation\r\nUpgrade `base64url` to version 3.0.0 or higher.\r\n**Note** This is vulnerable only for Node <=4\r\n\r\n## References\r\n- [HackerOne Report](https://hackerone.com/reports/321687)\r\n- [GitHub Commit](https://github.com/brianloveswords/base64url/commit/4355cb294123e86171daa9389f7afe6d2b2b9dae)",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-201"
        ],
        "NSP": [
          "658"
        ],
        "GHSA": [
          "GHSA-rvg8-pwq2-xj7q"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-BASE64URL-12139"
        ]
      },
      "packageName": "base64url",
      "proprietary": false,
      "creationTime": "2018-03-04T08:54:39.014000Z",
      "functions_new": [
        {
          "version": [
            "<=1.0.6"
          ],
          "functionId": {
            "filePath": "index.js",
            "functionName": "padString"
          }
        },
        {
          "version": [
            ">=2.0.0 <3.0.0"
          ],
          "functionId": {
            "filePath": "dist/pad-string.js",
            "functionName": "padString"
          }
        }
      ],
      "alternativeIds": [
        "SNYK-JS-BASE64URL-12139"
      ],
      "disclosureTime": "2018-05-11T08:54:39Z",
      "packageManager": "npm",
      "publicationTime": "2018-05-13T14:26:26Z",
      "modificationTime": "2020-12-14T14:41:50.915405Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "express-jwt@0.1.3",
        "jsonwebtoken@0.1.0",
        "jws@0.2.6",
        "base64url@0.0.6"
      ],
      "upgradePath": [
        false,
        "express-jwt@3.0.0",
        "jsonwebtoken@5.0.0",
        "jws@3.1.5"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "base64url",
      "version": "0.0.6"
    },
    {
      "id": "npm:base64url:20180511",
      "title": "Uninitialized Memory Exposure",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H/E:F/RL:O/RC:C",
      "credit": [
        "ChALkeR"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.0"
        ]
      },
      "exploit": "Functional",
      "fixedIn": [
        "3.0.0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.1,
      "functions": [
        {
          "version": [
            "<=1.0.6"
          ],
          "functionId": {
            "filePath": "index.js",
            "className": null,
            "functionName": "padString"
          }
        },
        {
          "version": [
            ">=2.0.0 <3.0.0"
          ],
          "functionId": {
            "filePath": "dist/pad-string.js",
            "className": null,
            "functionName": "padString"
          }
        }
      ],
      "malicious": false,
      "moduleName": "base64url",
      "references": [
        {
          "url": "https://github.com/brianloveswords/base64url/commit/4355cb294123e86171daa9389f7afe6d2b2b9dae",
          "title": "GitHub Commit"
        },
        {
          "url": "https://hackerone.com/reports/321687",
          "title": "HackerOne Report"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\r\n[base64url](https://www.npmjs.com/package/base64url) Converting to, and from, base64url.\r\n\r\nAffected versions of this package are vulnerable to Uninitialized Memory Exposure. An attacker could extract sensitive data from uninitialized memory or may cause a Denial of Service (DoS) by passing in a large number, in setups where typed user input can be passed (e.g. from JSON).\r\n\r\n## Details\r\nThe Buffer class on Node.js is a mutable array of binary data, and can be initialized with a string, array or number.\r\n```js\r\nconst buf1 = new Buffer([1,2,3]);\r\n// creates a buffer containing [01, 02, 03]\r\nconst buf2 = new Buffer('test');\r\n// creates a buffer containing ASCII bytes [74, 65, 73, 74]\r\nconst buf3 = new Buffer(10);\r\n// creates a buffer of length 10\r\n```\r\n\r\nThe first two variants simply create a binary representation of the value it received. The last one, however, pre-allocates a buffer of the specified size, making it a useful buffer, especially when reading data from a stream.\r\nWhen using the number constructor of Buffer, it will allocate the memory, but will not fill it with zeros. Instead, the allocated buffer will hold whatever was in memory at the time. If the buffer is not `zeroed` by using `buf.fill(0)`, it may leak sensitive information like keys, source code, and system info.\r\n\r\n\r\n## Remediation\r\nUpgrade `base64url` to version 3.0.0 or higher.\r\n**Note** This is vulnerable only for Node <=4\r\n\r\n## References\r\n- [HackerOne Report](https://hackerone.com/reports/321687)\r\n- [GitHub Commit](https://github.com/brianloveswords/base64url/commit/4355cb294123e86171daa9389f7afe6d2b2b9dae)",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-201"
        ],
        "NSP": [
          "658"
        ],
        "GHSA": [
          "GHSA-rvg8-pwq2-xj7q"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-BASE64URL-12139"
        ]
      },
      "packageName": "base64url",
      "proprietary": false,
      "creationTime": "2018-03-04T08:54:39.014000Z",
      "functions_new": [
        {
          "version": [
            "<=1.0.6"
          ],
          "functionId": {
            "filePath": "index.js",
            "functionName": "padString"
          }
        },
        {
          "version": [
            ">=2.0.0 <3.0.0"
          ],
          "functionId": {
            "filePath": "dist/pad-string.js",
            "functionName": "padString"
          }
        }
      ],
      "alternativeIds": [
        "SNYK-JS-BASE64URL-12139"
      ],
      "disclosureTime": "2018-05-11T08:54:39Z",
      "packageManager": "npm",
      "publicationTime": "2018-05-13T14:26:26Z",
      "modificationTime": "2020-12-14T14:41:50.915405Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "express-jwt@0.1.3",
        "jsonwebtoken@0.1.0",
        "jws@0.2.6",
        "jwa@0.0.1",
        "base64url@0.0.6"
      ],
      "upgradePath": [
        false,
        "express-jwt@3.0.0",
        "jsonwebtoken@5.0.0",
        "jws@3.1.0",
        "jwa@1.1.6"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "base64url",
      "version": "0.0.6"
    },
    {
      "id": "npm:jsonwebtoken:20150331",
      "title": "Authentication Bypass",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "credit": [
        "Tim McLean"
      ],
      "semver": {
        "vulnerable": [
          "<4.2.2"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "4.2.2"
      ],
      "patches": [
        {
          "id": "patch:npm:jsonwebtoken:20150331:0",
          "urls": [
            "https://snyk-patches.s3.amazonaws.com/npm/jsonwebtoken/20150331/jsonwebtoken_20150331_0_0_1bb584bc382295eeb7ee8c4452a673a77a68b687_snyk.patch"
          ],
          "version": "=4.0.0 || =4.1.0 || =4.2.1",
          "comments": [],
          "modificationTime": "2019-12-03T11:40:45.753281Z"
        }
      ],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "jsonwebtoken",
      "references": [
        {
          "url": "https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/",
          "title": "Auth0 Blog"
        },
        {
          "url": "https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687",
          "title": "GitHub Commit"
        },
        {
          "url": "https://www.timmclean.net/2015/02/25/jwt-alg-none.html",
          "title": "Tim McLean Blog"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "critical",
          "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 9.8,
          "modificationTime": "2022-01-03T17:48:53.018995Z"
        }
      ],
      "description": "## Overview\n[`jsonwebtoken`](https://www.npmjs.com/package/jsonwebtoken) is a JSON Web token implementation for symmetric and asymmetric keys.\nAffected versions of this package are vulnerable to an Authentication Bypass attack, due to the \"algorithm\" not being enforced. Attackers are given the opportunity to choose the algorithm sent to the server and generate signatures with arbitrary contents. The server expects an asymmetric key (RSA) but is sent a symmetric key (HMAC-SHA) with RSA's public key, so instead of going through a key validation process, the server will think the public key is actually an HMAC private key.\n\n## Remediation\nUpgrade `jsonwebtoken` to version 4.2.2 or greater.\n\n## References\n- [GitHub Commit](https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687)\n- [Tim McLean Blog](https://www.timmclean.net/2015/02/25/jwt-alg-none.html)\n- [Auth0 Blog](https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/)\n",
      "identifiers": {
        "CVE": [
          "CVE-2015-9235"
        ],
        "CWE": [
          "CWE-592"
        ],
        "NSP": [
          "17"
        ],
        "GHSA": [
          "GHSA-c7hr-j4mj-j2w6"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-JSONWEBTOKEN-10037"
        ]
      },
      "packageName": "jsonwebtoken",
      "proprietary": false,
      "creationTime": "2015-03-31T16:00:00Z",
      "functions_new": [],
      "alternativeIds": [
        "SNYK-JS-JSONWEBTOKEN-10037"
      ],
      "disclosureTime": "2015-03-31T16:00:00Z",
      "packageManager": "npm",
      "publicationTime": "2015-03-31T16:00:00Z",
      "modificationTime": "2022-01-03T17:48:53.018995Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "express-jwt@0.1.3",
        "jsonwebtoken@0.1.0"
      ],
      "upgradePath": [
        false,
        "express-jwt@2.1.0",
        "jsonwebtoken@4.2.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "jsonwebtoken",
      "version": "0.1.0"
    },
    {
      "id": "npm:jsonwebtoken:20150331",
      "title": "Authentication Bypass",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "credit": [
        "Tim McLean"
      ],
      "semver": {
        "vulnerable": [
          "<4.2.2"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "4.2.2"
      ],
      "patches": [
        {
          "id": "patch:npm:jsonwebtoken:20150331:0",
          "urls": [
            "https://snyk-patches.s3.amazonaws.com/npm/jsonwebtoken/20150331/jsonwebtoken_20150331_0_0_1bb584bc382295eeb7ee8c4452a673a77a68b687_snyk.patch"
          ],
          "version": "=4.0.0 || =4.1.0 || =4.2.1",
          "comments": [],
          "modificationTime": "2019-12-03T11:40:45.753281Z"
        }
      ],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [],
      "malicious": false,
      "moduleName": "jsonwebtoken",
      "references": [
        {
