Giter VIP home page Giter VIP logo

llvm-project's Introduction

Apple's fork of llvm-project

This is Apple's fork of llvm-project. For more information on Apple's branching scheme, please see apple-docs/AppleBranchingScheme.md.

The LLVM project's main README follows.

The LLVM Compiler Infrastructure

This directory and its sub-directories contain source code for LLVM, a toolkit for the construction of highly optimized compilers, optimizers, and run-time environments.

The README briefly describes how to get started with building LLVM. For more information on how to contribute to the LLVM project, please take a look at the Contributing to LLVM guide.

Getting Started with the LLVM System

Taken from https://llvm.org/docs/GettingStarted.html.

Overview

Welcome to the LLVM project!

The LLVM project has multiple components. The core of the project is itself called "LLVM". This contains all of the tools, libraries, and header files needed to process intermediate representations and converts it into object files. Tools include an assembler, disassembler, bitcode analyzer, and bitcode optimizer. It also contains basic regression tests.

C-like languages use the Clang front end. This component compiles C, C++, Objective-C, and Objective-C++ code into LLVM bitcode -- and from there into object files, using LLVM.

Other components include: the libc++ C++ standard library, the LLD linker, and more.

Getting the Source Code and Building LLVM

The LLVM Getting Started documentation may be out of date. The Clang Getting Started page might have more accurate information.

This is an example work-flow and configuration to get and build the LLVM source:

  1. Checkout LLVM (including related sub-projects like Clang):

    • git clone https://github.com/llvm/llvm-project.git

    • Or, on windows, git clone --config core.autocrlf=false https://github.com/llvm/llvm-project.git

  2. Configure and build LLVM and Clang:

    • cd llvm-project

    • mkdir build

    • cd build

    • cmake -G <generator> [options] ../llvm

      Some common build system generators are:

      • Ninja --- for generating Ninja build files. Most llvm developers use Ninja.
      • Unix Makefiles --- for generating make-compatible parallel makefiles.
      • Visual Studio --- for generating Visual Studio projects and solutions.
      • Xcode --- for generating Xcode projects.

      Some Common options:

      • -DLLVM_ENABLE_PROJECTS='...' --- semicolon-separated list of the LLVM sub-projects you'd like to additionally build. Can include any of: clang, clang-tools-extra, libcxx, libcxxabi, libunwind, lldb, compiler-rt, lld, polly, or debuginfo-tests.

        For example, to build LLVM, Clang, libcxx, and libcxxabi, use -DLLVM_ENABLE_PROJECTS="clang;libcxx;libcxxabi".

      • -DCMAKE_INSTALL_PREFIX=directory --- Specify for directory the full path name of where you want the LLVM tools and libraries to be installed (default /usr/local).

      • -DCMAKE_BUILD_TYPE=type --- Valid options for type are Debug, Release, RelWithDebInfo, and MinSizeRel. Default is Debug.

      • -DLLVM_ENABLE_ASSERTIONS=On --- Compile with assertion checks enabled (default is Yes for Debug builds, No for all other build types).

    • cmake --build . [-- [options] <target>] or your build system specified above directly.

      • The default target (i.e. ninja or make) will build all of LLVM.

      • The check-all target (i.e. ninja check-all) will run the regression tests to ensure everything is in working order.

      • CMake will generate targets for each tool and library, and most LLVM sub-projects generate their own check-<project> target.

      • Running a serial build will be slow. To improve speed, try running a parallel build. That's done by default in Ninja; for make, use the option -j NNN, where NNN is the number of parallel jobs, e.g. the number of CPUs you have.

    • For more information see CMake

Consult the Getting Started with LLVM page for detailed information on configuring and compiling LLVM. You can visit Directory Layout to learn about the layout of the source code tree.

llvm-project's People

Contributors

akyrtzi avatar arsenm avatar chandlerc avatar chapuni avatar d0k avatar ddunbar avatar douggregor avatar dwblaikie avatar echristo avatar eefriedman avatar ericwf avatar espindola avatar isanbard avatar kcc avatar labath avatar lattner avatar majnemer avatar maskray avatar nico avatar pcc avatar resistor avatar rksimon avatar rnk avatar rotateright avatar rui314 avatar stoklund avatar tkremenek avatar tobiasgrosser avatar topperc avatar zygoloid avatar

llvm-project's Issues

WS-2019-0425 (Medium) detected in mocha-4.0.1.tgz

WS-2019-0425 - Medium Severity Vulnerability

Vulnerable Library - mocha-4.0.1.tgz

simple, flexible, fun test framework

Library home page: https://registry.npmjs.org/mocha/-/mocha-4.0.1.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/mocha/package.json

