Vulnerabilities

 2 via 2 paths

Dependencies

 177

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
  • 1
Status
  • 2
  • 0
  • 0

critical severity

Resources Downloaded over Insecure Protocol

  • Vulnerable module: esbuild
  • Introduced through: @intlify/unplugin-vue-i18n@11.2.5

Detailed paths

  • Introduced through: @nuxtjs/i18n@nuxt-community/i18n-module › @intlify/unplugin-vue-i18n@11.2.5 › @intlify/bundle-utils@11.2.5 › esbuild@0.25.12

Overview

esbuild is an An extremely fast JavaScript and CSS bundler and minifier.

Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol in the installFromNPM process. An attacker can execute arbitrary code with the privileges of the Deno process by supplying a malicious binary through control of the NPM_CONFIG_REGISTRY environment variable.

Remediation

Upgrade esbuild to version 0.28.1 or higher.

References

Resources Downloaded over Insecure Protocol vulnerability report

high severity
new

Uncontrolled Recursion

  • Vulnerable module: braces
  • Introduced through: @intlify/unplugin-vue-i18n@11.2.5

Detailed paths

  • Introduced through: @nuxtjs/i18n@nuxt-community/i18n-module › @intlify/unplugin-vue-i18n@11.2.5 › fast-glob@3.3.3 › micromatch@4.0.8 › braces@3.0.3

Overview

braces is a Bash-like brace expansion, implemented in JavaScript.

Affected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the character limit to exhaust the call stack and crash the Node.js process with an uncaught RangeError.

Remediation

There is no fixed version for braces.

References

Uncontrolled Recursion vulnerability report