{ "vulnerabilities": [ { "id": "SNYK-UBUNTU2204-NODEJS-17268893", "cpes": [], "title": "CVE-2026-45447", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447" }, { "url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt", "title": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25237", "title": "https://access.redhat.com/errata/RHSA-2026:25237" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25239", "title": "https://access.redhat.com/errata/RHSA-2026:25239" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26275", "title": "https://access.redhat.com/errata/RHSA-2026:26275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34102", "title": "https://access.redhat.com/errata/RHSA-2026:34102" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35869", "title": "https://access.redhat.com/errata/RHSA-2026:35869" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36215", "title": "https://access.redhat.com/errata/RHSA-2026:36215" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36217", "title": "https://access.redhat.com/errata/RHSA-2026:36217" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39009", "title": "https://access.redhat.com/errata/RHSA-2026:39009" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39012", "title": "https://access.redhat.com/errata/RHSA-2026:39012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45447", "title": "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44438", "title": "https://access.redhat.com/errata/RHSA-2026:44438" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735", "title": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737", "title": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58563", "title": "https://access.redhat.com/errata/RHSA-2026:58563" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66524", "title": "https://access.redhat.com/errata/RHSA-2026:66524" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nodejs` package and not the `nodejs` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nThere is no fixed version for `Ubuntu:22.04` `nodejs`.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n", "epssDetails": { "percentile": "0.88452", "probability": "0.03566", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45447" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "nodejs", "creationTime": "2026-06-10T02:46:34.655313Z", "disclosureTime": "2026-06-09T17:17:19.277000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:22.04", "publicationTime": "2026-06-10T02:46:34.660471Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-12T01:29:09.004017Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-wlc2-mc@2.50.21_47ddc85.4286", "nodejs@22.23.2-1nodesource1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "nodejs", "version": "22.23.2-1nodesource1" } ], "ok": false, "dependencyCount": 567, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "deb", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "binariesVulns": { "issuesData": {}, "affectedPkgs": {} }, "os": { "prettyName": "Ubuntu 22.04.5 LTS" } }, "summary": "1 high or critical severity vulnerable dependency path", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 1, "projectName": "docker-image|docker.io/scopear/docker-wlc2-mc", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.21_47ddc85.4286/scopear/docker-wlc2-mc", "applications": [ { "vulnerabilities": [ { "id": "SNYK-JS-SHARP-19653587", "title": "Heap-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<0.35.4" ] }, "exploit": "Not Defined", "fixedIn": [ "0.35.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.9, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sharp", "references": [ { "url": "https://github.com/lovell/sharp/releases/tag/v0.35.4", "title": "GitHub Release" }, { "url": "https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c", "title": "Maintainer's Advisory" } ], "cvssDetails": [], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "assigner": "Snyk", "severity": "high", "baseScore": 8.9, "cvssVersion": "4.0", "modificationTime": "2026-09-14T10:08:39.720123Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-14T10:08:39.720123Z" } ], "description": "## Overview\n[sharp](https://www.npmjs.org/package/sharp) is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images\n\nAffected versions of this package are vulnerable to Heap-based Buffer Overflow in the `VipsForeignLoadHeif` process. An attacker can execute arbitrary code by providing specially crafted AVIF images as input. \r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by blocking the decoding of AVIF images using the configuration sharp.block({ operation: [\"VipsForeignLoadHeif\"] }); and by ensuring the Node.js executable is compiled as a Position Independent Executable (PIE).\n## Remediation\nUpgrade `sharp` to version 0.35.4 or higher.\n## References\n- [GitHub Release](https://github.com/lovell/sharp/releases/tag/v0.35.4)\n- [Maintainer's Advisory](https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c)\n", "epssDetails": null, "identifiers": { "CVE": [], "CWE": [ "CWE-122" ], "GHSA": [ "GHSA-rgj7-g3m4-5g8c" ] }, "packageName": "sharp", "proprietary": false, "creationTime": "2026-09-09T13:56:44.366968Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-08T21:25:11Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-09T13:56:44.573106Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-14T10:08:39.720123Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-model-converter@1.0.0", "sharp@0.35.3" ], "upgradePath": [ false, "sharp@0.35.4" ], "isUpgradable": true, "isPatchable": false, "name": "sharp", "version": "0.35.3" } ], "ok": false, "dependencyCount": 77, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "1 high or critical severity vulnerable dependency path", "severityThreshold": "high", "remediation": { "unresolved": [], "upgrade": { "sharp@0.35.3": { "upgradeTo": "sharp@0.35.4", "upgrades": [ "sharp@0.35.3" ], "vulns": [ "SNYK-JS-SHARP-19653587" ] } }, "patch": {}, "ignore": {}, "pin": {} }, "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 1, "targetFile": "/opt/scopear/app/services/model-converter/package.json", "projectName": "worklink-create-model-converter", "displayTargetFile": "/opt/scopear/app/services/model-converter/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.21_47ddc85.4286" }, { "vulnerabilities": [ { "id": "SNYK-JS-EXTRACTZIP-17660777", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "credit": [ "Ziad Salah" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.6, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "extract-zip", "references": [ { "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json", "title": "Advisory" }, { "url": "https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf", "title": "GitHub Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-30T07:17:19.904850Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.6, "cvssVersion": "4.0", "modificationTime": "2026-07-24T14:06:06.638835Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-07-24T14:06:06.638835Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:17:19.904850Z" } ], "description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nThere is no fixed version for `extract-zip`.