Dependency Hierarchy:

  • mocha-4.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 53a7540377af5cfb21bdaf52cc4f3242c13c8301

Found in base branch: apple/main

Vulnerability Details

Mocha is vulnerable to ReDoS attack. If the stack trace in utils.js begins with a large error message, and full-trace is not enabled, utils.stackTraceFilter() will take exponential run time.

Publish Date: 2019-01-24

URL: WS-2019-0425

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-01-24

Fix Resolution: 6.0.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-32804 (High) detected in tar-2.2.2.tgz

CVE-2021-32804 - High Severity Vulnerability

Vulnerable Library - tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/tar/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • gulp-untar-0.0.6.tgz
      • tar-2.2.2.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Publish Date: 2021-08-03

URL: CVE-2021-32804

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3jfq-g458-7qm9

Release Date: 2021-08-03

Fix Resolution (tar): 3.2.2

Direct dependency fix Resolution (vscode): 1.1.31


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-27515 (Medium) detected in url-parse-1.4.7.tgz

CVE-2021-27515 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/url-parse/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • url-parse-1.4.7.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

url-parse before 1.5.0 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path.

Publish Date: 2021-02-22

URL: CVE-2021-27515

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27515

Release Date: 2021-02-22

Fix Resolution (url-parse): 1.5.0

Direct dependency fix Resolution (vscode): 1.1.11


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-25883 (High) detected in semver-5.7.1.tgz

CVE-2022-25883 - High Severity Vulnerability

Vulnerable Library - semver-5.7.1.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz

Path to dependency file: /llvm/utils/vscode/llvm/package.json

Path to vulnerable library: /llvm/utils/vscode/llvm/node_modules/semver/package.json,/lldb/tools/lldb-vscode/node_modules/semver/package.json

Dependency Hierarchy:

  • tslint-5.20.1.tgz (Root Library)
    • semver-5.7.1.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2

CVE-2020-7598 (Medium) detected in minimist-0.0.8.tgz

CVE-2020-7598 - Medium Severity Vulnerability

Vulnerable Library - minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /llvm/utils/vscode/llvm/package.json

Path to vulnerable library: /llvm/utils/vscode/llvm/node_modules/minimist/package.json,/lldb/tools/lldb-vscode/node_modules/minimist/package.json

Dependency Hierarchy:

  • tslint-5.20.1.tgz (Root Library)
    • mkdirp-0.5.1.tgz
      • minimist-0.0.8.tgz (Vulnerable Library)

Found in HEAD commit: 53a7540377af5cfb21bdaf52cc4f3242c13c8301

Found in base branch: apple/main

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-11

Fix Resolution (minimist): 0.2.1

Direct dependency fix Resolution (tslint): 6.0.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0686 (Critical) detected in url-parse-1.4.7.tgz

CVE-2022-0686 - Critical Severity Vulnerability

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/url-parse/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • url-parse-1.4.7.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

Publish Date: 2022-02-20

URL: CVE-2022-0686

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686

Release Date: 2022-02-20

Fix Resolution (url-parse): 1.5.8

Direct dependency fix Resolution (vscode): 1.1.11


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-29934 (Medium) detected in llvm-projectllvmorg-12.0.0-rc1

CVE-2023-29934 - Medium Severity Vulnerability

Vulnerable Library - llvm-projectllvmorg-12.0.0-rc1

The LLVM Project is a collection of modular and reusable compiler and toolchain technologies. Note: the repository does not accept github pull requests at this moment. Please submit your patches at http://reviews.llvm.org.

Library home page: https://github.com/llvm/llvm-project.git

Found in base branch: apple/main

Vulnerable Source Files (1)

/mlir/lib/Conversion/SCFToSPIRV/SCFToSPIRV.cpp

Vulnerability Details

llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect().