          "url": "https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/",
          "title": "Auth0 Blog"
        },
        {
          "url": "https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687",
          "title": "GitHub Commit"
        },
        {
          "url": "https://www.timmclean.net/2015/02/25/jwt-alg-none.html",
          "title": "Tim McLean Blog"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "critical",
          "cvssV3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 9.8,
          "modificationTime": "2022-01-03T17:48:53.018995Z"
        }
      ],
      "description": "## Overview\n[`jsonwebtoken`](https://www.npmjs.com/package/jsonwebtoken) is a JSON Web token implementation for symmetric and asymmetric keys.\nAffected versions of this package are vulnerable to an Authentication Bypass attack, due to the \"algorithm\" not being enforced. Attackers are given the opportunity to choose the algorithm sent to the server and generate signatures with arbitrary contents. The server expects an asymmetric key (RSA) but is sent a symmetric key (HMAC-SHA) with RSA's public key, so instead of going through a key validation process, the server will think the public key is actually an HMAC private key.\n\n## Remediation\nUpgrade `jsonwebtoken` to version 4.2.2 or greater.\n\n## References\n- [GitHub Commit](https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687)\n- [Tim McLean Blog](https://www.timmclean.net/2015/02/25/jwt-alg-none.html)\n- [Auth0 Blog](https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/)\n",
      "identifiers": {
        "CVE": [
          "CVE-2015-9235"
        ],
        "CWE": [
          "CWE-592"
        ],
        "NSP": [
          "17"
        ],
        "GHSA": [
          "GHSA-c7hr-j4mj-j2w6"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-JSONWEBTOKEN-10037"
        ]
      },
      "packageName": "jsonwebtoken",
      "proprietary": false,
      "creationTime": "2015-03-31T16:00:00Z",
      "functions_new": [],
      "alternativeIds": [
        "SNYK-JS-JSONWEBTOKEN-10037"
      ],
      "disclosureTime": "2015-03-31T16:00:00Z",
      "packageManager": "npm",
      "publicationTime": "2015-03-31T16:00:00Z",
      "modificationTime": "2022-01-03T17:48:53.018995Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "jsonwebtoken@0.4.0"
      ],
      "upgradePath": [
        false,
        "jsonwebtoken@4.2.2"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "jsonwebtoken",
      "version": "0.4.0"
    },
    {
      "id": "npm:jws:20160726",
      "title": "Forgeable Public/Private Tokens",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "credit": [
        "Brian Brennan and Tim McLean"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 8.7,
      "functions": [],
      "malicious": false,
      "moduleName": "jws",
      "references": [
        {
          "url": "https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/",
          "title": "Auth0 Blog"
        },
        {
          "url": "https://github.com/auth0/node-jws/commit/585d0e1e97b6747c10cf5b7689ccc5618a89b299%23diff-4ac32a78649ca5bdd8e0ba38b7006a1e",
          "title": "GitHub Changelog"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\r\n[`jws`](https://www.npmjs.com/package/jws) is an implementation of JSON Web Signatures.\r\nAffected versions of this package are vulnerable to an Authentication Bypass attack, due to the \"algorithm\" not being enforced in `jws.verify()`. Attackers are given the opportunity to choose the algorithm sent to the server and generate signatures with arbitrary contents. The server expects an asymmetric key (RSA) but is sent a symmetric key (HMAC-SHA) with RSA's public key, so instead of going through a key validation process, the server will think the public key is actually an HMAC private key.\r\n\r\n## Remediation\r\nUpgrade `jws` to version `3.0.0` or later.\r\n\r\n## References\r\n- [Auth0 Blog](https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/)",
      "identifiers": {
        "CVE": [
          "CVE-2016-1000223"
        ],
        "CWE": [
          "CWE-310"
        ],
        "NSP": [
          "88"
        ],
        "GHSA": [
          "GHSA-gjcw-v447-2w7q"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-JWS-10125"
        ]
      },
      "packageName": "jws",
      "proprietary": false,
      "creationTime": "2016-07-26T22:10:17.386000Z",
      "functions_new": [],
      "alternativeIds": [
        "SNYK-JS-JWS-10125"
      ],
      "disclosureTime": "2016-07-26T17:21:17Z",
      "packageManager": "npm",
      "publicationTime": "2016-07-26T17:21:17Z",
      "modificationTime": "2020-12-14T14:41:50.867488Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "jsonwebtoken@0.4.0",
        "jws@0.2.6"
      ],
      "upgradePath": [
        false,
        "jsonwebtoken@5.0.0",
        "jws@3.0.0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "jws",
      "version": "0.2.6"
    },
    {
      "id": "npm:jws:20160726",
      "title": "Forgeable Public/Private Tokens",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "credit": [
        "Brian Brennan and Tim McLean"
      ],
      "semver": {
        "vulnerable": [
          "<3.0.0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.0.0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 8.7,
      "functions": [],
      "malicious": false,
      "moduleName": "jws",
      "references": [
        {
          "url": "https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/",
          "title": "Auth0 Blog"
        },
        {
          "url": "https://github.com/auth0/node-jws/commit/585d0e1e97b6747c10cf5b7689ccc5618a89b299%23diff-4ac32a78649ca5bdd8e0ba38b7006a1e",
          "title": "GitHub Changelog"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\r\n[`jws`](https://www.npmjs.com/package/jws) is an implementation of JSON Web Signatures.\r\nAffected versions of this package are vulnerable to an Authentication Bypass attack, due to the \"algorithm\" not being enforced in `jws.verify()`. Attackers are given the opportunity to choose the algorithm sent to the server and generate signatures with arbitrary contents. The server expects an asymmetric key (RSA) but is sent a symmetric key (HMAC-SHA) with RSA's public key, so instead of going through a key validation process, the server will think the public key is actually an HMAC private key.\r\n\r\n## Remediation\r\nUpgrade `jws` to version `3.0.0` or later.\r\n\r\n## References\r\n- [Auth0 Blog](https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/)",
      "identifiers": {
        "CVE": [
          "CVE-2016-1000223"
        ],
        "CWE": [
          "CWE-310"
        ],
        "NSP": [
          "88"
        ],
        "GHSA": [
          "GHSA-gjcw-v447-2w7q"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-JWS-10125"
        ]
      },
      "packageName": "jws",
      "proprietary": false,
      "creationTime": "2016-07-26T22:10:17.386000Z",
      "functions_new": [],
      "alternativeIds": [
        "SNYK-JS-JWS-10125"
      ],
      "disclosureTime": "2016-07-26T17:21:17Z",
      "packageManager": "npm",
      "publicationTime": "2016-07-26T17:21:17Z",
      "modificationTime": "2020-12-14T14:41:50.867488Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "express-jwt@0.1.3",
        "jsonwebtoken@0.1.0",
        "jws@0.2.6"
      ],
      "upgradePath": [
        false,
        "express-jwt@3.0.0",
        "jsonwebtoken@5.0.0",
        "jws@3.0.0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "jws",
      "version": "0.2.6"
    },
    {
      "id": "npm:underscore.string:20170908",
      "title": "Regular Expression Denial of Service (ReDoS)",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        "Cristian-Alexandru Staicu"
      ],
      "semver": {
        "vulnerable": [
          ">2.4.0 <3.3.6"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "3.3.6"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "js",
      "severity": "high",
      "cvssScore": 7.5,
      "functions": [
        {
          "version": [
            ">2.4.1 <3.3.5"
          ],
          "functionId": {
            "filePath": "unescapeHTML.js",
            "className": null,
            "functionName": "module.exports"
          }
        }
      ],
      "malicious": false,
      "moduleName": "underscore.string",
      "references": [
        {
          "url": "https://github.com/epeli/underscore.string/commit/f486cd684c94c12db48b45d52b1472a1b9661029",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/esamattis/underscore.string/commit/d095c4af392fe105797288c352c7ccb8a3413425",
          "title": "GitHub Commit"
        },
        {
          "url": "https://github.com/epeli/underscore.string/issues/510",
          "title": "GitHub Issue"
        },
        {
          "url": "https://github.com/esamattis/underscore.string/pull/525",
          "title": "GitHub PR"
        }
      ],
      "cvssDetails": [],
      "description": "## Overview\n[underscore.string](https://www.npmjs.com/package/underscore.string) is a Javascript lacks complete string manipulation operations.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). It parses dates using regex strings, which may cause a slowdown of 2 seconds per 50k characters.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `underscore.string` to version 3.3.6 or higher.\n## References\n- [GitHub Commit](https://github.com/epeli/underscore.string/commit/f486cd684c94c12db48b45d52b1472a1b9661029)\n- [GitHub Commit](https://github.com/esamattis/underscore.string/commit/d095c4af392fe105797288c352c7ccb8a3413425)\n- [GitHub Issue](https://github.com/epeli/underscore.string/issues/510)\n- [GitHub PR](https://github.com/esamattis/underscore.string/pull/525)\n",
      "identifiers": {
        "CVE": [],
        "CWE": [
          "CWE-400"
        ],
        "NSP": [
          "745"
        ],
        "GHSA": [
          "GHSA-v2p6-4mp7-3r9v"
        ],
        "ALTERNATIVE": [
          "SNYK-JS-UNDERSCORESTRING-12168"
        ]
      },
      "packageName": "underscore.string",
      "proprietary": false,
      "creationTime": "2018-06-21T17:51:09.741000Z",
      "functions_new": [
        {
          "version": [
            ">2.4.1 <3.3.5"
          ],
          "functionId": {
            "filePath": "unescapeHTML.js",
            "functionName": "module.exports"
          }
        }
      ],
      "alternativeIds": [
