Snyk - Open Source Security

Snyk test report

August 27th 2026, 2:50:57 am (UTC+00:00)

Scanned the following paths:
  • docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115/scopear/docker-wlc2-mc (deb)
  • docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115//opt/scopear/app/services/model-converter/package.json (npm)
  • docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115//opt/scopear/app/services/package.json (npm)
  • docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115//opt/scopear/app/package.json (npm)
  • docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115//opt/scopear/app/common/package.json (npm)
  • docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115//opt/scopear/app/services/api/package.json (npm)
  • docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115//opt/scopear/.npm-global/lib/node_modules (npm)
  • docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115/microsoft/typescript-go//opt/scopear/.npm-global/lib/node_modules/typescript/node_modules/@typescript/typescript-linux-x64/lib/tsc (gomodules)
6 known vulnerabilities
6 vulnerable dependency paths
1141 dependencies

CVE-2026-45447

high severity
Exploit: Not Defined
  • Package Manager: ubuntu:22.04
  • Vulnerable module: nodejs
  • Introduced through: docker-image|docker.io/scopear/docker-wlc2-mc@2.50.6_def3651.4115 and nodejs@22.23.2-1nodesource1

Detailed paths

  • Introduced through: docker-image|docker.io/scopear/docker-wlc2-mc@2.50.6_def3651.4115 › nodejs@22.23.2-1nodesource1

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs package and not the nodejs package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.

Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution.

When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition.

In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution.

Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

There is no fixed version for Ubuntu:22.04 nodejs.

References

More about this vulnerability

Infinite loop

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115 › /opt/scopear/app/services/package.json
  • Package Manager: npm
  • Vulnerable module: nanoid
  • Introduced through: worklink-create-services@1.0.0, nanoid-cjs@0.0.7 and others

Detailed paths

  • Introduced through: worklink-create-services@1.0.0 › nanoid-cjs@0.0.7 › nanoid@5.1.7

Overview

Affected versions of this package are vulnerable to Infinite loop through the customAlphabet and nanoid functions in nanoid/non-secure. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.

Notes

  • The vulnerable code path is in the nanoid/non-secure entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.
  • The denial-of-service only shows up when callers pass a negative size into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.

Remediation

Upgrade nanoid to version 3.3.16, 5.1.16 or higher.

References

More about this vulnerability

Integer Overflow or Wraparound

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115 › /opt/scopear/app/services/package.json
  • Package Manager: npm
  • Vulnerable module: nanoid
  • Introduced through: worklink-create-services@1.0.0, nanoid-cjs@0.0.7 and others

Detailed paths

  • Introduced through: worklink-create-services@1.0.0 › nanoid-cjs@0.0.7 › nanoid@5.1.7

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound through the fillPool logic in index.js and index.cjs. An attacker can make subsequent ID generation deterministic by supplying an oversized size value to nanoid(size), which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.

Remediation

Upgrade nanoid to version 3.3.12, 5.1.11 or higher.

References

More about this vulnerability

Infinite loop

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115 › /opt/scopear/app/services/package.json
  • Package Manager: npm
  • Vulnerable module: image-size
  • Introduced through: worklink-create-services@1.0.0 and image-size@2.0.2

Detailed paths

  • Introduced through: worklink-create-services@1.0.0 › image-size@2.0.2

Overview

Affected versions of this package are vulnerable to Infinite loop in the extractPartialStreams() and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely.

Note: This is a bypass of the fix for the vulnerability described in CVE-2025-71319.

Remediation

There is no fixed version for image-size.

References

More about this vulnerability

Infinite loop

high severity
Exploit: Proof of Concept
  • Manifest file: docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115 › /opt/scopear/app/services/package.json
  • Package Manager: npm
  • Vulnerable module: image-size
  • Introduced through: worklink-create-services@1.0.0 and image-size@2.0.2

Detailed paths

  • Introduced through: worklink-create-services@1.0.0 › image-size@2.0.2

Overview

Affected versions of this package are vulnerable to Infinite loop in icns.js. An ICNS file with an icon entry whose declared length is zero can hang the parser indefinitely.

Remediation

There is no fixed version for image-size.

References

More about this vulnerability

Directory Traversal

high severity
Exploit: Not Defined
  • Manifest file: docker.io/scopear/docker-wlc2-mc:2.50.6_def3651.4115 › /opt/scopear/app/services/package.json
  • Package Manager: npm
  • Vulnerable module: extract-zip
  • Introduced through: worklink-create-services@1.0.0 and extract-zip@2.0.1

Detailed paths

  • Introduced through: worklink-create-services@1.0.0 › extract-zip@2.0.1

Overview

extract-zip is an unzip a zip file into a directory using 100% javascript

Affected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
        2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

There is no fixed version for extract-zip.

References

More about this vulnerability