\n## References\n- [Advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json)\n- [GitHub Advisory](https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf)\n", "epssDetails": { "percentile": "0.31654", "probability": "0.00391", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-56876" ], "CWE": [ "CWE-22" ], "GHSA": [ "GHSA-x7jf-2287-qcpf" ] }, "packageName": "extract-zip", "proprietary": false, "creationTime": "2026-06-28T07:51:29.464799Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-26T18:15:06Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-28T07:51:29.629427Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:06:06.638835Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-services@1.0.0", "extract-zip@2.0.1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "extract-zip", "version": "2.0.1" }, { "id": "SNYK-JS-EXTRACTZIP-19653641", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "extract-zip", "references": [ { "url": "https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650", "title": "GitHub Commit" }, { "url": "https://github.com/max-mapper/extract-zip/pull/160", "title": "GitHub PR" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-08-28T05:32:37.302301Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.2, "cvssVersion": "4.0", "modificationTime": "2026-09-14T10:08:30.140412Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-14T10:08:30.140412Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-08-28T05:32:37.302301Z" } ], "description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in `index.js`. An attacker can write a file outside the destination directory by supplying an archive with two entries that reuse the same path: a symlink pointing outside the extraction root, followed by a regular file for that same name. During extraction, the code only checked the parent directory of each entry and then wrote the file through the existing final path component, so the second entry followed the planted symlink and overwrote the symlink target. This can corrupt or replace files writable by the process running `extract-zip`.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nA fix was pushed into the `master` branch but not yet published.\n## References\n- [GitHub Commit](https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650)\n- [GitHub PR](https://github.com/max-mapper/extract-zip/pull/160)\n", "epssDetails": { "percentile": "0.20481", "probability": "0.00280", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-19693" ], "CWE": [ "CWE-22" ], "GHSA": [ "GHSA-7pqw-9j4j-h8q3" ] }, "packageName": "extract-zip", "proprietary": false, "creationTime": "2026-09-09T14:54:22.763062Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-17T15:30:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-09T14:54:23.005562Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-14T10:08:30.140412Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-services@1.0.0", "extract-zip@2.0.1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "extract-zip", "version": "2.0.1" }, { "id": "SNYK-JS-IMAGESIZE-17295814", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<2.0.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "2.0.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "image-size", "references": [ { "url": "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439", "title": "GitHub PR" }, { "url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities", "title": "Vulnerability Report" }, { "url": "https://codeberg.org/image-size/image-size/src/branch/main/lib/types/jxl.ts%23L21", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-16T14:58:03.788412Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-11T01:23:00.766258Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-17T02:01:02.754145Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-17T02:01:02.754145Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T14:58:03.788412Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-11T01:23:00.766258Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop in the `extractPartialStreams()` and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2025-71319](https://security.snyk.io/vuln/SNYK-JS-IMAGESIZE-9634164).\n## Remediation\nUpgrade `image-size` to version 2.0.3 or higher.\n## References\n- [GitHub PR](https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439)\n- [Vulnerability Report](https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities)\n- [Vulnerable Code](https://codeberg.org/image-size/image-size/src/branch/main/lib/types/jxl.ts#L21)\n", "epssDetails": { "percentile": "0.34280", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2025-71329" ], "CWE": [ "CWE-835" ] }, "packageName": "image-size", "proprietary": false, "creationTime": "2026-06-11T10:39:40.827383Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-10T14:38:17Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-11T10:39:40.987645Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-17T02:01:02.754145Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-services@1.0.0", "image-size@2.0.2" ], "upgradePath": [ false, "image-size@2.0.3" ], "isUpgradable": true, "isPatchable": false, "name": "image-size", "version": "2.0.2" }, { "id": "SNYK-JS-IMAGESIZE-17295816", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<2.0.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "2.0.