        "SNYK-JS-UNDERSCORESTRING-12168"
      ],
      "disclosureTime": "2017-09-08T17:51:09Z",
      "packageManager": "npm",
      "publicationTime": "2018-06-25T13:19:28Z",
      "modificationTime": "2022-05-16T13:08:55.548162Z",
      "socialTrendAlert": false,
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "grunt@1.4.1",
        "grunt-legacy-util@2.0.1",
        "underscore.string@3.3.5"
      ],
      "upgradePath": [
        false,
        "grunt@1.4.1",
        "grunt-legacy-util@2.0.1",
        "underscore.string@3.3.6"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "underscore.string",
      "version": "3.3.5"
    },
    {
      "id": "snyk:lic:npm:fuzzball:GPL-2.0",
      "type": "license",
      "title": "GPL-2.0 license",
      "semver": {
        "vulnerable": [
          ">=0.1.4"
        ]
      },
      "license": "GPL-2.0",
      "language": "js",
      "description": "GPL-2.0 license",
      "packageName": "fuzzball",
      "creationTime": "2022-12-02T16:07:36.341Z",
      "packageManager": "npm",
      "publicationTime": "2022-12-02T16:07:36.341Z",
      "severity": "high",
      "severityWithCritical": "high",
      "from": [
        "juice-shop@12.3.0",
        "fuzzball@1.4.0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "fuzzball",
      "version": "1.4.0"
    }
  ],
  "ok": false,
  "dependencyCount": 913,
  "org": "jordan.miles",
  "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.0\nignore: {}\npatch: {}\nexclude:\n  global:\n    - models/address.js\n    - package.json\n    - package-lock.json\n",
  "isPrivate": true,
  "licensesPolicy": {
    "severities": {},
    "orgLicenseRules": {
      "AGPL-1.0": {
        "licenseType": "AGPL-1.0",
        "severity": "high",
        "instructions": ""
      },
      "AGPL-3.0": {
        "licenseType": "AGPL-3.0",
        "severity": "high",
        "instructions": ""
      },
      "Artistic-1.0": {
        "licenseType": "Artistic-1.0",
        "severity": "medium",
        "instructions": ""
      },
      "Artistic-2.0": {
        "licenseType": "Artistic-2.0",
        "severity": "medium",
        "instructions": ""
      },
      "CDDL-1.0": {
        "licenseType": "CDDL-1.0",
        "severity": "medium",
        "instructions": ""
      },
      "CPOL-1.02": {
        "licenseType": "CPOL-1.02",
        "severity": "high",
        "instructions": ""
      },
      "EPL-1.0": {
        "licenseType": "EPL-1.0",
        "severity": "medium",
        "instructions": ""
      },
      "GPL-2.0": {
        "licenseType": "GPL-2.0",
        "severity": "high",
        "instructions": ""
      },
      "GPL-3.0": {
        "licenseType": "GPL-3.0",
        "severity": "high",
        "instructions": ""
      },
      "LGPL-2.0": {
        "licenseType": "LGPL-2.0",
        "severity": "medium",
        "instructions": ""
      },
      "LGPL-2.1": {
        "licenseType": "LGPL-2.1",
        "severity": "medium",
        "instructions": ""
      },
      "LGPL-3.0": {
        "licenseType": "LGPL-3.0",
        "severity": "medium",
        "instructions": ""
      },
      "MPL-1.1": {
        "licenseType": "MPL-1.1",
        "severity": "medium",
        "instructions": ""
      },
      "MPL-2.0": {
        "licenseType": "MPL-2.0",
        "severity": "medium",
        "instructions": ""
      },
      "MS-RL": {
        "licenseType": "MS-RL",
        "severity": "medium",
        "instructions": ""
      },
      "SimPL-2.0": {
        "licenseType": "SimPL-2.0",
        "severity": "high",
        "instructions": ""
      }
    }
  },
  "packageManager": "npm",
  "projectId": "b8c4db00-36cd-4034-900c-2f92e99ea9ac",
  "ignoreSettings": {
    "adminOnly": false,
    "reasonRequired": false,
    "disregardFilesystemIgnores": false
  },
  "summary": "137 vulnerable dependency paths",
  "remediation": {
    "unresolved": [
      {
        "id": "SNYK-JS-ASYNC-2441827",
        "title": "Prototype Pollution",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
        "credit": [
          "Unknown"
        ],
        "semver": {
          "vulnerable": [
            ">=2.0.0 <2.6.4",
            ">=3.0.0 <3.2.2"
          ]
        },
        "exploit": "Proof of Concept",
        "fixedIn": [
          "2.6.4",
          "3.2.2"
        ],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "high",
        "cvssScore": 7.5,
        "functions": [],
        "malicious": false,
        "moduleName": "async",
        "references": [
          {
            "url": "https://github.com/caolan/async/pull/1828",
            "title": "GitHub Backport PR"
          },
          {
            "url": "https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2",
            "title": "GitHub Commit"
          },
          {
            "url": "https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d",
            "title": "GitHub Commit"
          },
          {
            "url": "https://jsfiddle.net/oz5twjd9/",
            "title": "PoC"
          }
        ],
        "cvssDetails": [
          {
            "assigner": "NVD",
            "severity": "high",
            "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 7.8,
            "modificationTime": "2022-05-14T01:11:01.228151Z"
          },
          {
            "assigner": "Red Hat",
            "severity": "high",
            "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 7.8,
            "modificationTime": "2022-11-27T15:35:48.591671Z"
          }
        ],
        "description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mapValues()` method, due to improper check in `createObjectIterator` function.\r\n\r\n## PoC\r\n\r\n```js\r\n//when objects are parsed, all properties are created as own (the objects can come from outside sources (http requests/ file))\r\nconst hasOwn = JSON.parse('{\"__proto__\": {\"isAdmin\": true}}');\r\n\r\n//does not have the property,  because it's inside object's own \"__proto__\"\r\nconsole.log(hasOwn.isAdmin);\r\n\r\nasync.mapValues(hasOwn, (val, key, cb) => cb(null, val), (error, result) => {\r\n  // after the method executes, hasOwn.__proto__ value (isAdmin: true) replaces the prototype of the newly created object, leading to potential exploits.\r\n  console.log(result.isAdmin);\r\n});\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `async` to version 2.6.4, 3.2.2 or higher.\n## References\n- [GitHub Backport PR](https://github.com/caolan/async/pull/1828)\n- [GitHub Commit](https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2)\n- [GitHub Commit](https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d)\n- [PoC](https://jsfiddle.net/oz5twjd9/)\n",
        "identifiers": {
          "CVE": [
            "CVE-2021-43138"
          ],
          "CWE": [
            "CWE-1321"
          ]
        },
        "packageName": "async",
        "proprietary": false,
        "creationTime": "2022-04-07T07:58:38.528444Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2022-04-07T07:49:24Z",
        "packageManager": "npm",
        "publicationTime": "2022-04-07T14:22:18Z",
        "modificationTime": "2022-11-27T15:35:48.591671Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "juicy-chat-bot@0.6.5",
          "@nlpjs/lang-all@4.22.7",
          "@nlpjs/lang-ja@4.22.7",
          "kuromoji@0.1.2",
          "async@2.6.3"
        ],
        "upgradePath": [
          false,
          "juicy-chat-bot@0.6.5",
          "@nlpjs/lang-all@4.22.7",
          "@nlpjs/lang-ja@4.22.7",
          "kuromoji@0.1.2",
          "async@2.6.4"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "async",
        "version": "2.6.3",
        "severityWithCritical": "high"
      },
      {
        "id": "SNYK-JS-DECODEURICOMPONENT-3149970",
        "title": "Denial of Service (DoS)",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
        "credit": [
          "KatsuragiCSL"
        ],
        "semver": {
          "vulnerable": [
            "<0.2.2"
          ]
        },
        "exploit": "Proof of Concept",
        "fixedIn": [
          "0.2.2"
        ],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "high",
        "cvssScore": 7.5,
        "functions": [],
        "malicious": false,
        "moduleName": "decode-uri-component",
        "references": [
          {
            "url": "https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152",
            "title": "GitHub Commit"
          },
          {
            "url": "https://github.com/SamVerschueren/decode-uri-component/issues/5",
            "title": "GitHub Issue"
          },
          {
            "url": "https://github.com/sindresorhus/query-string/issues/345",
            "title": "GitHub Issue"
          }
        ],
        "cvssDetails": [
          {
            "assigner": "NVD",
            "severity": "high",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "modificationTime": "2022-12-02T01:11:11.714842Z"
          }
        ],
        "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) due to improper input validation, when the hash string `# kun%ea%ba%5a%ba` is being parsed by `decodeUriComponent`.\r\n\r\n## PoC\r\n```js\r\nconst decodeUriComponent = require('decode-uri-component');\r\n\r\nvar x = decodeUriComponent('%ea%ba%5a%ba');\r\n\r\nconsole.log(x);\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `decode-uri-component` to version 0.2.2 or higher.\n## References\n- [GitHub Commit](https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152)\n- [GitHub Issue](https://github.com/SamVerschueren/decode-uri-component/issues/5)\n- [GitHub Issue](https://github.com/sindresorhus/query-string/issues/345)\n",
        "identifiers": {
          "CVE": [
            "CVE-2022-38900"
          ],
          "CWE": [
            "CWE-400"
          ]
        },
        "packageName": "decode-uri-component",
        "proprietary": false,
        "creationTime": "2022-11-28T14:24:36.010219Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2022-11-28T14:06:23Z",
        "packageManager": "npm",
        "publicationTime": "2022-11-28T16:12:34.614831Z",
        "modificationTime": "2022-12-02T09:02:03.162272Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "check-dependencies@1.1.0",
          "findup-sync@2.0.0",
          "micromatch@3.1.10",
          "extglob@2.0.4",
          "expand-brackets@2.1.4",
          "snapdragon@0.8.2",
          "source-map-resolve@0.5.3",
          "decode-uri-component@0.2.0"
        ],
        "upgradePath": [
