Vulnerabilities

 2 via 2 paths

Dependencies

 119

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
  • 1
Status
  • 2
  • 0
  • 0

high severity

XML Entity Expansion (Billion Laughs)

  • Vulnerable module: svgo
  • Introduced through: @rpl/badge-up@3.0.0

Detailed paths

  • Introduced through: coveradge@brettz9/coveradge › @rpl/badge-up@3.0.0 › svgo@2.6.0

Overview

Affected versions of this package are vulnerable to XML Entity Expansion (Billion Laughs) when parsing of custom XML entities in DOCTYPE. An attacker can cause the application to consume excessive memory by submitting malicious SVG files containing recursive entity references.

Workaround

For version 4.0.0, upgrading the sax dependency to 1.5.0 recursively (yarn -R) mitigates this vulnerability.

Remediation

Upgrade svgo to version 2.8.1, 3.3.3, 4.0.1 or higher.

References

XML Entity Expansion (Billion Laughs) vulnerability report

medium severity
new

Incomplete List of Disallowed Inputs

  • Vulnerable module: svgo
  • Introduced through: @rpl/badge-up@3.0.0

Detailed paths

  • Introduced through: coveradge@brettz9/coveradge › @rpl/badge-up@3.0.0 › svgo@2.6.0

Overview

Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper handling of namespaced or prefixed script elements and case-sensitive matching of JavaScript URIs in the removeScripts plugin. An attacker can execute arbitrary scripts in the context of the application by uploading specially crafted SVG files containing executable scripts or JavaScript URIs that bypass sanitization.

Workaround

This vulnerability can be mitigated by using a dedicated SVG sanitization tool before processing SVG files.

Remediation

Upgrade svgo to version 2.8.3, 3.3.4, 4.0.2 or higher.

References

Incomplete List of Disallowed Inputs vulnerability report