{ "vulnerabilities": [ { "id": "SNYK-UBUNTU2204-NODEJS-17268893", "cpes": [], "title": "CVE-2026-45447", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447" }, { "url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt", "title": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25237", "title": "https://access.redhat.com/errata/RHSA-2026:25237" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25239", "title": "https://access.redhat.com/errata/RHSA-2026:25239" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26275", "title": "https://access.redhat.com/errata/RHSA-2026:26275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34102", "title": "https://access.redhat.com/errata/RHSA-2026:34102" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35869", "title": "https://access.redhat.com/errata/RHSA-2026:35869" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36215", "title": "https://access.redhat.com/errata/RHSA-2026:36215" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36217", "title": "https://access.redhat.com/errata/RHSA-2026:36217" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39009", "title": "https://access.redhat.com/errata/RHSA-2026:39009" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39012", "title": "https://access.redhat.com/errata/RHSA-2026:39012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45447", "title": "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44438", "title": "https://access.redhat.com/errata/RHSA-2026:44438" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735", "title": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737", "title": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58563", "title": "https://access.redhat.com/errata/RHSA-2026:58563" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nodejs` package and not the `nodejs` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nThere is no fixed version for `Ubuntu:22.04` `nodejs`.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n", "epssDetails": { "percentile": "0.88452", "probability": "0.03566", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45447" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "nodejs", "creationTime": "2026-06-10T02:46:34.655313Z", "disclosureTime": "2026-06-09T17:17:19.277000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:22.04", "publicationTime": "2026-06-10T02:46:34.660471Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-08-26T01:31:17.266491Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-wlc2-mc@2.50.6_def3651.4115", "nodejs@22.23.2-1nodesource1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "nodejs", "version": "22.23.2-1nodesource1" } ], "ok": false, "dependencyCount": 567, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "deb", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "binariesVulns": { "issuesData": {}, "affectedPkgs": {} }, "os": { "prettyName": "Ubuntu 22.04.5 LTS" } }, "summary": "1 high or critical severity vulnerable dependency path", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 1, "projectName": "docker-image|docker.io/scopear/docker-wlc2-mc", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115/scopear/docker-wlc2-mc", "applications": [ { "vulnerabilities": [], "ok": true, "dependencyCount": 77, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/opt/scopear/app/services/model-converter/package.json", "projectName": "worklink-create-model-converter", "displayTargetFile": "/opt/scopear/app/services/model-converter/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115" }, { "vulnerabilities": [ { "id": "SNYK-JS-EXTRACTZIP-17660777", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "credit": [ "Ziad Salah" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.6, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "extract-zip", "references": [ { "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json", "title": "Advisory" }, { "url": "https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf", "title": "GitHub Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-30T07:17:19.904850Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.6, "cvssVersion": "4.0", "modificationTime": "2026-07-24T14:06:06.638835Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-07-24T14:06:06.638835Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:17:19.904850Z" } ], "description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nThere is no fixed version for `extract-zip`.\n## References\n- [Advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json)\n- [GitHub Advisory](https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf)\n", "epssDetails": { "percentile": "0.31654", "probability": "0.00391", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-56876" ], "CWE": [ "CWE-22" ], "GHSA": [ "GHSA-x7jf-2287-qcpf" ] }, "packageName": "extract-zip", "proprietary": false, "creationTime": "2026-06-28T07:51:29.464799Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-26T18:15:06Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-28T07:51:29.629427Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:06:06.638835Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-services@1.0.0", "extract-zip@2.0.1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "extract-zip", "version": "2.0.1" }, { "id": "SNYK-JS-IMAGESIZE-17295814", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Proof of Concept", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "image-size", "references": [ { "url": "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439", "title": "GitHub PR" }, { "url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities", "title": "Vulnerability Report" }, { "url": "https://codeberg.org/image-size/image-size/src/branch/main/lib/types/jxl.ts%23L21", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-16T14:58:03.788412Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-11T01:23:00.766258Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-05T02:01:24.424560Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T02:01:24.424560Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T14:58:03.788412Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-11T01:23:00.766258Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop in the `extractPartialStreams()` and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2025-71319](https://security.snyk.io/vuln/SNYK-JS-IMAGESIZE-9634164).\n## Remediation\nThere is no fixed version for `image-size`.