Publish Date: 2023-05-05

URL: CVE-2023-29934

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-05-05

Fix Resolution: llvmorg-16.0.0

CVE-2022-3517 (High) detected in minimatch-3.0.4.tgz

CVE-2022-3517 - High Severity Vulnerability

Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/minimatch/package.json,/llvm/utils/vscode/llvm/node_modules/minimatch/package.json

Dependency Hierarchy:

  • tslint-5.20.1.tgz (Root Library)
    • minimatch-3.0.4.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5

CVE-2021-37701 (High) detected in tar-2.2.2.tgz

CVE-2021-37701 - High Severity Vulnerability

Vulnerable Library - tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/tar/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • gulp-untar-0.0.6.tgz
      • tar-2.2.2.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Publish Date: 2021-08-31

URL: CVE-2021-37701

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9r2w-394v-53qc

Release Date: 2021-08-31

Fix Resolution (tar): 4.4.16

Direct dependency fix Resolution (vscode): 1.1.31


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-30846 (High) detected in typed-rest-client-1.2.0.tgz

CVE-2023-30846 - High Severity Vulnerability

Vulnerable Library - typed-rest-client-1.2.0.tgz

Node Rest and Http Clients for use with TypeScript

Library home page: https://registry.npmjs.org/typed-rest-client/-/typed-rest-client-1.2.0.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/typed-rest-client/package.json

Dependency Hierarchy:

  • vsce-1.84.0.tgz (Root Library)
    • typed-rest-client-1.2.0.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as follows: First, send any request with BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandler. Second, the target host may return a redirection (3xx), with a link to a second host. Third, the next request will use the credentials to authenticate with the second host, by setting the Authorization header. The expected behavior is that the next request will NOT set the Authorization header. The problem was fixed in version 1.8.0. There are no known workarounds.

Publish Date: 2023-04-26

URL: CVE-2023-30846

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-30846

Release Date: 2023-04-26

Fix Resolution (typed-rest-client): 1.8.0

Direct dependency fix Resolution (vsce): 1.88.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0691 (Critical) detected in url-parse-1.4.7.tgz

CVE-2022-0691 - Critical Severity Vulnerability

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/url-parse/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • url-parse-1.4.7.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

Publish Date: 2022-02-21

URL: CVE-2022-0691

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691

Release Date: 2022-02-21

Fix Resolution (url-parse): 1.5.9

Direct dependency fix Resolution (vscode): 1.1.11


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-33587 (High) detected in css-what-4.0.0.tgz

CVE-2021-33587 - High Severity Vulnerability

Vulnerable Library - css-what-4.0.0.tgz

a CSS selector parser

Library home page: https://registry.npmjs.org/css-what/-/css-what-4.0.0.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/css-what/package.json

Dependency Hierarchy:

  • vsce-1.84.0.tgz (Root Library)
    • cheerio-1.0.0-rc.5.tgz
      • cheerio-select-tmp-0.1.1.tgz
        • css-what-4.0.0.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Publish Date: 2021-05-28

URL: CVE-2021-33587

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587

Release Date: 2021-05-28

Fix Resolution (css-what): 5.0.1

Direct dependency fix Resolution (vsce): 1.85.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0639 (Medium) detected in url-parse-1.4.7.tgz

CVE-2022-0639 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/url-parse/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • url-parse-1.4.7.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.

Publish Date: 2022-02-17

URL: CVE-2022-0639

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0639

Release Date: 2022-02-17

Fix Resolution (url-parse): 1.5.7

Direct dependency fix Resolution (vscode): 1.1.11


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-44906 (Critical) detected in minimist-1.2.5.tgz, minimist-0.0.8.tgz

CVE-2021-44906 - Critical Severity Vulnerability

Vulnerable Libraries - minimist-1.2.5.tgz, minimist-0.0.8.tgz

minimist-1.2.5.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/gulp-util/node_modules/minimist/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • gulp-untar-0.0.6.tgz
      • gulp-util-3.0.8.tgz
        • minimist-1.2.5.tgz (Vulnerable Library)
minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /llvm/utils/vscode/llvm/package.json

Path to vulnerable library: /llvm/utils/vscode/llvm/node_modules/minimist/package.json,/lldb/tools/lldb-vscode/node_modules/minimist/package.json

Dependency Hierarchy:

  • tslint-5.20.1.tgz (Root Library)
    • mkdirp-0.5.1.tgz
      • minimist-0.0.8.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvch-5gv4-984h

Release Date: 2022-03-17

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (vscode): 1.1.11

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (tslint): 6.0.0


⛑️ Automatic Remediation will be attempted for this issue.

