Vulnerabilities |
4 via 5 paths |
|---|---|
Dependencies |
214 |
Source |
GitHub |
Find, fix and prevent vulnerabilities in your code.
high severity
- Vulnerable module: uri-js
- Introduced through: eslint@10.14.0
Detailed paths
-
Introduced through: magicmirror@MichMich/MagicMirror › eslint@10.14.0 › ajv@6.15.0 › uri-js@4.4.1
Overview
uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.
Affected versions of this package are vulnerable to Infinite loop via the removeDotSegments function, which loops infinitely when a path segment begins with Unicode line separators (U+2028) or paragraph separators (U+2029). An attacker can trigger this by passing such a path to removeDotSegments directly, or through the normalize or resolve functions with IRI handling enabled, blocking the Node.js event loop indefinitely until heap exhaustion.
Remediation
There is no fixed version for uri-js.
References
medium severity
new
- Vulnerable module: minimatch
- Introduced through: eslint@10.14.0
Detailed paths
-
Introduced through: magicmirror@MichMich/MagicMirror › eslint@10.14.0 › minimatch@10.2.6
-
Introduced through: magicmirror@MichMich/MagicMirror › eslint@10.14.0 › @eslint/config-array@0.23.5 › minimatch@10.2.6
Overview
minimatch is a minimal matching utility.
Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) in the firstPhasePreProcess method, where the **/.. transform clones a globParts entry and pushes the clone back onto the same array inside a do...while (didSomething) fixpoint loop. An attacker can exhaust CPU and memory by supplying a glob pattern whose **/.. sequences regenerate entries during preprocessing, which secondPhasePreProcess then compares in an O(n^2) pairwise partsMatch pass over the expanded set. Exploitation requires the pattern to be parsed with optimizationLevel set to 2 or higher.
Remediation
Upgrade minimatch to version 11.0.1 or higher.
References
medium severity
- Vulnerable module: uri-js
- Introduced through: eslint@10.14.0
Detailed paths
-
Introduced through: magicmirror@MichMich/MagicMirror › eslint@10.14.0 › ajv@6.15.0 › uri-js@4.4.1
Overview
uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.
Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via pctDecChars(), which decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. An attacker can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.
Remediation
There is no fixed version for uri-js.
References
medium severity
- Vulnerable module: uri-js
- Introduced through: eslint@10.14.0
Detailed paths
-
Introduced through: magicmirror@MichMich/MagicMirror › eslint@10.14.0 › ajv@6.15.0 › uri-js@4.4.1
Overview
uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.
Affected versions of this package are vulnerable to Uncaught Exception in the parse() function of src/schemes/mailto.ts, whose to branch calls hfield[1].split(",") directly, while the subject, body, and default branches all route through unescapeComponent(), which short-circuits on a missing value. An attacker can crash the process by supplying a mailto URI whose query carries a bare to token with no =value, such as mailto:?to, so splitting on = yields a one element array and the undefined second element is dereferenced. This requires the application to pass an attacker-influenced string to URI.parse(), URI.resolve(), URI.normalize(), or URI.equal(), none of which wrap the scheme handler in a try/catch, and whether the throw terminates the process or only fails the one request depends on the host's own error handling.
Remediation
There is no fixed version for uri-js.