firebase-tools-12.4.7.tgz: 16 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com]

Vulnerable Library - firebase-tools-12.4.7.tgz

Library home page: https://registry.npmjs.org/firebase-tools/-/firebase-tools-12.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/package.json

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (firebase-tools version)	Remediation Possible**
CVE-2023-42282	Critical	9.8	detected in multiple dependencies	Transitive	12.4.8	✅
CVE-2024-29415	Critical	9.1	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2025-7783	High	8.7	form-data-4.0.0.tgz	Transitive	12.4.8	✅
CVE-2024-45296	High	7.5	path-to-regexp-1.8.0.tgz	Transitive	12.4.8	✅
CVE-2024-4068	High	7.5	braces-3.0.2.tgz	Transitive	N/A*	❌
CVE-2024-37890	High	7.5	ws-7.5.9.tgz	Transitive	12.4.8	✅
CVE-2024-21538	High	7.5	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2024-28863	Medium	6.5	tar-6.1.15.tgz	Transitive	N/A*	❌
CVE-2025-64718	Medium	5.3	detected in multiple dependencies	Transitive	13.7.3	✅
CVE-2024-47178	Medium	5.3	basic-auth-connect-1.0.0.tgz	Transitive	12.4.8	✅
CVE-2025-7339	Low	3.4	on-headers-1.0.2.tgz	Transitive	12.4.8	✅
CVE-2025-59437	Low	3.2	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2025-59436	Low	3.2	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2025-5889	Low	3.1	detected in multiple dependencies	Transitive	12.4.8	✅
CVE-2024-4128	Low	2.6	firebase-tools-12.4.7.tgz	Direct	N/A	❌
CVE-2025-54798	Low	2.5	detected in multiple dependencies	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-42282

Vulnerable Libraries - ip-1.1.8.tgz, ip-2.0.0.tgz

ip-1.1.8.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ip/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • proxy-agent-6.3.0.tgz
    • pac-proxy-agent-7.0.0.tgz
      • pac-resolver-7.0.0.tgz
        • ❌ ip-1.1.8.tgz (Vulnerable Library)

ip-2.0.0.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/socks/node_modules/ip/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • proxy-agent-6.3.0.tgz
    • socks-proxy-agent-8.0.1.tgz
      • socks-2.7.1.tgz
        • ❌ ip-2.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Publish Date: 2024-02-08

URL: CVE-2023-42282

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-78xj-cgh5-2h22

Release Date: 2024-02-08

Fix Resolution (ip): 1.1.9

Direct dependency fix Resolution (firebase-tools): 12.4.8

Fix Resolution (ip): 1.1.9

Direct dependency fix Resolution (firebase-tools): 12.4.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-29415

Vulnerable Libraries - ip-2.0.0.tgz, ip-1.1.8.tgz

ip-2.0.0.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/socks/node_modules/ip/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • proxy-agent-6.3.0.tgz
    • socks-proxy-agent-8.0.1.tgz
      • socks-2.7.1.tgz
        • ❌ ip-2.0.0.tgz (Vulnerable Library)

ip-1.1.8.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ip/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • proxy-agent-6.3.0.tgz
    • pac-proxy-agent-7.0.0.tgz
      • pac-resolver-7.0.0.tgz
        • ❌ ip-1.1.8.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282. We assigned a different CVSS score to this CVE because of its potential to result in a Server-Side Request Forgery (SSRF) vulnerability. Additionally, the package is no longer maintained, which increases the associated risk.

Publish Date: 2024-05-27

URL: CVE-2024-29415

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2025-7783

Vulnerable Library - form-data-4.0.0.tgz

A library to create readable "multipart/form-data" streams. Can be used to submit forms and file uploads to other web applications.

Library home page: https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/form-data/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • ❌ form-data-4.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.
This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-07-18

URL: CVE-2025-7783

CVSS 3 Score Details (8.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fjxv-7rqg-78g4

Release Date: 2025-07-18

Fix Resolution (form-data): 4.0.4

Direct dependency fix Resolution (firebase-tools): 12.4.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-45296

Vulnerable Library - path-to-regexp-1.8.0.tgz

Express style path to RegExp utility

Library home page: https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-1.8.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/node_modules/superstatic/node_modules/path-to-regexp/package.json,/node_modules/superstatic/node_modules/path-to-regexp/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • superstatic-9.0.3.tgz
    • ❌ path-to-regexp-1.8.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

Publish Date: 2024-09-09

URL: CVE-2024-45296

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9wv6-86v2-598j

Release Date: 2024-09-09

Fix Resolution (path-to-regexp): 1.9.0

Direct dependency fix Resolution (firebase-tools): 12.4.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-4068

Vulnerable Library - braces-3.0.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/node_modules/braces/package.json,/node_modules/braces/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • chokidar-3.5.3.tgz
    • ❌ braces-3.0.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The NPM package "braces", versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In "lib/parse.js," if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash. After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.