WS-2018-0590 (High) detected in diff-3.3.1.tgz

WS-2018-0590 - High Severity Vulnerability

Vulnerable Library - diff-3.3.1.tgz

A javascript text diff implementation.

Library home page: https://registry.npmjs.org/diff/-/diff-3.3.1.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/diff/package.json

Dependency Hierarchy:

  • mocha-4.0.1.tgz (Root Library)
    • diff-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: 53a7540377af5cfb21bdaf52cc4f3242c13c8301

Found in base branch: apple/main

Vulnerability Details

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Publish Date: 2018-03-05

URL: WS-2018-0590

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-03-05

Fix Resolution (diff): 3.5.0

Direct dependency fix Resolution (mocha): 5.0.3


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-26136 (Critical) detected in tough-cookie-2.5.0.tgz

CVE-2023-26136 - Critical Severity Vulnerability

Vulnerable Library - tough-cookie-2.5.0.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/tough-cookie/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • request-2.88.2.tgz
      • tough-cookie-2.5.0.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Publish Date: 2023-07-01

URL: CVE-2023-26136

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136

Release Date: 2023-07-01

Fix Resolution (tough-cookie): 4.1.3

Direct dependency fix Resolution (vscode): 1.1.31


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-28155 (Medium) detected in request-2.88.2.tgz

CVE-2023-28155 - Medium Severity Vulnerability

Vulnerable Library - request-2.88.2.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/request/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • request-2.88.2.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).NOTE: The request package is no longer supported by the maintainer.

Publish Date: 2023-03-16

URL: CVE-2023-28155

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p8p7-x288-28g6

Release Date: 2023-03-16

Fix Resolution: @cypress/request - 3.0.0

CVE-2021-37712 (High) detected in tar-2.2.2.tgz

CVE-2021-37712 - High Severity Vulnerability

Vulnerable Library - tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/tar/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • gulp-untar-0.0.6.tgz
      • tar-2.2.2.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.

Publish Date: 2021-08-31

URL: CVE-2021-37712

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qq89-hq3f-393p

Release Date: 2021-08-31

Fix Resolution (tar): 4.4.18

Direct dependency fix Resolution (vscode): 1.1.31


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-10744 (Critical) detected in lodash.template-3.6.2.tgz

CVE-2019-10744 - Critical Severity Vulnerability

Vulnerable Library - lodash.template-3.6.2.tgz

The modern build of lodash’s `_.template` as a module.

Library home page: https://registry.npmjs.org/lodash.template/-/lodash.template-3.6.2.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/lodash.template/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • gulp-untar-0.0.6.tgz
      • gulp-util-3.0.8.tgz
        • lodash.template-3.6.2.tgz (Vulnerable Library)

Found in HEAD commit: 53a7540377af5cfb21bdaf52cc4f3242c13c8301

Found in base branch: apple/main

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash.template): 4.5.0

Direct dependency fix Resolution (vscode): 1.1.18


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-33430 (Medium) detected in numpy-1.16.6-cp27-cp27mu-manylinux1_x86_64.whl

CVE-2021-33430 - Medium Severity Vulnerability

Vulnerable Library - numpy-1.16.6-cp27-cp27mu-manylinux1_x86_64.whl

Fundamental package for array computing in Python

Library home page: https://files.pythonhosted.org/packages/3a/5f/47e578b3ae79e2624e205445ab77a1848acdaa2929a00eeef6b16eaaeb20/numpy-1.16.6-cp27-cp27mu-manylinux1_x86_64.whl

Path to dependency file: /clang/utils/check_cfc

Path to vulnerable library: /clang/utils/check_cfc,/clang/utils/analyzer/requirements.txt,/debuginfo-tests/dexter/dex/debugger/dbgeng

Dependency Hierarchy:

  • numpy-1.16.6-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

** DISPUTED ** A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulneraility; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user.

