excel-as-json@0.9.0

Vulnerabilities

3 via 3 paths

Dependencies

37

Source

npm

Find, fix and prevent vulnerabilities in your code.

Severity
  • 1
  • 1
  • 1
Status
  • 3
  • 0
  • 0

high severity

Arbitrary File Overwrite

  • Vulnerable module: fstream
  • Introduced through: excel@0.1.4

Detailed paths

  • Introduced through: excel-as-json@0.9.0 excel@0.1.4 unzip@0.1.11 fstream@0.1.31

Overview

fstream is a package that supports advanced FS Streaming for Node.

Affected versions of this package are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.

Remediation

Upgrade fstream to version 1.0.12 or higher.

References

medium severity

Sensitive Information Exposure

  • Vulnerable module: libxmljs
  • Introduced through: excel@0.1.4

Detailed paths

  • Introduced through: excel-as-json@0.9.0 excel@0.1.4 libxmljs@0.14.3
    Remediation: Upgrade to excel-as-json@1.0.3.

Overview

nokogiri is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors. Affected versions of this Gem are vulnerable to both Memory Exhaustion and Sensitive Information Exposure.

Details

Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.

libxml2 could be made to crash if it opened a specially crafted file. It was discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service.

References

low severity

Arbitrary Code Injection

  • Vulnerable module: underscore
  • Introduced through: excel@0.1.4

Detailed paths

  • Introduced through: excel-as-json@0.9.0 excel@0.1.4 underscore@1.3.3
    Remediation: Upgrade to excel@1.0.0.

Overview

underscore is a JavaScript's functional programming helper library.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the template function, particularly when the variable option is taken from _.templateSettings as it is not sanitized.

PoC

const _ = require('underscore');
_.templateSettings.variable = "a = this.process.mainModule.require('child_process').execSync('touch HELLO')";
const t = _.template("")();

Remediation

Upgrade underscore to version 1.13.0-2, 1.12.1 or higher.

References