\n## References\n- [GitHub PR](https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439)\n- [Vulnerability Report](https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities)\n- [Vulnerable Code](https://codeberg.org/image-size/image-size/src/branch/main/lib/types/jxl.ts#L21)\n", "epssDetails": { "percentile": "0.34280", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2025-71329" ], "CWE": [ "CWE-835" ] }, "packageName": "image-size", "proprietary": false, "creationTime": "2026-06-11T10:39:40.827383Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-10T14:38:17Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-11T10:39:40.987645Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-05T02:01:24.424560Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-services@1.0.0", "image-size@2.0.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "image-size", "version": "2.0.2" }, { "id": "SNYK-JS-IMAGESIZE-17295816", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Proof of Concept", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "image-size", "references": [ { "url": "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439", "title": "GitHub PR" }, { "url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities", "title": "Vulnerability Report" }, { "url": "https://codeberg.org/image-size/image-size/src/branch/main/lib/types/icns.ts%23L94", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-16T14:56:48.045341Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-11T01:22:58.500245Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-11T02:01:08.848643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-11T02:01:08.848643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T14:56:48.045341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-11T01:22:58.500245Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop in `icns.js`. An ICNS file with an icon entry whose declared length is zero can hang the parser indefinitely.\n## Remediation\nThere is no fixed version for `image-size`.\n## References\n- [GitHub PR](https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439)\n- [Vulnerability Report](https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities)\n- [Vulnerable Code](https://codeberg.org/image-size/image-size/src/branch/main/lib/types/icns.ts#L94)\n", "epssDetails": { "percentile": "0.34280", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2025-71330" ], "CWE": [ "CWE-835" ] }, "packageName": "image-size", "proprietary": false, "creationTime": "2026-06-11T10:43:12.039483Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-10T14:38:09Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-11T10:43:12.497488Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-11T02:01:08.848643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-services@1.0.0", "image-size@2.0.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "image-size", "version": "2.0.2" }, { "id": "SNYK-JS-NANOID-18506894", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "sajdakabir" ], "semver": { "vulnerable": [ "<3.3.16", ">=4.0.0 <5.1.16" ] }, "exploit": "Not Defined", "fixedIn": [ "3.3.16", "5.1.16" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "nanoid", "references": [ { "url": "https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-19T01:29:26.647652Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-19T05:39:05.135161Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-22T15:45:25.400572Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-22T15:45:25.400572Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-19T01:29:26.647652Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-19T05:39:05.135161Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop through the `customAlphabet` and `nanoid` functions in `nanoid/non-secure`. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.\r\n\r\n**Notes**\r\n\r\n- The vulnerable code path is in the `nanoid/non-secure` entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.\r\n- The denial-of-service only shows up when callers pass a negative `size` into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.\n## Remediation\nUpgrade `nanoid` to version 3.3.16, 5.1.16 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49)\n", "epssDetails": { "percentile": "0.26018", "probability": "0.00330", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-67214" ], "CWE": [ "CWE-835" ] }, "packageName": "nanoid", "proprietary": false, "creationTime": "2026-08-02T08:46:50.155712Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-29T15:51:39Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-02T08:46:50.324306Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-22T15:45:25.400572Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-services@1.0.0", "nanoid-cjs@0.0.7", "nanoid@5.1.7" ], "upgradePath": [ false, "nanoid-cjs@0.0.7", "nanoid@5.1.16" ], "isUpgradable": true, "isPatchable": false, "name": "nanoid", "version": "5.1.7" }, { "id": "SNYK-JS-NANOID-18748186", "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L", "credit": [ "alanzabihi" ], "semver": { "vulnerable": [ "<3.3.12", ">=4.0.0 <5.1.11" ] }, "exploit": "Not Defined", "fixedIn": [ "3.3.12", "5.1.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.3, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "nanoid", "references": [ { "url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4", "title": "GitHub Commit" }, { "url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3", "title": "GitHub Commit" }, { "url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac", "title": "GitHub Commit" }, { "url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-08-13T05:36:59.819726Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:L", "assigner": "Snyk", "severity": "high", "baseScore": 8.3, "cvssVersion": "4.0", "modificationTime": "2026-08-13T08:50:54.590341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L", "assigner": "Snyk", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-08-13T08:50:54.590341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-08-13T05:36:59.819726Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound through the `fillPool` logic in `index.js` and `index.cjs`. An attacker can make subsequent ID generation deterministic by supplying an oversized `size` value to `nanoid(size)`, which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.