          false,
          "check-dependencies@1.1.0",
          "findup-sync@2.0.0",
          "micromatch@3.1.10",
          "extglob@2.0.4",
          "expand-brackets@2.1.4",
          "snapdragon@0.8.2",
          "source-map-resolve@0.5.3",
          "decode-uri-component@0.2.2"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "decode-uri-component",
        "version": "0.2.0",
        "severityWithCritical": "high"
      },
      {
        "id": "SNYK-JS-DECOMPRESSTAR-559095",
        "title": "Arbitrary File Write via Archive Extraction (Zip Slip)",
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:U/RC:C",
        "credit": [
          "Oscar Arnflo"
        ],
        "semver": {
          "vulnerable": [
            "*"
          ]
        },
        "exploit": "Proof of Concept",
        "fixedIn": [],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "medium",
        "cvssScore": 6.3,
        "functions": [
          {
            "version": [
              "*"
            ],
            "functionId": {
              "filePath": "index.js",
              "className": null,
              "functionName": "module.exports"
            }
          }
        ],
        "malicious": false,
        "moduleName": "decompress-tar",
        "references": [
          {
            "url": "https://github.com/kevva/decompress/pull/73",
            "title": "GitHub Fix PR"
          },
          {
            "url": "https://github.com/kevva/decompress/issues/71",
            "title": "GitHub Issue"
          },
          {
            "url": "https://github.com/kevva/decompress-tar/pull/12",
            "title": "GitHub PR decompress-tar"
          },
          {
            "url": "https://www.npmjs.com/advisories/1217",
            "title": "NPM Advisory"
          }
        ],
        "cvssDetails": [
          {
            "assigner": "NVD",
            "severity": "critical",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "modificationTime": "2022-01-03T18:04:12.459024Z"
          }
        ],
        "description": "## Overview\n[decompress-tar](https://github.com/kevva/decompress-tar) is a tar plugin for decompress.\n\nAffected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). It is possible to bypass the security measures provided by decompress  and conduct ZIP path traversal through symlinks.\r\n\r\n### PoC\r\n\r\n```\r\nconst decompress = require('decompress');\r\n\r\ndecompress('slip.tar.gz', 'dist').then(files => {\r\n\tconsole.log('done!');\r\n});\r\n```\n\n## Details\n\nIt is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a \"../../file.exe\" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a zip archive with one benign file and one malicious file. Extracting the malicous file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n\n+2018-04-15 22:04:29 ..... 19 19 good.txt\n\n+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n\n```\n\n## Remediation\nThere is no fixed version for `decompress-tar`.\n## References\n- [GitHub Fix PR](https://github.com/kevva/decompress/pull/73)\n- [GitHub Issue](https://github.com/kevva/decompress/issues/71)\n- [GitHub PR decompress-tar](https://github.com/kevva/decompress-tar/pull/12)\n- [NPM Advisory](https://www.npmjs.com/advisories/1217)\n",
        "identifiers": {
          "CVE": [
            "CVE-2020-12265"
          ],
          "CWE": [
            "CWE-29"
          ],
          "NSP": [
            "1217"
          ],
          "GHSA": [
            "GHSA-qgfr-5hqp-vrw9"
          ]
        },
        "packageName": "decompress-tar",
        "proprietary": false,
        "creationTime": "2020-03-02T11:17:35.161853Z",
        "functions_new": [
          {
            "version": [
              "*"
            ],
            "functionId": {
              "filePath": "index.js",
              "functionName": "module.exports"
            }
          }
        ],
        "alternativeIds": [],
        "disclosureTime": "2019-10-15T20:29:24Z",
        "packageManager": "npm",
        "publicationTime": "2020-02-27T13:28:41Z",
        "modificationTime": "2022-01-03T18:04:12.459024Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "download@8.0.0",
          "decompress@4.2.1",
          "decompress-targz@4.1.1",
          "decompress-tar@4.1.1"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "decompress-tar",
        "version": "4.1.1",
        "severityWithCritical": "medium"
      },
      {
        "id": "SNYK-JS-DICER-2311764",
        "title": "Denial of Service (DoS)",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C",
        "credit": [
          "Aras Abbasi"
        ],
        "semver": {
          "vulnerable": [
            "*"
          ]
        },
        "exploit": "Functional",
        "fixedIn": [],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "high",
        "cvssScore": 7.5,
        "functions": [],
        "malicious": false,
        "moduleName": "dicer",
        "references": [
          {
            "url": "https://github.com/mscdex/dicer/pull/22/commits/b7fca2e93e8e9d4439d8acc5c02f5e54a0112dac",
            "title": "GitHub Commit"
          },
          {
            "url": "https://github.com/mscdex/busboy/issues/250",
            "title": "GitHub Issue"
          },
          {
            "url": "https://github.com/mscdex/dicer/pull/22",
            "title": "GitHub PR"
          }
        ],
        "cvssDetails": [
          {
            "assigner": "NVD",
            "severity": "high",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "modificationTime": "2022-06-07T13:11:23.181321Z"
          }
        ],
        "description": "## Overview\n\nAffected versions of this package are vulnerable to Denial of Service (DoS). A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.\r\n\r\n## PoC:\r\n```js\r\n    fetch('form-image', {\r\n      method: 'POST',\r\n      headers: {\r\n        ['content-type']: 'multipart/form-data; boundary=----WebKitFormBoundaryoo6vortfDzBsDiro',\r\n        ['content-length']: '145',\r\n        host: '127.0.0.1:8000',\r\n        connection: 'keep-alive',\r\n      },\r\n      body: '------WebKitFormBoundaryoo6vortfDzBsDiro\\r\\n Content-Disposition: form-data; name=\"bildbeschreibung\"\\r\\n\\r\\n\\r\\n------WebKitFormBoundaryoo6vortfDzBsDiro--'\r\n    });\r\n```\n## Remediation\nThere is no fixed version for `dicer`.\n## References\n- [GitHub Commit](https://github.com/mscdex/dicer/pull/22/commits/b7fca2e93e8e9d4439d8acc5c02f5e54a0112dac)\n- [GitHub Issue](https://github.com/mscdex/busboy/issues/250)\n- [GitHub PR](https://github.com/mscdex/dicer/pull/22)\n",
        "identifiers": {
          "CVE": [
            "CVE-2022-24434"
          ],
          "CWE": [
            "CWE-400"
          ]
        },
        "packageName": "dicer",
        "proprietary": true,
        "creationTime": "2021-12-07T14:51:46.208362Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2021-12-07T14:51:02Z",
        "packageManager": "npm",
        "publicationTime": "2022-05-19T10:52:23Z",
        "modificationTime": "2022-06-09T21:50:31.265376Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "multer@1.4.4",
          "busboy@0.2.14",
          "dicer@0.2.5"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "dicer",
        "version": "0.2.5",
        "severityWithCritical": "high"
      },
      {
        "id": "SNYK-JS-EIVINDFJELDSTADDOT-564434",
        "title": "Prototype Pollution",
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
        "credit": [
          "JHU System Security Lab"
        ],
        "semver": {
          "vulnerable": [
            "*"
          ]
        },
        "exploit": "Proof of Concept",
        "fixedIn": [],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "medium",
        "cvssScore": 4.2,
        "functions": [],
        "malicious": false,
        "moduleName": "eivindfjeldstad-dot",
        "references": [
          {
            "url": "https://github.com/eivindfjeldstad/dot/commit/774e4b0c97ca35d2ae40df2cd14428d37dd07a0b",
            "title": "GitHub Commit"
          }
        ],
        "cvssDetails": [
          {
            "assigner": "NVD",
            "severity": "medium",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 5.3,
            "modificationTime": "2022-01-03T18:10:07.420105Z"
          }
        ],
        "description": "## Overview\n[eivindfjeldstad-dot](https://www.npmjs.com/package/eivindfjeldstad-dot) is a module that Gets and sets object properties with dot notation.\r\n\r\n**Note:** this package has been deprecated and moved into `@eivifj/dot`.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The function `set` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.\r\n\r\n## PoC\r\n```\r\nvar a = require(\"eivindfjeldstad-dot\")\r\nvar path = \"__proto__.toString\";\r\na.set({},path,\"JHU\");\r\nconsole.log({}.toString);\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `eivindfjeldstad-dot`.\n## References\n- [GitHub Commit](https://github.com/eivindfjeldstad/dot/commit/774e4b0c97ca35d2ae40df2cd14428d37dd07a0b)\n",
        "identifiers": {
          "CVE": [
            "CVE-2020-7639"
          ],
          "CWE": [
            "CWE-1321"
          ]
        },
        "packageName": "eivindfjeldstad-dot",
        "proprietary": true,
        "creationTime": "2020-04-05T14:48:43.897856Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2020-04-05T00:00:00Z",
        "packageManager": "npm",
        "publicationTime": "2020-04-05T00:00:00Z",
        "modificationTime": "2022-08-25T12:14:41.018488Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "yaml-schema-validator@1.2.3",
          "validate@4.5.1",
          "eivindfjeldstad-dot@0.0.1"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "eivindfjeldstad-dot",
        "version": "0.0.1",
        "severityWithCritical": "medium"
      },
      {
        "id": "SNYK-JS-GOT-2932019",
        "title": "Open Redirect",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
        "credit": [
          "Unknown"
        ],
        "semver": {
          "vulnerable": [
            "<11.8.5",
            ">=12.0.0 <12.1.0"
          ]
        },
        "exploit": "Not Defined",
        "fixedIn": [
          "11.8.5",
          "12.1.0"
        ],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "medium",
        "cvssScore": 5.4,
        "functions": [],
        "malicious": false,
        "moduleName": "got",