Publish Date: 2021-12-17

URL: CVE-2021-33430

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-33430

Release Date: 2021-12-17

Fix Resolution: 1.21.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-40897 (Medium) detected in setuptools-44.1.1-py2.py3-none-any.whl

CVE-2022-40897 - Medium Severity Vulnerability

Vulnerable Library - setuptools-44.1.1-py2.py3-none-any.whl

Easily download, build, install, upgrade, and uninstall Python packages

Library home page: https://files.pythonhosted.org/packages/e1/b7/182161210a13158cd3ccc41ee19aadef54496b74f2817cc147006ec932b4/setuptools-44.1.1-py2.py3-none-any.whl

Path to dependency file: /clang/utils/check_cfc

Path to vulnerable library: /clang/utils/check_cfc,/clang/utils/analyzer/requirements.txt,/debuginfo-tests/dexter/dex/debugger/dbgeng

Dependency Hierarchy:

  • setuptools-44.1.1-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 53a7540377af5cfb21bdaf52cc4f3242c13c8301

Found in base branch: apple/main

Vulnerability Details

Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

Publish Date: 2022-12-23

URL: CVE-2022-40897

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/

Release Date: 2022-12-23

Fix Resolution: 65.5.1


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-3664 (Medium) detected in url-parse-1.4.7.tgz

CVE-2021-3664 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/url-parse/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • url-parse-1.4.7.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

url-parse is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2021-07-26

URL: CVE-2021-3664

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3664

Release Date: 2021-07-26

Fix Resolution (url-parse): 1.5.2

Direct dependency fix Resolution (vscode): 1.1.11


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0512 (Medium) detected in url-parse-1.4.7.tgz

CVE-2022-0512 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/url-parse/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • url-parse-1.4.7.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

Publish Date: 2022-02-14

URL: CVE-2022-0512

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0512

Release Date: 2022-02-14

Fix Resolution (url-parse): 1.5.6

Direct dependency fix Resolution (vscode): 1.1.11


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-32803 (High) detected in tar-2.2.2.tgz

CVE-2021-32803 - High Severity Vulnerability

Vulnerable Library - tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/tar/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • gulp-untar-0.0.6.tgz
      • tar-2.2.2.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

Publish Date: 2021-08-03

URL: CVE-2021-32803

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r628-mhmh-qjhw

Release Date: 2021-08-03

Fix Resolution (tar): 3.2.3

Direct dependency fix Resolution (vscode): 1.1.31


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-23343 (High) detected in path-parse-1.0.6.tgz

CVE-2021-23343 - High Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: /llvm/utils/vscode/llvm/package.json

Path to vulnerable library: /llvm/utils/vscode/llvm/node_modules/path-parse/package.json,/lldb/tools/lldb-vscode/node_modules/path-parse/package.json

Dependency Hierarchy:

  • tslint-5.20.1.tgz (Root Library)
    • resolve-1.15.1.tgz
      • path-parse-1.0.6.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution (path-parse): 1.0.7

Direct dependency fix Resolution (tslint): 6.0.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-13091 (High) detected in pandas-0.24.2-cp27-cp27mu-manylinux1_x86_64.whl - autoclosed

CVE-2020-13091 - High Severity Vulnerability

Vulnerable Library - pandas-0.24.2-cp27-cp27mu-manylinux1_x86_64.whl

Powerful data structures for data analysis, time series, and statistics

Library home page: https://files.pythonhosted.org/packages/db/83/7d4008ffc2988066ff37f6a0bb6d7b60822367dcb36ba5e39aa7801fda54/pandas-0.24.2-cp27-cp27mu-manylinux1_x86_64.whl

Path to dependency file: /clang/utils/analyzer/requirements.txt

Path to vulnerable library: /llvm-project/clang/utils/analyzer/requirements.txt,/llvm-project/clang/utils/check_cfc,/llvm-project/debuginfo-tests/dexter/dex/debugger/dbgeng

Dependency Hierarchy:

  • pandas-0.24.2-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 53a7540377af5cfb21bdaf52cc4f3242c13c8301

Found in base branch: apple/main

Vulnerability Details

** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the read_pickle() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner.