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "image-size", "references": [ { "url": "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439", "title": "GitHub PR" }, { "url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities", "title": "Vulnerability Report" }, { "url": "https://codeberg.org/image-size/image-size/src/branch/main/lib/types/icns.ts%23L94", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-16T14:56:48.045341Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-11T01:22:58.500245Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-17T02:01:02.754603Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-17T02:01:02.754603Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T14:56:48.045341Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-11T01:22:58.500245Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop in `icns.js`. An ICNS file with an icon entry whose declared length is zero can hang the parser indefinitely.\n## Remediation\nUpgrade `image-size` to version 2.0.3 or higher.\n## References\n- [GitHub PR](https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439)\n- [Vulnerability Report](https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities)\n- [Vulnerable Code](https://codeberg.org/image-size/image-size/src/branch/main/lib/types/icns.ts#L94)\n", "epssDetails": { "percentile": "0.34280", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2025-71330" ], "CWE": [ "CWE-835" ] }, "packageName": "image-size", "proprietary": false, "creationTime": "2026-06-11T10:43:12.039483Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-10T14:38:09Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-11T10:43:12.497488Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-17T02:01:02.754603Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-services@1.0.0", "image-size@2.0.2" ], "upgradePath": [ false, "image-size@2.0.3" ], "isUpgradable": true, "isPatchable": false, "name": "image-size", "version": "2.0.2" }, { "id": "SNYK-JS-NANOID-18506894", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "sajdakabir" ], "semver": { "vulnerable": [ "<3.3.16", ">=4.0.0 <5.1.16" ] }, "exploit": "Not Defined", "fixedIn": [ "3.3.16", "5.1.16" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "nanoid", "references": [ { "url": "https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-19T01:29:26.647652Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-19T05:39:05.135161Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-22T15:45:25.400572Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-22T15:45:25.400572Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-19T01:29:26.647652Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-19T05:39:05.135161Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop through the `customAlphabet` and `nanoid` functions in `nanoid/non-secure`. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.\r\n\r\n**Notes**\r\n\r\n- The vulnerable code path is in the `nanoid/non-secure` entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.\r\n- The denial-of-service only shows up when callers pass a negative `size` into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.\n## Remediation\nUpgrade `nanoid` to version 3.3.16, 5.1.16 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49)\n", "epssDetails": { "percentile": "0.26018", "probability": "0.00330", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-67214" ], "CWE": [ "CWE-835" ] }, "packageName": "nanoid", "proprietary": false, "creationTime": "2026-08-02T08:46:50.155712Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-29T15:51:39Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-02T08:46:50.324306Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-22T15:45:25.400572Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-services@1.0.0", "nanoid-cjs@0.0.7", "nanoid@5.1.7" ], "upgradePath": [ false, "nanoid-cjs@0.0.7", "nanoid@5.1.16" ], "isUpgradable": true, "isPatchable": false, "name": "nanoid", "version": "5.1.7" }, { "id": "SNYK-JS-NANOID-18748186", "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L", "credit": [ "alanzabihi" ], "semver": { "vulnerable": [ "<3.3.12", ">=4.0.0 <5.1.11" ] }, "exploit": "Not Defined", "fixedIn": [ "3.3.12", "5.1.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.3, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "nanoid", "references": [ { "url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4", "title": "GitHub Commit" }, { "url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3", "title": "GitHub Commit" }, { "url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac", "title": "GitHub Commit" }, { "url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-08-13T05:36:59.819726Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:L", "assigner": "Snyk", "severity": "high", "baseScore": 8.3, "cvssVersion": "4.0", "modificationTime": "2026-09-14T12:25:49.727372Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L", "assigner": "Snyk", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-14T12:25:49.727372Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-08-13T05:36:59.819726Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound through the `fillPool` logic in `index.js` and `index.cjs`. An attacker can make subsequent ID generation deterministic by supplying an oversized `size` value to `nanoid(size)`, which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.\n## Remediation\nUpgrade `nanoid` to version 3.3.12, 5.1.11 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac)\n- [Maintainer's Advisory](https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w)\n", "epssDetails": { "percentile": "0.22045", "probability": "0.00296", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-73086" ], "CWE": [ "CWE-190" ], "GHSA": [ "GHSA-xwg4-73v4-xw9w" ] }, "packageName": "nanoid", "proprietary": false, "creationTime": "2026-08-13T08:50:54.123936Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-12T17:41:43Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-13T08:50:54.371994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-14T12:25:49.727372Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-services@1.0.0", "nanoid-cjs@0.0.7", "nanoid@5.1.7" ], "upgradePath": [ false, "nanoid-cjs@0.0.7", "nanoid@5.1.16" ], "isUpgradable": true, "isPatchable": false, "name": "nanoid", "version": "5.1.7" }, { "id": "SNYK-JS-PROXYADDR-19812342", "title": "User Impersonation", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "kagebunsher" ], "semver": { "vulnerable": [ ">=1.1.0 <2.0.8" ] }, "exploit": "Not Defined", "fixedIn": [ "2.