        "references": [
          {
            "url": "https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0",
            "title": "GitHub Diff"
          },
          {
            "url": "https://github.com/sindresorhus/got/pull/2047",
            "title": "GitHub PR"
          }
        ],
        "cvssDetails": [
          {
            "assigner": "NVD",
            "severity": "medium",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 5.3,
            "modificationTime": "2022-06-29T01:11:26.531842Z"
          },
          {
            "assigner": "Red Hat",
            "severity": "medium",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "cvssV3BaseScore": 5.3,
            "modificationTime": "2022-11-19T20:57:05.871669Z"
          }
        ],
        "description": "## Overview\n\nAffected versions of this package are vulnerable to Open Redirect due to missing verification of requested URLs. It allowed a victim to be redirected to a UNIX socket.\n## Remediation\nUpgrade `got` to version 11.8.5, 12.1.0 or higher.\n## References\n- [GitHub Diff](https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0)\n- [GitHub PR](https://github.com/sindresorhus/got/pull/2047)\n",
        "identifiers": {
          "CVE": [
            "CVE-2022-33987"
          ],
          "CWE": [
            "CWE-601"
          ]
        },
        "packageName": "got",
        "proprietary": false,
        "creationTime": "2022-06-19T09:23:24.210132Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2022-06-19T08:33:16Z",
        "packageManager": "npm",
        "publicationTime": "2022-06-19T15:33:44.269688Z",
        "modificationTime": "2022-11-19T20:57:05.871669Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "download@8.0.0",
          "got@8.3.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "got",
        "version": "8.3.2",
        "severityWithCritical": "medium"
      },
      {
        "id": "SNYK-JS-LODASHSET-1320032",
        "title": "Prototype Pollution",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
        "credit": [
          "awarau"
        ],
        "semver": {
          "vulnerable": [
            "*"
          ]
        },
        "exploit": "Proof of Concept",
        "fixedIn": [],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "high",
        "cvssScore": 7.3,
        "functions": [],
        "malicious": false,
        "moduleName": "lodash.set",
        "references": [
          {
            "url": "https://hackerone.com/reports/864701",
            "title": "HackerOne Report"
          }
        ],
        "cvssDetails": [],
        "description": "## Overview\n[lodash.set](https://www.npmjs.com/package/lodash.set) is a lodash method _.set exported as a Node.js module.\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `setWith` and `set` functions.\r\n\r\n## PoC by awarau\r\n* Create a JS file with this contents:\r\n```\r\nlod = require('lodash')\r\nlod.setWith({}, \"__proto__[test]\", \"123\")\r\nlod.set({}, \"__proto__[test2]\", \"456\")\r\nconsole.log(Object.prototype)\r\n```\r\n* Execute it with `node`\r\n* Observe that `test` and `test2` is now in the `Object.prototype`.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nThere is no fixed version for `lodash.set`.\n## References\n- [HackerOne Report](https://hackerone.com/reports/864701)\n",
        "identifiers": {
          "CVE": [],
          "CWE": [
            "CWE-1321"
          ]
        },
        "packageName": "lodash.set",
        "proprietary": false,
        "creationTime": "2021-07-19T12:00:32.890460Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2020-08-21T10:34:29Z",
        "packageManager": "npm",
        "publicationTime": "2020-08-21T12:53:03Z",
        "modificationTime": "2022-08-25T12:14:41.622393Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "grunt-replace-json@0.1.0",
          "lodash.set@4.3.2"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "lodash.set",
        "version": "4.3.2",
        "severityWithCritical": "high"
      },
      {
        "id": "SNYK-JS-MARSDB-480405",
        "title": "Arbitrary Code Injection",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "credit": [
          "Francois Gauthier"
        ],
        "semver": {
          "vulnerable": [
            "*"
          ]
        },
        "exploit": "Not Defined",
        "fixedIn": [],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "critical",
        "cvssScore": 9.8,
        "functions": [],
        "malicious": false,
        "moduleName": "marsdb",
        "references": [
          {
            "url": "https://www.npmjs.com/advisories/1122",
            "title": "NPM Security Advisory"
          }
        ],
        "cvssDetails": [],
        "description": "## Overview\n[marsdb](https://github.com/c58/marsdb) is a MarsDB is a lightweight client-side database.\n\nAffected versions of this package are vulnerable to Arbitrary Code Injection. In the `DocumentMatcher` class, selectors on `$where` clauses are passed to a Function constructor unsanitized. This allows attackers to run arbitrary commands in the system when the function is executed.\n## Remediation\nThere is no fixed version for `marsdb`.\n## References\n- [NPM Security Advisory](https://www.npmjs.com/advisories/1122)\n",
        "identifiers": {
          "CVE": [],
          "CWE": [
            "CWE-94"
          ],
          "NSP": [
            "1122"
          ],
          "GHSA": [
            "GHSA-5mrr-rgp6-x4gr"
          ]
        },
        "packageName": "marsdb",
        "proprietary": false,
        "creationTime": "2019-11-06T09:43:57.923159Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2019-08-29T17:53:27Z",
        "packageManager": "npm",
        "publicationTime": "2019-11-06T11:41:52Z",
        "modificationTime": "2020-12-14T14:41:11.223902Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "marsdb@0.6.11"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "marsdb",
        "version": "0.6.11",
        "severityWithCritical": "critical"
      },
      {
        "id": "SNYK-JS-MINIMIST-2429795",
        "title": "Prototype Pollution",
        "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P",
        "credit": [
          "Unknown"
        ],
        "semver": {
          "vulnerable": [
            "<1.2.6"
          ]
        },
        "exploit": "Proof of Concept",
        "fixedIn": [
          "1.2.6"
        ],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "low",
        "cvssScore": 3.7,
        "functions": [],
        "malicious": false,
        "moduleName": "minimist",
        "references": [
          {
            "url": "https://github.com/substack/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d",
            "title": "Fix Commit"
          },
          {
            "url": "https://github.com/substack/minimist/issues/164",
            "title": "GitHub Issue"
          },
          {
            "url": "https://github.com/substack/minimist/blob/master/index.js%23L69",
            "title": "Vulnerable Code"
          }
        ],
        "cvssDetails": [
          {
            "assigner": "SUSE",
            "severity": "medium",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "cvssV3BaseScore": 5.6,
            "modificationTime": "2022-05-18T11:05:33.152638Z"
          },
          {
            "assigner": "NVD",
            "severity": "critical",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "modificationTime": "2022-04-13T01:10:15.021168Z"
          },
          {
            "assigner": "Red Hat",
            "severity": "high",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 8.1,
            "modificationTime": "2022-11-25T14:17:13.977821Z"
          }
        ],
        "description": "## Overview\n[minimist](https://www.npmjs.com/package/minimist) is a parse argument options module.\n\nAffected versions of this package are vulnerable to Prototype Pollution due to a missing handler to `Function.prototype`.\r\n\r\n**Notes:** \r\n\r\n- This vulnerability is a bypass to [CVE-2020-7598](https://security.snyk.io/vuln/SNYK-JS-MINIMIST-559764)\r\n\r\n- The reason for the different CVSS between CVE-2021-44906 to CVE-2020-7598, is that CVE-2020-7598 can pollute objects, while CVE-2021-44906 can pollute only function.\r\n\r\n\r\n## PoC by Snyk\r\n```js\r\nrequire('minimist')('--_.constructor.constructor.prototype.foo bar'.split(' '));\r\nconsole.log((function(){}).foo); // bar\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `minimist` to version 1.2.6 or higher.\n## References\n- [Fix Commit](https://github.com/substack/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d)\n- [GitHub Issue](https://github.com/substack/minimist/issues/164)\n- [Vulnerable Code](https://github.com/substack/minimist/blob/master/index.js#L69)\n",
        "identifiers": {
          "CVE": [
            "CVE-2021-44906"
          ],
          "CWE": [
            "CWE-1321"
          ],
          "SNYK": [
            "SNYK-JS-MINIMIST-559764"
          ]
        },
        "packageName": "minimist",
        "proprietary": false,
        "creationTime": "2022-03-18T13:02:08.840039Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2022-03-18T12:24:05Z",
        "packageManager": "npm",
        "publicationTime": "2022-03-21T12:09:35Z",
        "modificationTime": "2022-11-25T14:17:13.977821Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "check-dependencies@1.1.0",
          "bower-config@1.4.3",
          "minimist@0.2.1"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "minimist",
        "version": "0.2.1",
        "severityWithCritical": "low"
      },
      {
        "id": "SNYK-JS-MOMENT-2944238",
        "title": "Regular Expression Denial of Service (ReDoS)",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
        "credit": [
          "Khang Vo"
        ],
        "semver": {
          "vulnerable": [
            ">=2.18.0 <2.29.4"
          ]
        },
        "exploit": "Proof of Concept",
        "fixedIn": [
          "2.29.4"
        ],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "high",
        "cvssScore": 7.5,
        "functions": [],
        "malicious": false,
        "moduleName": "moment",
        "references": [
          {
            "url": "https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3",
            "title": "GitHub Commit"
          },
          {