Publish Date: 2020-05-15

URL: CVE-2020-13091

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-13091

Release Date: 2020-05-19

Fix Resolution: pandas - 0.3.0.beta,1.0.4;autovizwidget - 0.12.7;pandas - 1.0.4,1.1.0rc0

CVE-2021-37713 (High) detected in tar-2.2.2.tgz

CVE-2021-37713 - High Severity Vulnerability

Vulnerable Library - tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/tar/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • gulp-untar-0.0.6.tgz
      • tar-2.2.2.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain .. path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory. Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path. This only affects users of node-tar on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

Publish Date: 2021-08-31

URL: CVE-2021-37713

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5955-9wpr-37jh

Release Date: 2021-08-31

Fix Resolution (tar): 4.4.18

Direct dependency fix Resolution (vscode): 1.1.31


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-3803 (High) detected in nth-check-2.0.0.tgz

CVE-2021-3803 - High Severity Vulnerability

Vulnerable Library - nth-check-2.0.0.tgz

Parses and compiles CSS nth-checks to highly optimized functions.

Library home page: https://registry.npmjs.org/nth-check/-/nth-check-2.0.0.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/nth-check/package.json

Dependency Hierarchy:

  • vsce-1.84.0.tgz (Root Library)
    • cheerio-1.0.0-rc.5.tgz
      • cheerio-select-tmp-0.1.1.tgz
        • css-select-3.1.2.tgz
          • nth-check-2.0.0.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

nth-check is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3803

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-17

Fix Resolution (nth-check): 2.0.1

Direct dependency fix Resolution (vsce): 1.85.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-34141 (Medium) detected in numpy-1.16.6-cp27-cp27mu-manylinux1_x86_64.whl

CVE-2021-34141 - Medium Severity Vulnerability

Vulnerable Library - numpy-1.16.6-cp27-cp27mu-manylinux1_x86_64.whl

Fundamental package for array computing in Python

Library home page: https://files.pythonhosted.org/packages/3a/5f/47e578b3ae79e2624e205445ab77a1848acdaa2929a00eeef6b16eaaeb20/numpy-1.16.6-cp27-cp27mu-manylinux1_x86_64.whl

Path to dependency file: /clang/utils/check_cfc

Path to vulnerable library: /clang/utils/check_cfc,/clang/utils/analyzer/requirements.txt,/debuginfo-tests/dexter/dex/debugger/dbgeng

Dependency Hierarchy:

  • numpy-1.16.6-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."

Publish Date: 2021-12-17

URL: CVE-2021-34141

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34141

Release Date: 2021-12-17

Fix Resolution: 1.22.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-28863 (Medium) detected in tar-2.2.2.tgz

CVE-2024-28863 - Medium Severity Vulnerability

Vulnerable Library - tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/tar/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • gulp-untar-0.0.6.tgz
      • tar-2.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 53a7540377af5cfb21bdaf52cc4f3242c13c8301

Found in base branch: apple/main

Vulnerability Details

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Publish Date: 2024-03-21

URL: CVE-2024-28863

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f5x3-32g6-xq36

Release Date: 2024-03-21

Fix Resolution: tar - 6.2.1

CVE-2021-3918 (Critical) detected in json-schema-0.2.3.tgz

CVE-2021-3918 - Critical Severity Vulnerability

Vulnerable Library - json-schema-0.2.3.tgz

JSON Schema validation and specifications

Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/json-schema/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • request-2.88.2.tgz
      • http-signature-1.2.0.tgz
        • jsprim-1.4.1.tgz
          • json-schema-0.2.3.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-11-13

URL: CVE-2021-3918

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918

Release Date: 2021-11-13

Fix Resolution (json-schema): 0.4.0

Direct dependency fix Resolution (vscode): 1.1.11


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24999 (High) detected in qs-6.5.2.tgz

CVE-2022-24999 - High Severity Vulnerability

Vulnerable Library - qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/qs/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • request-2.88.2.tgz
      • qs-6.5.2.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.5.3

Direct dependency fix Resolution (vscode): 1.1.11


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-21670 (Medium) detected in markdown-it-10.0.0.tgz

CVE-2022-21670 - Medium Severity Vulnerability

Vulnerable Library - markdown-it-10.0.0.tgz

Markdown-it - modern pluggable markdown parser.

Library home page: https://registry.npmjs.org/markdown-it/-/markdown-it-10.0.0.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/markdown-it/package.json

Dependency Hierarchy:

  • vsce-1.84.0.tgz (Root Library)
    • markdown-it-10.0.0.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.