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "critical", "cvssScore": 9.3, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "proxy-addr", "references": [ { "url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h", "title": "GitHub Advisory" }, { "url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965", "title": "GitHub Commit" } ], "cvssDetails": [], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "critical", "baseScore": 9.3, "cvssVersion": "4.0", "modificationTime": "2026-09-15T14:03:28.067198Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Snyk", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-09-15T14:03:28.067198Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n", "epssDetails": { "percentile": "0.08526", "probability": "0.00187", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-90711" ], "CWE": [ "CWE-290" ], "GHSA": [ "GHSA-jqcg-44mw-7w3h" ] }, "packageName": "proxy-addr", "proprietary": false, "creationTime": "2026-09-15T08:22:56.328403Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-15T07:14:51Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-15T08:22:56.519310Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-15T14:03:28.067198Z", "socialTrendAlert": false, "severityWithCritical": "critical", "from": [ "worklink-create-services@1.0.0", "express@5.2.1", "proxy-addr@2.0.7" ], "upgradePath": [ false, "express@5.2.1", "proxy-addr@2.0.8" ], "isUpgradable": true, "isPatchable": false, "name": "proxy-addr", "version": "2.0.7" }, { "id": "SNYK-JS-SHARP-19653587", "title": "Heap-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<0.35.4" ] }, "exploit": "Not Defined", "fixedIn": [ "0.35.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.9, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sharp", "references": [ { "url": "https://github.com/lovell/sharp/releases/tag/v0.35.4", "title": "GitHub Release" }, { "url": "https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c", "title": "Maintainer's Advisory" } ], "cvssDetails": [], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "assigner": "Snyk", "severity": "high", "baseScore": 8.9, "cvssVersion": "4.0", "modificationTime": "2026-09-14T10:08:39.720123Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-14T10:08:39.720123Z" } ], "description": "## Overview\n[sharp](https://www.npmjs.org/package/sharp) is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images\n\nAffected versions of this package are vulnerable to Heap-based Buffer Overflow in the `VipsForeignLoadHeif` process. An attacker can execute arbitrary code by providing specially crafted AVIF images as input. \r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by blocking the decoding of AVIF images using the configuration sharp.block({ operation: [\"VipsForeignLoadHeif\"] }); and by ensuring the Node.js executable is compiled as a Position Independent Executable (PIE).\n## Remediation\nUpgrade `sharp` to version 0.35.4 or higher.\n## References\n- [GitHub Release](https://github.com/lovell/sharp/releases/tag/v0.35.4)\n- [Maintainer's Advisory](https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c)\n", "epssDetails": null, "identifiers": { "CVE": [], "CWE": [ "CWE-122" ], "GHSA": [ "GHSA-rgj7-g3m4-5g8c" ] }, "packageName": "sharp", "proprietary": false, "creationTime": "2026-09-09T13:56:44.366968Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-08T21:25:11Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-09T13:56:44.573106Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-14T10:08:39.720123Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-services@1.0.0", "@gltf-transform/functions@4.4.2", "ndarray-pixels@5.0.1", "sharp@0.35.3" ], "upgradePath": [ false, "@gltf-transform/functions@4.4.2", "ndarray-pixels@5.2.0", "sharp@0.35.4" ], "isUpgradable": true, "isPatchable": false, "name": "sharp", "version": "0.35.3" } ], "ok": false, "dependencyCount": 321, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "8 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "remediation": { "unresolved": [ { "id": "SNYK-JS-EXTRACTZIP-17660777", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "credit": [ "Ziad Salah" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.6, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "extract-zip", "references": [ { "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json", "title": "Advisory" }, { "url": "https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf", "title": "GitHub Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-30T07:17:19.904850Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.6, "cvssVersion": "4.0", "modificationTime": "2026-07-24T14:06:06.638835Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-07-24T14:06:06.638835Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:17:19.904850Z" } ], "description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nThere is no fixed version for `extract-zip`.\n## References\n- [Advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json)\n- [GitHub Advisory](https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf)\n", "epssDetails": { "percentile": "0.31654", "probability": "0.00391", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-56876" ], "CWE": [ "CWE-22" ], "GHSA": [ "GHSA-x7jf-2287-qcpf" ] }, "packageName": "extract-zip", "proprietary": false, "creationTime": "2026-06-28T07:51:29.464799Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-26T18:15:06Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-28T07:51:29.629427Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-24T14:06:06.638835Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "worklink-create-services@1.0.0", "extract-zip@2.0.1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "extract-zip", "version": "2.0.1", "severityWithCritical": "high" }, { "id": "SNYK-JS-EXTRACTZIP-19653641", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "extract-zip", "references": [ { "url": "https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650", "title": "GitHub Commit" }, { "url": "https://github.com/max-mapper/extract-zip/pull/160", "title": "GitHub PR" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-08-28T05:32:37.302301Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.2, "cvssVersion": "4.0", "modificationTime": "2026-09-14T10:08:30.140412Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-14T10:08:30.140412Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-08-28T05:32:37.302301Z" } ], "description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in `index.js`. An attacker can write a file outside the destination directory by supplying an archive with two entries that reuse the same path: a symlink pointing outside the extraction root, followed by a regular file for that same name. During extraction, the code only checked the parent directory of each entry and then wrote the file through the existing final path component, so the second entry followed the planted symlink and overwrote the symlink target. This can corrupt or replace files writable by the process running `extract-zip`.