            "url": "https://github.com/moment/moment/issues/6012",
            "title": "GitHub Issue"
          },
          {
            "url": "https://github.com/moment/moment/pull/6015",
            "title": "GitHub PR"
          }
        ],
        "cvssDetails": [
          {
            "assigner": "NVD",
            "severity": "high",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "modificationTime": "2022-10-28T01:10:31.309052Z"
          },
          {
            "assigner": "Red Hat",
            "severity": "high",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "modificationTime": "2022-11-19T20:56:45.261178Z"
          }
        ],
        "description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `preprocessRFC2822()` function in `from-string.js`, when processing a very long crafted string (over 10k characters).\r\n\r\n\r\n\r\n## PoC:\r\n```js\r\nmoment(\"(\".repeat(500000))\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `moment` to version 2.29.4 or higher.\n## References\n- [GitHub Commit](https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3)\n- [GitHub Issue](https://github.com/moment/moment/issues/6012)\n- [GitHub PR](https://github.com/moment/moment/pull/6015)\n",
        "identifiers": {
          "CVE": [
            "CVE-2022-31129"
          ],
          "CWE": [
            "CWE-1333"
          ],
          "GHSA": [
            "GHSA-wc69-rhjr-hc9g"
          ]
        },
        "packageName": "moment",
        "proprietary": false,
        "creationTime": "2022-07-07T06:05:46.236101Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2022-07-06T18:38:49Z",
        "packageManager": "npm",
        "publicationTime": "2022-07-07T07:32:53Z",
        "modificationTime": "2022-11-19T20:56:45.261178Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "sequelize@5.22.5",
          "moment-timezone@0.5.34",
          "moment@2.29.1"
        ],
        "upgradePath": [
          false,
          "sequelize@5.22.5",
          "moment-timezone@0.5.34",
          "moment@2.29.4"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "moment",
        "version": "2.29.1",
        "severityWithCritical": "high"
      },
      {
        "id": "SNYK-JS-MOUT-2342654",
        "title": "Prototype Pollution",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
        "credit": [
          "P.Adithya Srinivas",
          "Masudul Hasan Masud Bhuiyan",
          "Cristian-Alexandru Staicu"
        ],
        "semver": {
          "vulnerable": [
            "<1.2.4"
          ]
        },
        "exploit": "Proof of Concept",
        "fixedIn": [
          "1.2.4"
        ],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "high",
        "cvssScore": 7.5,
        "functions": [],
        "malicious": false,
        "moduleName": "mout",
        "references": [
          {
            "url": "https://github.com/mout/mout/blob/master/src/object/deepFillIn.js",
            "title": "GitHub Additional Information"
          },
          {
            "url": "https://github.com/mout/mout/blob/master/src/object/deepMixIn.js",
            "title": "GitHub Additional Information"
          },
          {
            "url": "https://github.com/mout/mout/commit/17ffdc2a96417a63a0147156dc045e90d0d14c64",
            "title": "GitHub Commit"
          },
          {
            "url": "https://github.com/mout/mout/pull/279",
            "title": "GitHub PR"
          }
        ],
        "cvssDetails": [
          {
            "assigner": "NVD",
            "severity": "high",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "cvssV3BaseScore": 7.5,
            "modificationTime": "2022-06-29T01:11:24.754541Z"
          }
        ],
        "description": "## Overview\n[mout](https://www.npmjs.com/package/mout) is a Modular Utilities\n\nAffected versions of this package are vulnerable to Prototype Pollution. The `deepFillIn` function can be used to 'fill missing properties recursively', while the `deepMixIn` mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively is not checked, leading to exploiting this vulnerability.\r\n\r\n**Note:**  This vulnerability derives from an incomplete fix of [CVE-2020-7792](https://security.snyk.io/vuln/SNYK-JS-MOUT-1014544).\r\n\r\n\r\n## PoC\r\n```javascript\r\nlet mout = require(\"mout\")\r\nlet b = {};\r\nlet payload = JSON.parse('[\"constructor.prototype.polluted\"]');\r\nmout.object.set(b, payload, \"success\");\r\nconsole.log(polluted);\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `mout` to version 1.2.4 or higher.\n## References\n- [GitHub Additional Information](https://github.com/mout/mout/blob/master/src/object/deepFillIn.js)\n- [GitHub Additional Information](https://github.com/mout/mout/blob/master/src/object/deepMixIn.js)\n- [GitHub Commit](https://github.com/mout/mout/commit/17ffdc2a96417a63a0147156dc045e90d0d14c64)\n- [GitHub PR](https://github.com/mout/mout/pull/279)\n",
        "identifiers": {
          "CVE": [
            "CVE-2022-21213"
          ],
          "CWE": [
            "CWE-1321"
          ]
        },
        "packageName": "mout",
        "proprietary": true,
        "creationTime": "2022-01-19T08:32:39.145148Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2022-01-19T08:32:37Z",
        "packageManager": "npm",
        "publicationTime": "2022-06-15T15:27:59Z",
        "modificationTime": "2022-09-20T10:50:08.788220Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "check-dependencies@1.1.0",
          "bower-config@1.4.3",
          "mout@1.2.3"
        ],
        "upgradePath": [
          false,
          "check-dependencies@1.1.0",
          "bower-config@1.4.3",
          "mout@1.2.4"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "mout",
        "version": "1.2.3",
        "severityWithCritical": "high"
      },
      {
        "id": "SNYK-JS-NODEFETCH-2342118",
        "title": "Information Exposure",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
        "credit": [
          "Unknown"
        ],
        "semver": {
          "vulnerable": [
            "<2.6.7",
            ">=3.0.0 <3.1.1"
          ]
        },
        "exploit": "Not Defined",
        "fixedIn": [
          "2.6.7",
          "3.1.1"
        ],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "medium",
        "cvssScore": 6.5,
        "functions": [],
        "malicious": false,
        "moduleName": "node-fetch",
        "references": [
          {
            "url": "https://github.com/node-fetch/node-fetch/commit/1ef4b560a17e644a02a3bfdea7631ffeee578b35",
            "title": "Github Commit"
          },
          {
            "url": "https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10",
            "title": "GitHub Commit"
          },
          {
            "url": "https://github.com/node-fetch/node-fetch/pull/1449/commits/5c32f002fdd65b1c6a8f1e3620210813d45c7e60",
            "title": "GitHub Commit"
          },
          {
            "url": "https://github.com/node-fetch/node-fetch/pull/1449",
            "title": "GitHub PR"
          }
        ],
        "cvssDetails": [
          {
            "assigner": "SUSE",
            "severity": "medium",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "cvssV3BaseScore": 6.1,
            "modificationTime": "2022-05-18T11:06:23.475047Z"
          },
          {
            "assigner": "NVD",
            "severity": "medium",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "cvssV3BaseScore": 6.1,
            "modificationTime": "2022-10-29T01:10:37.609069Z"
          },
          {
            "assigner": "Red Hat",
            "severity": "medium",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "cvssV3BaseScore": 6.1,
            "modificationTime": "2022-11-27T21:31:03.384329Z"
          }
        ],
        "description": "## Overview\n[node-fetch](https://www.npmjs.com/package/node-fetch) is a light-weight module that brings window.fetch to node.js\n\nAffected versions of this package are vulnerable to Information Exposure when fetching a remote url with Cookie, if it get a `Location` response header, it will follow that url and try to fetch that url with provided cookie. This can lead to forwarding secure headers to 3th party.\n## Remediation\nUpgrade `node-fetch` to version 2.6.7, 3.1.1 or higher.\n## References\n- [Github Commit](https://github.com/node-fetch/node-fetch/commit/1ef4b560a17e644a02a3bfdea7631ffeee578b35)\n- [GitHub Commit](https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10)\n- [GitHub Commit](https://github.com/node-fetch/node-fetch/pull/1449/commits/5c32f002fdd65b1c6a8f1e3620210813d45c7e60)\n- [GitHub PR](https://github.com/node-fetch/node-fetch/pull/1449)\n",
        "identifiers": {
          "CVE": [
            "CVE-2022-0235",
            "CVE-2022-1365"
          ],
          "CWE": [
            "CWE-200"
          ]
        },
        "packageName": "node-fetch",
        "proprietary": false,
        "creationTime": "2022-01-17T12:08:00.675849Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2022-01-17T12:00:01Z",
        "packageManager": "npm",
        "publicationTime": "2022-01-17T16:25:00Z",
        "modificationTime": "2022-11-27T21:31:03.384329Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "libxmljs2@0.26.7",
          "@mapbox/node-pre-gyp@1.0.8",
          "node-fetch@2.6.6"
        ],
        "upgradePath": [
          false,
          "libxmljs2@0.26.7",
          "@mapbox/node-pre-gyp@1.0.8",
          "node-fetch@2.6.7"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "node-fetch",
        "version": "2.6.6",
        "severityWithCritical": "medium"
      },
      {
        "id": "SNYK-JS-NOTEVIL-2385946",
        "title": "Sandbox Bypass",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P",
        "credit": [
          "Cristian-Alexandru Staicu",
          "Abdullah Alhamdan"
        ],
        "semver": {
          "vulnerable": [
            "*"
          ]
        },
        "exploit": "Proof of Concept",
        "fixedIn": [],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "medium",
        "cvssScore": 6.5,
        "functions": [],
        "malicious": false,
        "moduleName": "notevil",
        "references": [],
        "cvssDetails": [
          {
            "assigner": "NVD",
            "severity": "medium",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "cvssV3BaseScore": 6.5,
            "modificationTime": "2022-03-24T13:10:40.225450Z"
          }