\n## Remediation\nUpgrade `nanoid` to version 3.3.12, 5.1.11 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac)\n- [Maintainer's Advisory](https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w)\n", "epssDetails": { "percentile": "0.22045", "probability": "0.00296", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-73086" ], "CWE": [ "CWE-190" ], "GHSA": [ "GHSA-xwg4-73v4-xw9w" ] }, "packageName": "nanoid", "proprietary": false, "creationTime": "2026-08-13T08:50:54.123936Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-12T17:41:43.179000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-13T08:50:54.371994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-13T08:50:54.590341Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-services@1.0.0", "nanoid-cjs@0.0.7", "nanoid@5.1.7" ], "upgradePath": [ false, "nanoid-cjs@0.0.7", "nanoid@5.1.16" ], "isUpgradable": true, "isPatchable": false, "name": "nanoid", "version": "5.1.7" } ], "ok": false, "dependencyCount": 321, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "5 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "remediation": { "unresolved": [ { "id": "SNYK-JS-EXTRACTZIP-17660777", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "credit": [ "Ziad Salah" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.6, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "extract-zip", "references": [ { "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json", "title": "Advisory" }, { "url": "https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf", "title": "GitHub Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-30T07:17:19.904850Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.6, "cvssVersion": "4.0", "modificationTime": "2026-07-24T14:06:06.638835Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-07-24T14:06:06.638835Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:17:19.904850Z" } ], "description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nThere is no fixed version for `extract-zip`.\n## References\n- [Advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json)\n- [GitHub Advisory](https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf)\n", "epssDetails": { "percentile": "0.31654", "probability": "0.00391", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-56876" ], "CWE": [ "CWE-22" ], "GHSA": [ "GHSA-x7jf-2287-qcpf" ] }, "packageName": "extract-zip", "proprietary": false, "creationTime": "2026-06-28T07:51:29.464799Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-26T18:15:06Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-28T07:51:29.629427Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:06:06.638835Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "worklink-create-services@1.0.0", "extract-zip@2.0.1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "extract-zip", "version": "2.0.1", "severityWithCritical": "high" }, { "id": "SNYK-JS-IMAGESIZE-17295814", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Proof of Concept", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "image-size", "references": [ { "url": "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439", "title": "GitHub PR" }, { "url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities", "title": "Vulnerability Report" }, { "url": "https://codeberg.org/image-size/image-size/src/branch/main/lib/types/jxl.ts%23L21", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-16T14:58:03.788412Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-11T01:23:00.766258Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-05T02:01:24.424560Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T02:01:24.424560Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T14:58:03.788412Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-11T01:23:00.766258Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop in the `extractPartialStreams()` and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2025-71319](https://security.snyk.io/vuln/SNYK-JS-IMAGESIZE-9634164).\n## Remediation\nThere is no fixed version for `image-size`.\n## References\n- [GitHub PR](https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439)\n- [Vulnerability Report](https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities)\n- [Vulnerable Code](https://codeberg.org/image-size/image-size/src/branch/main/lib/types/jxl.ts#L21)\n", "epssDetails": { "percentile": "0.34280", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2025-71329" ], "CWE": [ "CWE-835" ] }, "packageName": "image-size", "proprietary": false, "creationTime": "2026-06-11T10:39:40.827383Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-10T14:38:17Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-11T10:39:40.987645Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-05T02:01:24.424560Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "worklink-create-services@1.0.0", "image-size@2.0.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "image-size", "version": "2.0.2", "severityWithCritical": "high" }, { "id": "SNYK-JS-IMAGESIZE-17295816", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Proof of Concept", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "image-size", "references": [ { "url": "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439", "title": "GitHub PR" }, { "url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities", "title": "Vulnerability Report" }, { "url": "https://codeberg.org/image-size/image-size/src/branch/main/lib/types/icns.ts%23L94", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-16T14:56:48.045341Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-11T01:22:58.500245Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-11T02:01:08.848643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-11T02:01:08.848643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T14:56:48.045341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-11T01:22:58.500245Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop in `icns.js`. An ICNS file with an icon entry whose declared length is zero can hang the parser indefinitely.\n## Remediation\nThere is no fixed version for `image-size`.\n## References\n- [GitHub PR](https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439)\n- [Vulnerability Report](https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities)\n- [Vulnerable Code](https://codeberg.org/image-size/image-size/src/branch/main/lib/types/icns.ts#L94)\n", "epssDetails": { "percentile": "0.34280", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2025-71330" ], "CWE": [ "CWE-835" ] }, "packageName": "image-size", "proprietary": false, "creationTime": "2026-06-11T10:43:12.039483Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-10T14:38:09Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-11T10:43:12.497488Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-11T02:01:08.848643Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "worklink-create-services@1.0.0", "image-size@2.0.