Find, fix and prevent vulnerabilities in your code.
critical severity
new
- Vulnerable module: gray-matter
- Introduced through: gray-matter@4.0.3
Detailed paths
-
Introduced through: fepper@electric-eloquence/fepper-npm#release › gray-matter@4.0.3
Overview
gray-matter is a Parse front-matter from a string or file. Fast, reliable and easy to use. Parses YAML front matter by default, but also has support for YAML, JSON, TOML or Coffee Front-Matter, with options to set custom delimiters. Used by metalsmith, assemble, verb and
Affected versions of this package are vulnerable to Arbitrary Code Injection via the eval process in lib/engines.js when parsing front matter with the language set to js or javascript. An attacker can execute arbitrary code by supplying crafted input that is evaluated by the JavaScript engine.
Remediation
There is no fixed version for gray-matter.
References
medium severity
new
- Vulnerable module: sprintf-js
- Introduced through: gray-matter@4.0.3
Detailed paths
-
Introduced through: fepper@electric-eloquence/fepper-npm#release › gray-matter@4.0.3 › js-yaml@3.15.2 › argparse@1.0.10 › sprintf-js@1.0.3
Overview
Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unbounded precision specifiers passed without validation to the toFixed, toExponential, and toPrecision methods. An attacker who controls a format string can inject precision values exceeding ECMAScript limits, causing uncaught RangeError exceptions that abort the calling operation.
Remediation
There is no fixed version for sprintf-js.
References
low severity
- Vulnerable module: prismjs
- Introduced through: prismjs@1.27.0
Detailed paths
-
Introduced through: fepper@electric-eloquence/fepper-npm#release › prismjs@1.27.0Remediation: Upgrade to prismjs@1.30.0.
Overview
prismjs is a lightweight, robust, elegant syntax highlighting library.
Affected versions of this package are vulnerable to Arbitrary Code Injection via the document.currentScript lookup process. An attacker can manipulate the web page content and execute unintended actions by injecting HTML elements that overshadow legitimate DOM elements.
Note:
This is only exploitable if the application accepts untrusted input containing HTML but not direct JavaScript.
Remediation
Upgrade prismjs to version 1.30.0 or higher.