        ],
        "description": "## Overview\n[notevil](https://www.npmjs.com/package/notevil) is a module uses esprima to parse the javascript AST then walks each node and evaluates the result\r\n**Note:**This package has been deprecated.\n\nAffected versions of this package are vulnerable to Sandbox Bypass. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype.\r\n\r\n**Note:**  This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878).\r\n\r\n## PoC:\r\n```js\r\nvar safeEval = require('notevil')\r\n\r\nsafeEval(`  \r\nObject.defineProperty(({})[[\"__proto__\"]][[\"__proto__\"]], 'polluted', {\r\n  value: 'success'\r\n});`);\r\n\r\nconsole.log(polluted);\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nThere is no fixed version for `notevil`.\n",
        "identifiers": {
          "CVE": [
            "CVE-2021-23771"
          ],
          "CWE": [
            "CWE-1321",
            "CWE-265"
          ]
        },
        "packageName": "notevil",
        "proprietary": true,
        "creationTime": "2022-01-27T15:00:51.139678Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2022-01-27T15:00:48Z",
        "packageManager": "npm",
        "publicationTime": "2022-02-14T16:21:53.819915Z",
        "modificationTime": "2022-03-24T13:10:40.225450Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "notevil@1.3.3"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "notevil",
        "version": "1.3.3",
        "severityWithCritical": "medium"
      },
      {
        "id": "SNYK-JS-SIMPLEGET-2361683",
        "title": "Information Exposure",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P",
        "credit": [
          "Unknown"
        ],
        "semver": {
          "vulnerable": [
            "<2.8.2",
            ">=3.0.0 <3.1.1",
            ">=4.0.0 <4.0.1"
          ]
        },
        "exploit": "Proof of Concept",
        "fixedIn": [
          "2.8.2",
          "3.1.1",
          "4.0.1"
        ],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "high",
        "cvssScore": 8.8,
        "functions": [],
        "malicious": false,
        "moduleName": "simple-get",
        "references": [
          {
            "url": "https://github.com/feross/simple-get/commit/43c272db3e4b1383cb03d80338dba3e08c451641",
            "title": "Github Commit"
          },
          {
            "url": "https://github.com/feross/simple-get/commit/6eb82c090e30e7146fa5e9ae7212ca16b24b08b4",
            "title": "GitHub Commit"
          },
          {
            "url": "https://github.com/feross/simple-get/commit/e4af095e06cd69a9235013e8507e220a79b9684f",
            "title": "GitHub Commit"
          }
        ],
        "cvssDetails": [
          {
            "assigner": "NVD",
            "severity": "high",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "cvssV3BaseScore": 7.5,
            "modificationTime": "2022-02-02T04:10:10.987374Z"
          }
        ],
        "description": "## Overview\n\nAffected versions of this package are vulnerable to Information Exposure. When getting `Location response` header after fetching a remote url with Cookie, it will follow that url and fetch it with the provided cookie which will be then leaked to the attacker .\n## Remediation\nUpgrade `simple-get` to version 2.8.2, 3.1.1, 4.0.1 or higher.\n## References\n- [Github Commit](https://github.com/feross/simple-get/commit/43c272db3e4b1383cb03d80338dba3e08c451641)\n- [GitHub Commit](https://github.com/feross/simple-get/commit/6eb82c090e30e7146fa5e9ae7212ca16b24b08b4)\n- [GitHub Commit](https://github.com/feross/simple-get/commit/e4af095e06cd69a9235013e8507e220a79b9684f)\n",
        "identifiers": {
          "CVE": [
            "CVE-2022-0355"
          ],
          "CWE": [
            "CWE-200"
          ]
        },
        "packageName": "simple-get",
        "proprietary": false,
        "creationTime": "2022-01-26T09:25:03.374211Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2022-01-26T09:13:34Z",
        "packageManager": "npm",
        "publicationTime": "2022-01-26T16:17:22Z",
        "modificationTime": "2022-02-03T08:12:41.755229Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "grunt-contrib-compress@1.6.0",
          "iltorb@2.4.5",
          "prebuild-install@5.3.6",
          "simple-get@3.1.0"
        ],
        "upgradePath": [
          false,
          "grunt-contrib-compress@1.6.0",
          "iltorb@2.4.5",
          "prebuild-install@5.3.6",
          "simple-get@3.1.1"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "simple-get",
        "version": "3.1.0",
        "severityWithCritical": "high"
      },
      {
        "id": "SNYK-JS-SOCKETIOPARSER-3091012",
        "title": "Improper Input Validation",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "credit": [
          "Thomas Rinsma"
        ],
        "semver": {
          "vulnerable": [
            "<3.3.3",
            ">=3.4.0 <3.4.2",
            ">=4.0.0 <4.0.5",
            ">=4.1.0 <4.2.1"
          ]
        },
        "exploit": "Not Defined",
        "fixedIn": [
          "3.3.3",
          "3.4.2",
          "4.0.5",
          "4.2.1"
        ],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "critical",
        "cvssScore": 9.8,
        "functions": [],
        "malicious": false,
        "moduleName": "socket.io-parser",
        "references": [
          {
            "url": "https://github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8de7fa94a80d4",
            "title": "GitHub Commit"
          },
          {
            "url": "https://github.com/socketio/socket.io-parser/commit/b5d0cb7dc56a0601a09b056beaeeb0e43b160050",
            "title": "GitHub Commit"
          },
          {
            "url": "https://csirt.divd.nl/cases/DIVD-2022-00045",
            "title": "Vulnerability Report"
          },
          {
            "url": "https://csirt.divd.nl/cves/CVE-2022-2421",
            "title": "Vulnerability Report"
          }
        ],
        "cvssDetails": [
          {
            "assigner": "NVD",
            "severity": "critical",
            "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "cvssV3BaseScore": 9.8,
            "modificationTime": "2022-11-03T01:10:50.144673Z"
          }
        ],
        "description": "## Overview\n\n[socket.io-parser](https://www.npmjs.org/package/socket.io-parser) is a socket.io protocol parser\n\n\nAffected versions of this package are vulnerable to Improper Input Validation.\nwhen parsing attachments containing untrusted user input. Attackers can overwrite the `_placeholder` object to place references to functions in query objects.\r\n\r\n## PoC\r\n\r\n```js\r\nconst decoder = new Decoder();\r\n\r\ndecoder.on(\"decoded\", (packet) => {\r\n  console.log(packet.data); // prints [ 'hello', [Function: splice] ]\r\n})\r\n\r\ndecoder.add('51-[\"hello\",{\"_placeholder\":true,\"num\":\"splice\"}]');\r\ndecoder.add(Buffer.from(\"world\"));\r\n```\n\n## Remediation\n\nUpgrade `socket.io-parser` to version 3.3.3, 3.4.2, 4.0.5, 4.2.1 or higher.\n\n\n## References\n\n- [GitHub Commit](https://github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8de7fa94a80d4)\n\n- [GitHub Commit](https://github.com/socketio/socket.io-parser/commit/b5d0cb7dc56a0601a09b056beaeeb0e43b160050)\n\n- [Vulnerability Report](https://csirt.divd.nl/cases/DIVD-2022-00045)\n\n- [Vulnerability Report](https://csirt.divd.nl/cves/CVE-2022-2421)\n",
        "identifiers": {
          "CVE": [
            "CVE-2022-2421"
          ],
          "CWE": [
            "CWE-89"
          ],
          "GHSA": [
            "GHSA-qm95-pgcg-qqfq"
          ]
        },
        "packageName": "socket.io-parser",
        "proprietary": false,
        "creationTime": "2022-10-30T11:44:09.888401Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2022-10-26T12:57:39Z",
        "packageManager": "npm",
        "publicationTime": "2022-10-30T12:46:06.853890Z",
        "modificationTime": "2022-11-15T14:07:51.338748Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "socket.io@2.4.1",
          "socket.io-parser@3.4.1"
        ],
        "upgradePath": [
          false,
          "socket.io@2.4.1",
          "socket.io-parser@3.4.2"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "socket.io-parser",
        "version": "3.4.1",
        "severityWithCritical": "critical"
      },
      {
        "id": "SNYK-JS-UNSETVALUE-2400660",
        "title": "Prototype Pollution",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "credit": [
          "khizar"
        ],
        "semver": {
          "vulnerable": [
            "<2.0.1"
          ]
        },
        "exploit": "Not Defined",
        "fixedIn": [
          "2.0.1"
        ],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "high",
        "cvssScore": 7.5,
        "functions": [],
        "malicious": false,
        "moduleName": "unset-value",
        "references": [
          {
            "url": "https://github.com/jonschlinkert/unset-value/pull/12/commits/abb534769f6ea62c3dd988f5ce0a4ebd1f91b561",
            "title": "GitHub Commit"
          },
          {
            "url": "https://github.com/jonschlinkert/unset-value/issues/11",
            "title": "GitHub Issue"
          },
          {
            "url": "https://github.com/jonschlinkert/unset-value/pull/12",
            "title": "GitHub PR"
          },
          {
            "url": "https://github.com/jonschlinkert/unset-value/releases",
            "title": "GitHub Release"
          }
        ],
        "cvssDetails": [],
        "description": "## Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `unset` function in `index.js`, because it allows access to object prototype properties.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n## How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `unset-value` to version 2.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/jonschlinkert/unset-value/pull/12/commits/abb534769f6ea62c3dd988f5ce0a4ebd1f91b561)\n- [GitHub Issue](https://github.com/jonschlinkert/unset-value/issues/11)\n- [GitHub PR](https://github.com/jonschlinkert/unset-value/pull/12)\n- [GitHub Release](https://github.com/jonschlinkert/unset-value/releases)\n",
        "identifiers": {
          "CVE": [],
          "CWE": [
            "CWE-1321"
          ]
        },
        "packageName": "unset-value",
        "proprietary": false,
        "creationTime": "2022-02-13T14:46:07.185334Z",
        "functions_new": [],