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "image-size", "version": "2.0.2", "severityWithCritical": "high" }, { "id": "SNYK-JS-NANOID-18506894", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "sajdakabir" ], "semver": { "vulnerable": [ "<3.3.16", ">=4.0.0 <5.1.16" ] }, "exploit": "Not Defined", "fixedIn": [ "3.3.16", "5.1.16" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "nanoid", "references": [ { "url": "https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-19T01:29:26.647652Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-19T05:39:05.135161Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-22T15:45:25.400572Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-22T15:45:25.400572Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-19T01:29:26.647652Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-19T05:39:05.135161Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop through the `customAlphabet` and `nanoid` functions in `nanoid/non-secure`. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.\r\n\r\n**Notes**\r\n\r\n- The vulnerable code path is in the `nanoid/non-secure` entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.\r\n- The denial-of-service only shows up when callers pass a negative `size` into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.\n## Remediation\nUpgrade `nanoid` to version 3.3.16, 5.1.16 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49)\n", "epssDetails": { "percentile": "0.26018", "probability": "0.00330", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-67214" ], "CWE": [ "CWE-835" ] }, "packageName": "nanoid", "proprietary": false, "creationTime": "2026-08-02T08:46:50.155712Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-29T15:51:39Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-02T08:46:50.324306Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-22T15:45:25.400572Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "worklink-create-services@1.0.0", "nanoid-cjs@0.0.7", "nanoid@5.1.7" ], "upgradePath": [ false, "nanoid-cjs@0.0.7", "nanoid@5.1.16" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "nanoid", "version": "5.1.7", "severityWithCritical": "high" }, { "id": "SNYK-JS-NANOID-18748186", "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L", "credit": [ "alanzabihi" ], "semver": { "vulnerable": [ "<3.3.12", ">=4.0.0 <5.1.11" ] }, "exploit": "Not Defined", "fixedIn": [ "3.3.12", "5.1.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.3, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "nanoid", "references": [ { "url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4", "title": "GitHub Commit" }, { "url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3", "title": "GitHub Commit" }, { "url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac", "title": "GitHub Commit" }, { "url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-08-13T05:36:59.819726Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:L", "assigner": "Snyk", "severity": "high", "baseScore": 8.3, "cvssVersion": "4.0", "modificationTime": "2026-08-13T08:50:54.590341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L", "assigner": "Snyk", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-08-13T08:50:54.590341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-08-13T05:36:59.819726Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound through the `fillPool` logic in `index.js` and `index.cjs`. An attacker can make subsequent ID generation deterministic by supplying an oversized `size` value to `nanoid(size)`, which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.\n## Remediation\nUpgrade `nanoid` to version 3.3.12, 5.1.11 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac)\n- [Maintainer's Advisory](https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w)\n", "epssDetails": { "percentile": "0.22045", "probability": "0.00296", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-73086" ], "CWE": [ "CWE-190" ], "GHSA": [ "GHSA-xwg4-73v4-xw9w" ] }, "packageName": "nanoid", "proprietary": false, "creationTime": "2026-08-13T08:50:54.123936Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-12T17:41:43.179000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-13T08:50:54.371994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-13T08:50:54.590341Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "worklink-create-services@1.0.0", "nanoid-cjs@0.0.7", "nanoid@5.1.7" ], "upgradePath": [ false, "nanoid-cjs@0.0.7", "nanoid@5.1.16" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "nanoid", "version": "5.1.7", "severityWithCritical": "high" } ], "upgrade": {}, "patch": {}, "ignore": {}, "pin": {} }, "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 5, "targetFile": "/opt/scopear/app/services/package.json", "projectName": "worklink-create-services", "displayTargetFile": "/opt/scopear/app/services/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 0, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/opt/scopear/app/package.json", "projectName": "worklink-create-2", "displayTargetFile": "/opt/scopear/app/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 2, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/opt/scopear/app/common/package.json", "projectName": "package.json", "displayTargetFile": "/opt/scopear/app/common/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 154, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/opt/scopear/app/services/api/package.json", "projectName": "worklink-create-api", "displayTargetFile": "/opt/scopear/app/services/api/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 3, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/opt/scopear/.npm-global/lib/node_modules", "projectName": "lib", "displayTargetFile": "/opt/scopear/.npm-global/lib/node_modules", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 17, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/opt/scopear/.npm-global/lib/node_modules/typescript/node_modules/@typescript/typescript-linux-x64/lib/tsc", "projectName": "github.com/microsoft/typescript-go", "displayTargetFile": "/opt/scopear/.npm-global/lib/node_modules/typescript/node_modules/@typescript/typescript-linux-x64/lib/tsc", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115/microsoft/typescript-go" } ] }