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nA fix was pushed into the `master` branch but not yet published.\n## References\n- [GitHub Commit](https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650)\n- [GitHub PR](https://github.com/max-mapper/extract-zip/pull/160)\n", "epssDetails": { "percentile": "0.20481", "probability": "0.00280", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-19693" ], "CWE": [ "CWE-22" ], "GHSA": [ "GHSA-7pqw-9j4j-h8q3" ] }, "packageName": "extract-zip", "proprietary": false, "creationTime": "2026-09-09T14:54:22.763062Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-17T15:30:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-09T14:54:23.005562Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-14T10:08:30.140412Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "worklink-create-services@1.0.0", "extract-zip@2.0.1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "extract-zip", "version": "2.0.1", "severityWithCritical": "high" }, { "id": "SNYK-JS-NANOID-18506894", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "sajdakabir" ], "semver": { "vulnerable": [ "<3.3.16", ">=4.0.0 <5.1.16" ] }, "exploit": "Not Defined", "fixedIn": [ "3.3.16", "5.1.16" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "nanoid", "references": [ { "url": "https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-19T01:29:26.647652Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-19T05:39:05.135161Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-22T15:45:25.400572Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-22T15:45:25.400572Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-19T01:29:26.647652Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-19T05:39:05.135161Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop through the `customAlphabet` and `nanoid` functions in `nanoid/non-secure`. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.\r\n\r\n**Notes**\r\n\r\n- The vulnerable code path is in the `nanoid/non-secure` entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.\r\n- The denial-of-service only shows up when callers pass a negative `size` into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.\n## Remediation\nUpgrade `nanoid` to version 3.3.16, 5.1.16 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49)\n", "epssDetails": { "percentile": "0.26018", "probability": "0.00330", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-67214" ], "CWE": [ "CWE-835" ] }, "packageName": "nanoid", "proprietary": false, "creationTime": "2026-08-02T08:46:50.155712Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-29T15:51:39Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-02T08:46:50.324306Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-22T15:45:25.400572Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "worklink-create-services@1.0.0", "nanoid-cjs@0.0.7", "nanoid@5.1.7" ], "upgradePath": [ false, "nanoid-cjs@0.0.7", "nanoid@5.1.16" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "nanoid", "version": "5.1.7", "severityWithCritical": "high" }, { "id": "SNYK-JS-NANOID-18748186", "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L", "credit": [ "alanzabihi" ], "semver": { "vulnerable": [ "<3.3.12", ">=4.0.0 <5.1.11" ] }, "exploit": "Not Defined", "fixedIn": [ "3.3.12", "5.1.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.3, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "nanoid", "references": [ { "url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4", "title": "GitHub Commit" }, { "url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3", "title": "GitHub Commit" }, { "url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac", "title": "GitHub Commit" }, { "url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-08-13T05:36:59.819726Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:L", "assigner": "Snyk", "severity": "high", "baseScore": 8.3, "cvssVersion": "4.0", "modificationTime": "2026-09-14T12:25:49.727372Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L", "assigner": "Snyk", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-14T12:25:49.727372Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-08-13T05:36:59.819726Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound through the `fillPool` logic in `index.js` and `index.cjs`. An attacker can make subsequent ID generation deterministic by supplying an oversized `size` value to `nanoid(size)`, which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.\n## Remediation\nUpgrade `nanoid` to version 3.3.12, 5.1.11 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac)\n- [Maintainer's Advisory](https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w)\n", "epssDetails": { "percentile": "0.22045", "probability": "0.00296", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-73086" ], "CWE": [ "CWE-190" ], "GHSA": [ "GHSA-xwg4-73v4-xw9w" ] }, "packageName": "nanoid", "proprietary": false, "creationTime": "2026-08-13T08:50:54.123936Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-12T17:41:43Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-13T08:50:54.371994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-14T12:25:49.727372Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "worklink-create-services@1.0.0", "nanoid-cjs@0.0.7", "nanoid@5.1.7" ], "upgradePath": [ false, "nanoid-cjs@0.0.7", "nanoid@5.1.16" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "nanoid", "version": "5.1.7", "severityWithCritical": "high" }, { "id": "SNYK-JS-PROXYADDR-19812342", "title": "User Impersonation", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "kagebunsher" ], "semver": { "vulnerable": [ ">=1.1.0 <2.0.8" ] }, "exploit": "Not Defined", "fixedIn": [ "2.