You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to vulnerable library: /node_modules/postcss-modules-values/node_modules/postcss/package.json,/node_modules/postcss-modules-local-by-default/node_modules/postcss/package.json,/node_modules/vue-loader/node_modules/postcss/package.json,/node_modules/postcss-modules-extract-imports/node_modules/postcss/package.json,/node_modules/postcss-modules-scope/node_modules/postcss/package.json,/node_modules/icss-utils/node_modules/postcss/package.json
Path to vulnerable library: /node_modules/postcss-modules-values/node_modules/postcss/package.json,/node_modules/postcss-modules-local-by-default/node_modules/postcss/package.json,/node_modules/vue-loader/node_modules/postcss/package.json,/node_modules/postcss-modules-extract-imports/node_modules/postcss/package.json,/node_modules/postcss-modules-scope/node_modules/postcss/package.json,/node_modules/icss-utils/node_modules/postcss/package.json
Dependency Hierarchy:
vue-loader-13.6.1.tgz (Root Library)
❌ postcss-6.0.14.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).
Path to vulnerable library: /node_modules/path-parse/package.json
Dependency Hierarchy:
vue-loader-13.6.1.tgz (Root Library)
resolve-1.5.0.tgz
❌ path-parse-1.0.5.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
Path to vulnerable library: /node_modules/js-yaml/package.json
Dependency Hierarchy:
vue-loader-13.6.1.tgz (Root Library)
postcss-load-config-1.2.0.tgz
cosmiconfig-2.2.2.tgz
❌ js-yaml-3.10.0.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.
mend-for-github-combot
changed the title
vue-loader-13.6.1.tgz: 3 vulnerabilities (highest severity is: 8.1)
vue-loader-13.6.1.tgz: 5 vulnerabilities (highest severity is: 8.1)
Jul 9, 2022
mend-for-github-combot
changed the title
vue-loader-13.6.1.tgz: 5 vulnerabilities (highest severity is: 8.1)
vue-loader-13.6.1.tgz: 5 vulnerabilities (highest severity is: 9.8)
Aug 12, 2022
mend-for-github-combot
changed the title
vue-loader-13.6.1.tgz: 5 vulnerabilities (highest severity is: 9.8)
vue-loader-13.6.1.tgz: 4 vulnerabilities (highest severity is: 8.1)
Dec 7, 2022
mend-for-github-combot
changed the title
vue-loader-13.6.1.tgz: 4 vulnerabilities (highest severity is: 8.1)
vue-loader-13.6.1.tgz: 4 vulnerabilities (highest severity is: 8.1) - autoclosed
Feb 10, 2023
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
Vulnerable Library - vue-loader-13.6.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/postcss-modules-values/node_modules/postcss/package.json,/node_modules/postcss-modules-local-by-default/node_modules/postcss/package.json,/node_modules/vue-loader/node_modules/postcss/package.json,/node_modules/postcss-modules-extract-imports/node_modules/postcss/package.json,/node_modules/postcss-modules-scope/node_modules/postcss/package.json,/node_modules/icss-utils/node_modules/postcss/package.json
Vulnerabilities
Details
WS-2019-0063
Vulnerable Library - js-yaml-3.10.0.tgz
YAML 1.2 parser and serializer
Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/js-yaml/package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.
Publish Date: 2019-04-05
URL: WS-2019-0063
CVSS 3 Score Details (8.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/813
Release Date: 2019-04-05
Fix Resolution (js-yaml): 3.13.1
Direct dependency fix Resolution (vue-loader): 13.6.2
⛑️ Automatic Remediation is available for this issue
CVE-2021-23382
Vulnerable Library - postcss-6.0.14.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.14.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/postcss-modules-values/node_modules/postcss/package.json,/node_modules/postcss-modules-local-by-default/node_modules/postcss/package.json,/node_modules/vue-loader/node_modules/postcss/package.json,/node_modules/postcss-modules-extract-imports/node_modules/postcss/package.json,/node_modules/postcss-modules-scope/node_modules/postcss/package.json,/node_modules/icss-utils/node_modules/postcss/package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).
Publish Date: 2021-04-26
URL: CVE-2021-23382
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382
Release Date: 2021-04-26
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (vue-loader): 15.2.5
⛑️ Automatic Remediation is available for this issue
CVE-2021-23343
Vulnerable Library - path-parse-1.0.5.tgz
Node.js path.parse() ponyfill
Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/path-parse/package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
Publish Date: 2021-05-04
URL: CVE-2021-23343
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2021-05-04
Fix Resolution (path-parse): 1.0.7
Direct dependency fix Resolution (vue-loader): 13.6.2
⛑️ Automatic Remediation is available for this issue
WS-2019-0032
Vulnerable Library - js-yaml-3.10.0.tgz
YAML 1.2 parser and serializer
Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/js-yaml/package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.
Publish Date: 2019-03-20
URL: WS-2019-0032
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/788/versions
Release Date: 2019-03-20
Fix Resolution (js-yaml): 3.13.0
Direct dependency fix Resolution (vue-loader): 13.6.2
⛑️ Automatic Remediation is available for this issue
⛑️ Automatic Remediation is available for this issue.
The text was updated successfully, but these errors were encountered: