Find, fix and prevent vulnerabilities in your code.
high severity
new
- Vulnerable module: fast-xml-parser
- Introduced through: @salesforce/packaging@3.7.3
Detailed paths
-
Introduced through: sf-chipps-package@ClayChipps/sf-chipps-package#208ee9d4b4b3241ff116ffd6edaa79cc94158079 › @salesforce/packaging@3.7.3 › fast-xml-parser@4.5.3Remediation: Upgrade to @salesforce/packaging@4.20.1.
Overview
fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries
Affected versions of this package are vulnerable to Uncaught Exception in the numeric entity processing when parsing XML containing out-of-range entity code points. An attacker can cause the application to crash by submitting specially crafted XML input that triggers an uncaught exception.
Remediation
Upgrade fast-xml-parser to version 5.3.4 or higher.
References
medium severity
- Vulnerable module: tmp
- Introduced through: @salesforce/core@6.7.6 and @salesforce/sf-plugins-core@5.0.13
Detailed paths
-
Introduced through: sf-chipps-package@ClayChipps/sf-chipps-package#208ee9d4b4b3241ff116ffd6edaa79cc94158079 › @salesforce/core@6.7.6 › jsforce@2.0.0-beta.29 › inquirer@7.3.3 › external-editor@3.1.0 › tmp@0.0.33
-
Introduced through: sf-chipps-package@ClayChipps/sf-chipps-package#208ee9d4b4b3241ff116ffd6edaa79cc94158079 › @salesforce/sf-plugins-core@5.0.13 › @salesforce/core@6.7.6 › jsforce@2.0.0-beta.29 › inquirer@7.3.3 › external-editor@3.1.0 › tmp@0.0.33
Overview
Affected versions of this package are vulnerable to Symlink Attack via the dir parameter. An attacker can cause files or directories to be written to arbitrary locations by supplying a crafted symbolic link that resolves outside the intended temporary directory.
PoC
const tmp = require('tmp');
const tmpobj = tmp.fileSync({ 'dir': 'evil-dir'});
console.log('File: ', tmpobj.name);
try {
tmp.fileSync({ 'dir': 'mydir1'});
} catch (err) {
console.log('test 1:', err.message)
}
try {
tmp.fileSync({ 'dir': '/foo'});
} catch (err) {
console.log('test 2:', err.message)
}
try {
const fs = require('node:fs');
const resolved = fs.realpathSync('/tmp/evil-dir');
tmp.fileSync({ 'dir': resolved});
} catch (err) {
console.log('test 3:', err.message)
}
Remediation
Upgrade tmp to version 0.2.4 or higher.