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "critical", "cvssScore": 9.3, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "proxy-addr", "references": [ { "url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h", "title": "GitHub Advisory" }, { "url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965", "title": "GitHub Commit" } ], "cvssDetails": [], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "critical", "baseScore": 9.3, "cvssVersion": "4.0", "modificationTime": "2026-09-15T14:03:28.067198Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Snyk", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-09-15T14:03:28.067198Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n", "epssDetails": { "percentile": "0.08526", "probability": "0.00187", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-90711" ], "CWE": [ "CWE-290" ], "GHSA": [ "GHSA-jqcg-44mw-7w3h" ] }, "packageName": "proxy-addr", "proprietary": false, "creationTime": "2026-09-15T08:22:56.328403Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-15T07:14:51Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-15T08:22:56.519310Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-15T14:03:28.067198Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "worklink-create-services@1.0.0", "express@5.2.1", "proxy-addr@2.0.7" ], "upgradePath": [ false, "express@5.2.1", "proxy-addr@2.0.8" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "proxy-addr", "version": "2.0.7", "severityWithCritical": "critical" }, { "id": "SNYK-JS-SHARP-19653587", "title": "Heap-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<0.35.4" ] }, "exploit": "Not Defined", "fixedIn": [ "0.35.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.9, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sharp", "references": [ { "url": "https://github.com/lovell/sharp/releases/tag/v0.35.4", "title": "GitHub Release" }, { "url": "https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c", "title": "Maintainer's Advisory" } ], "cvssDetails": [], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "assigner": "Snyk", "severity": "high", "baseScore": 8.9, "cvssVersion": "4.0", "modificationTime": "2026-09-14T10:08:39.720123Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-14T10:08:39.720123Z" } ], "description": "## Overview\n[sharp](https://www.npmjs.org/package/sharp) is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images\n\nAffected versions of this package are vulnerable to Heap-based Buffer Overflow in the `VipsForeignLoadHeif` process. An attacker can execute arbitrary code by providing specially crafted AVIF images as input. \r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by blocking the decoding of AVIF images using the configuration sharp.block({ operation: [\"VipsForeignLoadHeif\"] }); and by ensuring the Node.js executable is compiled as a Position Independent Executable (PIE).\n## Remediation\nUpgrade `sharp` to version 0.35.4 or higher.\n## References\n- [GitHub Release](https://github.com/lovell/sharp/releases/tag/v0.35.4)\n- [Maintainer's Advisory](https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c)\n", "epssDetails": null, "identifiers": { "CVE": [], "CWE": [ "CWE-122" ], "GHSA": [ "GHSA-rgj7-g3m4-5g8c" ] }, "packageName": "sharp", "proprietary": false, "creationTime": "2026-09-09T13:56:44.366968Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-08T21:25:11Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-09T13:56:44.573106Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-14T10:08:39.720123Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "worklink-create-services@1.0.0", "@gltf-transform/functions@4.4.2", "ndarray-pixels@5.0.1", "sharp@0.35.3" ], "upgradePath": [ false, "@gltf-transform/functions@4.4.2", "ndarray-pixels@5.2.0", "sharp@0.35.4" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "sharp", "version": "0.35.3", "severityWithCritical": "high" } ], "upgrade": { "image-size@2.0.2": { "upgradeTo": "image-size@2.0.3", "upgrades": [ "image-size@2.0.2", "image-size@2.0.2" ], "vulns": [ "SNYK-JS-IMAGESIZE-17295814", "SNYK-JS-IMAGESIZE-17295816" ] } }, "patch": {}, "ignore": {}, "pin": {} }, "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 8, "targetFile": "/opt/scopear/app/services/package.json", "projectName": "worklink-create-services", "displayTargetFile": "/opt/scopear/app/services/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.21_47ddc85.4286" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 0, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/opt/scopear/app/package.json", "projectName": "worklink-create-2", "displayTargetFile": "/opt/scopear/app/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.21_47ddc85.4286" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 2, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/opt/scopear/app/common/package.json", "projectName": "package.json", "displayTargetFile": "/opt/scopear/app/common/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.21_47ddc85.4286" }, { "vulnerabilities": [ { "id": "SNYK-JS-ADMZIP-19276676", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "credit": [ "Muhammad Sobirov" ], "semver": { "vulnerable": [ ">=0.5.9 <0.6.1" ] }, "exploit": "Not Defined", "fixedIn": [ "0.6.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "adm-zip", "references": [ { "url": "https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js", "title": "github.com" }, { "url": "https://github.com/openbrf/openbrf/commit/db32272c2eb5324eb3df46c39a53381efea209f4", "title": "GitHub Commit" }, { "url": "https://github.com/cthackers/adm-zip/issues/574", "title": "GitHub Issue" }, { "url": "https://github.com/cthackers/adm-zip/blob/2b4d84087d45344643e0183756e19191d52815cc/util/utils.js%23L65-L88", "title": "Vulnerable Code utils.js:65-88" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-08-25T01:29:56.558038Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-08-28T14:00:01.645132Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-14T14:00:50.653463Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-09-14T14:00:50.653463Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-25T01:29:56.558038Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-28T14:00:01.645132Z" } ], "description": "## Overview\n[adm-zip](https://www.npmjs.com/package/adm-zip) is a JavaScript implementation for zip data compression for NodeJS.