Vulnerabilities

 3 via 4 paths

Dependencies

 390

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 3
Status
  • 3
  • 0
  • 0

medium severity

Memory Allocation with Excessive Size Value

  • Vulnerable module: js-beautify
  • Introduced through: js-beautify@1.15.4

Detailed paths

  • Introduced through: parse-dashboard@parse-community/parse-dashboard › js-beautify@1.15.4

Overview

js-beautify is a reformat and re-indent bookmarklets, ugly JavaScript, unpack scripts packed by Dean Edward’s popular packer, as well as partly deobfuscate scripts processed by the npm package "javascript-obfuscator".

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via an unknown function, allowing a remote attacker to trigger uncontrolled memory allocation by sending a manipulated input, resulting in resource exhaustion.

Remediation

There is no fixed version for js-beautify.

References

Memory Allocation with Excessive Size Value vulnerability report

medium severity
new

Asymmetric Resource Consumption (Amplification)

  • Vulnerable module: minimatch
  • Introduced through: js-beautify@1.15.4

Detailed paths

  • Introduced through: parse-dashboard@parse-community/parse-dashboard › js-beautify@1.15.4 › editorconfig@1.0.7 › minimatch@9.0.9
  • Introduced through: parse-dashboard@parse-community/parse-dashboard › js-beautify@1.15.4 › glob@10.5.0 › minimatch@9.0.9

Overview

minimatch is a minimal matching utility.

Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) in the firstPhasePreProcess method, where the **/.. transform clones a globParts entry and pushes the clone back onto the same array inside a do...while (didSomething) fixpoint loop. An attacker can exhaust CPU and memory by supplying a glob pattern whose **/.. sequences regenerate entries during preprocessing, which secondPhasePreProcess then compares in an O(n^2) pairwise partsMatch pass over the expanded set. Exploitation requires the pattern to be parsed with optimizationLevel set to 2 or higher.

Remediation

Upgrade minimatch to version 11.0.1 or higher.

References

Asymmetric Resource Consumption (Amplification) vulnerability report

medium severity
new

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: glob
  • Introduced through: js-beautify@1.15.4

Detailed paths

  • Introduced through: parse-dashboard@parse-community/parse-dashboard › js-beautify@1.15.4 › glob@10.5.0
    Remediation: Upgrade to js-beautify@2.0.3.

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the walkCB, walkCB2, walkCBSync, and walkCB2Sync methods of src/walker.ts, where each abort branch calls cb() without returning. An attacker can keep a walk consuming filesystem I/O and CPU after it has already been aborted, by driving a traversal that the caller tries to bound, because execution continues past the abort into processPatterns(), readdirCB(), and recursive walkCB2() calls. This affects only callers that rely on the signal option or AbortSignal.timeout() to cancel a walk, and applies to both glob() and globStream().

Remediation

Upgrade glob to version 13.0.7, 14.0.2 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report