        "alternativeIds": [],
        "disclosureTime": "2022-02-13T14:44:04Z",
        "packageManager": "npm",
        "publicationTime": "2022-02-13T15:26:38.063549Z",
        "modificationTime": "2022-02-13T15:26:38.065734Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "check-dependencies@1.1.0",
          "findup-sync@2.0.0",
          "micromatch@3.1.10",
          "extglob@2.0.4",
          "expand-brackets@2.1.4",
          "snapdragon@0.8.2",
          "base@0.11.2",
          "cache-base@1.0.1",
          "unset-value@1.0.0"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "unset-value",
        "version": "1.0.0",
        "severityWithCritical": "high"
      },
      {
        "id": "npm:underscore.string:20170908",
        "title": "Regular Expression Denial of Service (ReDoS)",
        "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "credit": [
          "Cristian-Alexandru Staicu"
        ],
        "semver": {
          "vulnerable": [
            ">2.4.0 <3.3.6"
          ]
        },
        "exploit": "Not Defined",
        "fixedIn": [
          "3.3.6"
        ],
        "patches": [],
        "insights": {
          "triageAdvice": null
        },
        "language": "js",
        "severity": "high",
        "cvssScore": 7.5,
        "functions": [
          {
            "version": [
              ">2.4.1 <3.3.5"
            ],
            "functionId": {
              "filePath": "unescapeHTML.js",
              "className": null,
              "functionName": "module.exports"
            }
          }
        ],
        "malicious": false,
        "moduleName": "underscore.string",
        "references": [
          {
            "url": "https://github.com/epeli/underscore.string/commit/f486cd684c94c12db48b45d52b1472a1b9661029",
            "title": "GitHub Commit"
          },
          {
            "url": "https://github.com/esamattis/underscore.string/commit/d095c4af392fe105797288c352c7ccb8a3413425",
            "title": "GitHub Commit"
          },
          {
            "url": "https://github.com/epeli/underscore.string/issues/510",
            "title": "GitHub Issue"
          },
          {
            "url": "https://github.com/esamattis/underscore.string/pull/525",
            "title": "GitHub PR"
          }
        ],
        "cvssDetails": [],
        "description": "## Overview\n[underscore.string](https://www.npmjs.com/package/underscore.string) is a Javascript lacks complete string manipulation operations.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). It parses dates using regex strings, which may cause a slowdown of 2 seconds per 50k characters.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `underscore.string` to version 3.3.6 or higher.\n## References\n- [GitHub Commit](https://github.com/epeli/underscore.string/commit/f486cd684c94c12db48b45d52b1472a1b9661029)\n- [GitHub Commit](https://github.com/esamattis/underscore.string/commit/d095c4af392fe105797288c352c7ccb8a3413425)\n- [GitHub Issue](https://github.com/epeli/underscore.string/issues/510)\n- [GitHub PR](https://github.com/esamattis/underscore.string/pull/525)\n",
        "identifiers": {
          "CVE": [],
          "CWE": [
            "CWE-400"
          ],
          "NSP": [
            "745"
          ],
          "GHSA": [
            "GHSA-v2p6-4mp7-3r9v"
          ],
          "ALTERNATIVE": [
            "SNYK-JS-UNDERSCORESTRING-12168"
          ]
        },
        "packageName": "underscore.string",
        "proprietary": false,
        "creationTime": "2018-06-21T17:51:09.741000Z",
        "functions_new": [
          {
            "version": [
              ">2.4.1 <3.3.5"
            ],
            "functionId": {
              "filePath": "unescapeHTML.js",
              "functionName": "module.exports"
            }
          }
        ],
        "alternativeIds": [
          "SNYK-JS-UNDERSCORESTRING-12168"
        ],
        "disclosureTime": "2017-09-08T17:51:09Z",
        "packageManager": "npm",
        "publicationTime": "2018-06-25T13:19:28Z",
        "modificationTime": "2022-05-16T13:08:55.548162Z",
        "socialTrendAlert": false,
        "from": [
          "juice-shop@12.3.0",
          "grunt@1.4.1",
          "grunt-legacy-util@2.0.1",
          "underscore.string@3.3.5"
        ],
        "upgradePath": [
          false,
          "grunt@1.4.1",
          "grunt-legacy-util@2.0.1",
          "underscore.string@3.3.6"
        ],
        "isUpgradable": true,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "underscore.string",
        "version": "3.3.5",
        "severityWithCritical": "high"
      },
      {
        "id": "snyk:lic:npm:fuzzball:GPL-2.0",
        "type": "license",
        "title": "GPL-2.0 license",
        "semver": {
          "vulnerable": [
            ">=0.1.4"
          ]
        },
        "license": "GPL-2.0",
        "language": "js",
        "description": "GPL-2.0 license",
        "packageName": "fuzzball",
        "creationTime": "2022-12-02T16:07:36.341Z",
        "packageManager": "npm",
        "publicationTime": "2022-12-02T16:07:36.341Z",
        "severity": "high",
        "from": [
          "juice-shop@12.3.0",
          "fuzzball@1.4.0"
        ],
        "upgradePath": [],
        "isUpgradable": false,
        "isPatchable": false,
        "isPinnable": false,
        "isRuntime": false,
        "name": "fuzzball",
        "version": "1.4.0",
        "severityWithCritical": "high"
      }
    ],
    "upgrade": {
      "body-parser@1.19.1": {
        "upgradeTo": "body-parser@1.19.2",
        "upgrades": [
          "qs@6.9.6"
        ],
        "vulns": [
          "SNYK-JS-QS-3153490"
        ]
      },
      "express@4.17.2": {
        "upgradeTo": "express@4.17.3",
        "upgrades": [
          "qs@6.9.6"
        ],
        "vulns": [
          "SNYK-JS-QS-3153490"
        ]
      },
      "express-jwt@0.1.3": {
        "upgradeTo": "express-jwt@6.0.0",
        "upgrades": [
          "express-jwt@0.1.3",
          "base64url@0.0.6",
          "jws@0.2.6",
          "jsonwebtoken@0.1.0",
          "moment@2.0.0",
          "moment@2.0.0",
          "moment@2.0.0",
          "moment@2.0.0"
        ],
        "vulns": [
          "SNYK-JS-EXPRESSJWT-575022",
          "npm:base64url:20180511",
          "npm:jws:20160726",
          "npm:jsonwebtoken:20150331",
          "SNYK-JS-MOMENT-2440688",
          "npm:moment:20160126",
          "npm:moment:20161019",
          "npm:moment:20170905"
        ]
      },
      "file-type@12.4.2": {
        "upgradeTo": "file-type@16.5.4",
        "upgrades": [
          "file-type@12.4.2"
        ],
        "vulns": [
          "SNYK-JS-FILETYPE-2958042"
        ]
      },
      "grunt@1.4.1": {
        "upgradeTo": "grunt@1.5.3",
        "upgrades": [
          "grunt@1.4.1",
          "grunt@1.4.1"
        ],
        "vulns": [
          "SNYK-JS-GRUNT-2813632",
          "SNYK-JS-GRUNT-2635969"
        ]
      },
      "jsonwebtoken@0.4.0": {
        "upgradeTo": "jsonwebtoken@5.0.0",
        "upgrades": [
          "base64url@0.0.6",
          "jws@0.2.6",
          "jsonwebtoken@0.4.0"
        ],
        "vulns": [
          "npm:base64url:20180511",
          "npm:jws:20160726",
          "npm:jsonwebtoken:20150331"
        ]
      },
      "juicy-chat-bot@0.6.5": {
        "upgradeTo": "juicy-chat-bot@0.6.6",
        "upgrades": [
          "vm2@3.9.3",
          "vm2@3.9.3",
          "vm2@3.9.3"
        ],
        "vulns": [
          "SNYK-JS-VM2-1585918",
          "SNYK-JS-VM2-2309905",
          "SNYK-JS-VM2-3018201"
        ]
      },
      "replace@1.2.1": {
        "upgradeTo": "replace@1.2.2",
        "upgrades": [
          "minimatch@3.0.4"
        ],
        "vulns": [
          "SNYK-JS-MINIMATCH-3050818"
        ]
      },
      "sanitize-html@1.4.2": {
        "upgradeTo": "sanitize-html@2.7.1",
        "upgrades": [
          "sanitize-html@1.4.2",
          "sanitize-html@1.4.2",
          "sanitize-html@1.4.2",
          "sanitize-html@1.4.2",
          "sanitize-html@1.4.2",
          "lodash@2.4.2",
          "lodash@2.4.2",
          "lodash@2.4.2",
          "lodash@2.4.2",
          "lodash@2.4.2",
          "lodash@2.4.2",
          "lodash@2.4.2",
          "lodash@2.4.2",
          "sanitize-html@1.4.2",
          "sanitize-html@1.4.2"
        ],
        "vulns": [
          "SNYK-JS-SANITIZEHTML-2957526",
          "SNYK-JS-SANITIZEHTML-1070780",
          "SNYK-JS-SANITIZEHTML-1070786",
          "SNYK-JS-SANITIZEHTML-585892",
          "npm:sanitize-html:20161026",
          "SNYK-JS-LODASH-1018905",
          "SNYK-JS-LODASH-1040724",
          "SNYK-JS-LODASH-450202",
          "SNYK-JS-LODASH-567746",
          "SNYK-JS-LODASH-608086",
          "SNYK-JS-LODASH-73638",
          "SNYK-JS-LODASH-73639",
          "npm:lodash:20180130",
          "npm:sanitize-html:20141024",
          "npm:sanitize-html:20160801"
        ]
      },
      "sequelize@5.22.5": {
        "upgradeTo": "sequelize@6.21.2",
        "upgrades": [
          "sequelize@5.22.5",
          "sequelize@5.22.5"
        ],
        "vulns": [
          "SNYK-JS-SEQUELIZE-2959225",
          "SNYK-JS-SEQUELIZE-2932027"
        ]
      },
      "socket.io@2.4.1": {
        "upgradeTo": "socket.io@3.0.0",
        "upgrades": [
          "engine.io@3.5.0",
          "engine.io@3.5.0"
        ],
        "vulns": [
          "SNYK-JS-ENGINEIO-1056749",
          "SNYK-JS-ENGINEIO-3136336"
        ]
      },
      "sqlite3@5.0.2": {
        "upgradeTo": "sqlite3@5.0.3",
        "upgrades": [
          "ansi-regex@2.1.1",
          "sqlite3@5.0.2",
          "tar@2.2.2",
          "tar@2.2.2",
          "tar@2.2.2",
          "tar@2.2.2",
          "tar@2.2.2",
          "tar@2.2.2"
        ],
        "vulns": [
          "SNYK-JS-ANSIREGEX-1583908",
          "SNYK-JS-SQLITE3-2388645",
          "SNYK-JS-TAR-1536528",
          "SNYK-JS-TAR-1536531",
          "SNYK-JS-TAR-1536758",
          "SNYK-JS-TAR-1579147",
          "SNYK-JS-TAR-1579152",
          "SNYK-JS-TAR-1579155"
        ]
      }
    },
    "patch": {},
    "ignore": {},
    "pin": {}
  },
  "filesystemPolicy": true,
  "filtered": {
    "ignore": [],
    "patch": []
  },
  "uniqueCount": 61,
  "projectName": "juice-shop",
  "foundProjectCount": 1,
  "displayTargetFile": "package-lock.json",
  "hasUnknownVersions": false,
  "path": "/Users/jordanmiles/Documents/GitHub/juice-shop"
}