\n\nAffected versions of this package are vulnerable to Symlink Attack through the `extractAllTo`, `extractAllToAsync`, and `extractEntryTo` code paths in `util/utils.js`. An attacker can write attacker-controlled contents outside the extraction root by placing a symbolic link inside the destination directory and then supplying an archive entry that is extracted with overwrite enabled. This can replace any file the extracting process is allowed to write, breaking the integrity of files in shared, reused, or predictable extraction locations such as temporary directories or CI workspaces.\n## Remediation\nUpgrade `adm-zip` to version 0.6.1 or higher.\n## References\n- [github.com](https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js)\n- [GitHub Commit](https://github.com/openbrf/openbrf/commit/db32272c2eb5324eb3df46c39a53381efea209f4)\n- [GitHub Issue](https://github.com/cthackers/adm-zip/issues/574)\n- [Vulnerable Code utils.js:65-88](https://github.com/cthackers/adm-zip/blob/2b4d84087d45344643e0183756e19191d52815cc/util/utils.js#L65-L88)\n", "epssDetails": { "percentile": "0.02945", "probability": "0.00131", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-76845" ], "CWE": [ "CWE-59" ] }, "packageName": "adm-zip", "proprietary": false, "creationTime": "2026-08-27T08:59:37.276884Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-24T18:48:31Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-27T08:59:37.456389Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-14T14:00:50.653463Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-api@1.0.0", "adm-zip@0.6.0" ], "upgradePath": [ false, "adm-zip@0.6.1" ], "isUpgradable": true, "isPatchable": false, "name": "adm-zip", "version": "0.6.0" }, { "id": "SNYK-JS-ADMZIP-19846655", "title": "Improper Handling of Highly Compressed Data (Data Amplification)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Dilipkumar Choudhary" ], "semver": { "vulnerable": [ "<0.6.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "0.6.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "adm-zip", "references": [ { "url": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v", "title": "GitHub Advisory" }, { "url": "https://github.com/cthackers/adm-zip", "title": "github.com" }, { "url": "https://github.com/cthackers/adm-zip/blob/v0.6.0/methods/inflater.js", "title": "github.com" }, { "url": "https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6", "title": "GitHub Commit" }, { "url": "https://github.com/cthackers/adm-zip/commit/8bc411184de1b5ca28138c53074fb61119994dde", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-20T14:04:16.412603Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-16T01:31:39.529839Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-21T02:01:07.207541Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-21T02:01:07.207541Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-20T14:04:16.412603Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T01:31:39.529839Z" } ], "description": "## Overview\n[adm-zip](https://www.npmjs.com/package/adm-zip) is a JavaScript implementation for zip data compression for NodeJS.\n\nAffected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the `inflater` process. An attacker can exhaust system memory and disrupt service availability by submitting specially crafted ZIP archives with highly compressible entries that declare a zero uncompressed size.\n## Remediation\nUpgrade `adm-zip` to version 0.6.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v)\n- [github.com](https://github.com/cthackers/adm-zip)\n- [github.com](https://github.com/cthackers/adm-zip/blob/v0.6.0/methods/inflater.js)\n- [GitHub Commit](https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6)\n- [GitHub Commit](https://github.com/cthackers/adm-zip/commit/8bc411184de1b5ca28138c53074fb61119994dde)\n", "epssDetails": { "percentile": "0.32539", "probability": "0.00388", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-92000" ], "CWE": [ "CWE-409" ], "GHSA": [ "GHSA-rcw4-f5rp-g42v" ] }, "packageName": "adm-zip", "proprietary": false, "creationTime": "2026-09-16T07:02:48.841887Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-15T23:24:46.617000Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-16T07:02:49.097732Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-21T02:01:07.207541Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-api@1.0.0", "adm-zip@0.6.0" ], "upgradePath": [ false, "adm-zip@0.6.1" ], "isUpgradable": true, "isPatchable": false, "name": "adm-zip", "version": "0.6.0" }, { "id": "SNYK-JS-ADMZIP-19963965", "title": "Memory Allocation with Excessive Size Value", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "José Antonio Zamudio Amaya" ], "semver": { "vulnerable": [ "<0.6.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "0.6.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "adm-zip", "references": [ { "url": "https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6", "title": "GitHub Commit" }, { "url": "https://github.com/cthackers/adm-zip/releases/tag/v0.6.1", "title": "GitHub Release" }, { "url": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc", "title": "Maintainer's Advisory" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-09-23T13:34:16.868715Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-23T13:34:17.159174Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T13:34:17.159174Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T13:34:16.868715Z" } ], "description": "## Overview\n[adm-zip](https://www.npmjs.com/package/adm-zip) is a JavaScript implementation for zip data compression for NodeJS.\n\nAffected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the async decompression path in `methods/inflater.js`, where the decompression size cap enforced by zlib's `maxOutputLength` option is not applied to the streaming API. An attacker can supply a zip archive whose entries declare a small or zero uncompressed size but contain a large compressed payload (a decompression bomb), causing unbounded memory growth and a crash of the host process. Additionally, a declared size of 0 previously disabled the cap entirely on the synchronous path, allowing the same class of attack through entries that lie about their size.