Publish Date: 2022-01-10

URL: CVE-2022-21670

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6vfc-qv3f-vr6c

Release Date: 2022-01-10

Fix Resolution (markdown-it): 12.3.2

Direct dependency fix Resolution (vsce): 2.6.4


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-31852 (Medium) detected in llvm-projectllvmorg-12.0.0-rc1

CVE-2024-31852 - Medium Severity Vulnerability

Vulnerable Library - llvm-projectllvmorg-12.0.0-rc1

The LLVM Project is a collection of modular and reusable compiler and toolchain technologies. Note: the repository does not accept github pull requests at this moment. Please submit your patches at http://reviews.llvm.org.

Library home page: https://github.com/llvm/llvm-project.git

Found in base branch: apple/main

Vulnerable Source Files (1)

/llvm/lib/Target/ARM/ARMFrameLowering.cpp

Vulnerability Details

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."

Publish Date: 2024-04-05

URL: CVE-2024-31852

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-31852

Release Date: 2024-04-05

Fix Resolution: 0e16af8

WS-2021-0638 (High) detected in mocha-4.0.1.tgz

WS-2021-0638 - High Severity Vulnerability

Vulnerable Library - mocha-4.0.1.tgz

simple, flexible, fun test framework

Library home page: https://registry.npmjs.org/mocha/-/mocha-4.0.1.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/mocha/package.json

Dependency Hierarchy:

  • mocha-4.0.1.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

There is regular Expression Denial of Service (ReDoS) vulnerability in mocha.
It allows cause a denial of service when stripping crafted invalid function definition from strs.

Publish Date: 2021-09-18

URL: WS-2021-0638

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-18

Fix Resolution: 6.0.0-0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-28469 (High) detected in glob-parent-2.0.0.tgz, glob-parent-3.1.0.tgz

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Libraries - glob-parent-2.0.0.tgz, glob-parent-3.1.0.tgz

glob-parent-2.0.0.tgz

Strips glob magic from a string to provide the parent path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/glob-base/node_modules/glob-parent/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • gulp-symdest-1.1.1.tgz
      • vinyl-fs-2.4.4.tgz
        • glob-stream-5.3.5.tgz
          • micromatch-2.3.11.tgz
            • parse-glob-3.0.4.tgz
              • glob-base-0.3.0.tgz
                • glob-parent-2.0.0.tgz (Vulnerable Library)
glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/glob-parent/package.json

Dependency Hierarchy:

  • vscode-1.1.10.tgz (Root Library)
    • gulp-symdest-1.1.1.tgz
      • vinyl-fs-2.4.4.tgz
        • glob-stream-5.3.5.tgz
          • glob-parent-3.1.0.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution (glob-parent): 5.1.2

Direct dependency fix Resolution (vscode): 1.1.31

Fix Resolution (glob-parent): 5.1.2

Direct dependency fix Resolution (vscode): 1.1.31


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-29939 (Medium) detected in llvm-projectllvmorg-12.0.0-rc1

CVE-2023-29939 - Medium Severity Vulnerability

Vulnerable Library - llvm-projectllvmorg-12.0.0-rc1

The LLVM Project is a collection of modular and reusable compiler and toolchain technologies. Note: the repository does not accept github pull requests at this moment. Please submit your patches at http://reviews.llvm.org.

Library home page: https://github.com/llvm/llvm-project.git

Found in base branch: apple/main

Vulnerable Source Files (1)

/mlir/lib/Dialect/SPIRV/Transforms/LowerABIAttributesPass.cpp

Vulnerability Details

llvm-project commit a013839 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::TargetEnv(mlir::spirv::TargetEnvAttr).

Publish Date: 2023-05-05

URL: CVE-2023-29939

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-05-05

Fix Resolution: llvmorg-16.0.0

CVE-2021-23358 (High) detected in underscore-1.8.3.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.8.3.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.8.3.tgz

Path to dependency file: /lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /lldb/tools/lldb-vscode/node_modules/underscore/package.json

Dependency Hierarchy:

  • vsce-1.84.0.tgz (Root Library)
    • azure-devops-node-api-7.2.0.tgz
      • underscore-1.8.3.tgz (Vulnerable Library)

Found in base branch: apple/main

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution (underscore): 1.12.1

Direct dependency fix Resolution (vsce): 1.88.0


⛑️ Automatic Remediation will be attempted for this issue.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.