\n## Remediation\nUpgrade `adm-zip` to version 0.6.1 or higher.\n## References\n- [GitHub Commit](https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6)\n- [GitHub Release](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1)\n- [Maintainer's Advisory](https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc)\n", "epssDetails": { "percentile": "0.35119", "probability": "0.00411", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-77301" ], "CWE": [ "CWE-789" ], "GHSA": [ "GHSA-7q85-xj36-vmfc" ] }, "packageName": "adm-zip", "proprietary": false, "creationTime": "2026-09-20T09:07:08.742293Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-18T17:18:01Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-20T09:07:08.910929Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-23T13:34:17.159174Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "worklink-create-api@1.0.0", "adm-zip@0.6.0" ], "upgradePath": [ false, "adm-zip@0.6.1" ], "isUpgradable": true, "isPatchable": false, "name": "adm-zip", "version": "0.6.0" }, { "id": "SNYK-JS-PROXYADDR-19812342", "title": "User Impersonation", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "kagebunsher" ], "semver": { "vulnerable": [ ">=1.1.0 <2.0.8" ] }, "exploit": "Not Defined", "fixedIn": [ "2.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "critical", "cvssScore": 9.3, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "proxy-addr", "references": [ { "url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h", "title": "GitHub Advisory" }, { "url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965", "title": "GitHub Commit" } ], "cvssDetails": [], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "critical", "baseScore": 9.3, "cvssVersion": "4.0", "modificationTime": "2026-09-15T14:03:28.067198Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Snyk", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-09-15T14:03:28.067198Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n", "epssDetails": { "percentile": "0.08526", "probability": "0.00187", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-90711" ], "CWE": [ "CWE-290" ], "GHSA": [ "GHSA-jqcg-44mw-7w3h" ] }, "packageName": "proxy-addr", "proprietary": false, "creationTime": "2026-09-15T08:22:56.328403Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-15T07:14:51Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-15T08:22:56.519310Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-15T14:03:28.067198Z", "socialTrendAlert": false, "severityWithCritical": "critical", "from": [ "worklink-create-api@1.0.0", "express@5.2.1", "proxy-addr@2.0.7" ], "upgradePath": [ false, "express@5.2.1", "proxy-addr@2.0.8" ], "isUpgradable": true, "isPatchable": false, "name": "proxy-addr", "version": "2.0.7" } ], "ok": false, "dependencyCount": 154, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "4 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "remediation": { "unresolved": [ { "id": "SNYK-JS-PROXYADDR-19812342", "title": "User Impersonation", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "kagebunsher" ], "semver": { "vulnerable": [ ">=1.1.0 <2.0.8" ] }, "exploit": "Not Defined", "fixedIn": [ "2.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "critical", "cvssScore": 9.3, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "proxy-addr", "references": [ { "url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h", "title": "GitHub Advisory" }, { "url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965", "title": "GitHub Commit" } ], "cvssDetails": [], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "critical", "baseScore": 9.3, "cvssVersion": "4.0", "modificationTime": "2026-09-15T14:03:28.067198Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Snyk", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-09-15T14:03:28.067198Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n", "epssDetails": { "percentile": "0.08526", "probability": "0.00187", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-90711" ], "CWE": [ "CWE-290" ], "GHSA": [ "GHSA-jqcg-44mw-7w3h" ] }, "packageName": "proxy-addr", "proprietary": false, "creationTime": "2026-09-15T08:22:56.328403Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-09-15T07:14:51Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-09-15T08:22:56.519310Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-15T14:03:28.067198Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "worklink-create-api@1.0.0", "express@5.2.1", "proxy-addr@2.0.7" ], "upgradePath": [ false, "express@5.2.1", "proxy-addr@2.0.8" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "proxy-addr", "version": "2.0.7", "severityWithCritical": "critical" } ], "upgrade": { "adm-zip@0.6.0": { "upgradeTo": "adm-zip@0.6.1", "upgrades": [ "adm-zip@0.6.0", "adm-zip@0.6.0", "adm-zip@0.6.0" ], "vulns": [ "SNYK-JS-ADMZIP-19276676", "SNYK-JS-ADMZIP-19846655", "SNYK-JS-ADMZIP-19963965" ] } }, "patch": {}, "ignore": {}, "pin": {} }, "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 4, "targetFile": "/opt/scopear/app/services/api/package.json", "projectName": "worklink-create-api", "displayTargetFile": "/opt/scopear/app/services/api/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.21_47ddc85.4286" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 3, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/opt/scopear/.npm-global/lib/node_modules", "projectName": "lib", "displayTargetFile": "/opt/scopear/.npm-global/lib/node_modules", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.21_47ddc85.4286" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 17, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/opt/scopear/.npm-global/lib/node_modules/typescript/node_modules/@typescript/typescript-linux-x64/lib/tsc", "projectName": "github.com/microsoft/typescript-go", "displayTargetFile": "/opt/scopear/.npm-global/lib/node_modules/typescript/node_modules/@typescript/typescript-linux-x64/lib/tsc", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-wlc2-mc:2.50.21_47ddc85.4286/microsoft/typescript-go" } ] }