Publish Date: 2024-05-13

URL: CVE-2024-4068

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-13

Fix Resolution: braces - 3.0.3

CVE-2024-37890

Vulnerable Library - ws-7.5.9.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.5.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ws/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • ❌ ws-7.5.9.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

Publish Date: 2024-06-17

URL: CVE-2024-37890

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3h5v-q93c-6h6q

Release Date: 2024-06-17

Fix Resolution (ws): 7.5.10

Direct dependency fix Resolution (firebase-tools): 12.4.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-21538

Vulnerable Libraries - cross-spawn-7.0.3.tgz, cross-spawn-6.0.5.tgz

cross-spawn-7.0.3.tgz

Cross platform child_process#spawn and child_process#spawnSync

Library home page: https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cross-spawn/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • ❌ cross-spawn-7.0.3.tgz (Vulnerable Library)

cross-spawn-6.0.5.tgz

Cross platform child_process#spawn and child_process#spawnSync

Library home page: https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/node_modules/cross-env/node_modules/cross-spawn/package.json,/node_modules/cross-env/node_modules/cross-spawn/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • cross-env-5.2.1.tgz
    • ❌ cross-spawn-6.0.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Publish Date: 2024-11-08

URL: CVE-2024-21538

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2024-21538

Release Date: 2024-11-08

Fix Resolution: org.webjars.npm:cross-spawn:6.0.6,org.webjars.npm:cross-spawn:7.0.5,https://github.com/moxystudio/node-cross-spawn.git - v6.0.6,https://github.com/moxystudio/node-cross-spawn.git - v7.0.5

CVE-2024-28863

Vulnerable Library - tar-6.1.15.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.1.15.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tar/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • ❌ tar-6.1.15.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Publish Date: 2024-03-21

URL: CVE-2024-28863

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f5x3-32g6-xq36

Release Date: 2024-03-21

Fix Resolution: tar - 6.2.1

CVE-2025-64718

Vulnerable Libraries - js-yaml-3.14.1.tgz, js-yaml-4.1.0.tgz

js-yaml-3.14.1.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/node_modules/js-yaml/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • ❌ js-yaml-3.14.1.tgz (Vulnerable Library)

js-yaml-4.1.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/js-yaml/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • exegesis-4.1.1.tgz
    • json-schema-ref-parser-9.1.2.tgz
      • ❌ js-yaml-4.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

js-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution ("proto"). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using "node --disable-proto=delete" or "deno" (in Deno, pollution protection is on by default).

Publish Date: 2025-11-13

URL: CVE-2025-64718

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-mh29-5h37-fv8m

Release Date: 2025-11-13

Fix Resolution (js-yaml): 4.1.1

Direct dependency fix Resolution (firebase-tools): 13.7.3

Fix Resolution (js-yaml): 4.1.1

Direct dependency fix Resolution (firebase-tools): 13.7.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-47178

Vulnerable Library - basic-auth-connect-1.0.0.tgz

Basic auth middleware for node and connect

Library home page: https://registry.npmjs.org/basic-auth-connect/-/basic-auth-connect-1.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/node_modules/basic-auth-connect/package.json,/node_modules/basic-auth-connect/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • superstatic-9.0.3.tgz
    • ❌ basic-auth-connect-1.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0.

Publish Date: 2024-09-30

URL: CVE-2024-47178

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7p89-p6hx-q4fw

Release Date: 2024-09-30

Fix Resolution (basic-auth-connect): 1.1.0

Direct dependency fix Resolution (firebase-tools): 12.4.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2025-7339

Vulnerable Library - on-headers-1.0.2.tgz

Execute a listener when a response is about to write headers

Library home page: https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/node_modules/on-headers/package.json,/node_modules/on-headers/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • morgan-1.10.0.tgz
    • ❌ on-headers-1.0.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions "<1.1.0" may result in response headers being inadvertently modified when an array is passed to "response.writeHead()". Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to "1.1.0", but this issue can be worked around by passing an object to "response.writeHead()" rather than an array.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-07-17

URL: CVE-2025-7339

CVSS 3 Score Details (3.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-76c9-3jph-rj3q

Release Date: 2025-07-17

Fix Resolution (on-headers): 1.1.0

Direct dependency fix Resolution (firebase-tools): 12.4.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2025-59437

Vulnerable Libraries - ip-1.1.8.tgz, ip-2.0.0.tgz

ip-1.1.8.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ip/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • proxy-agent-6.3.0.tgz
    • pac-proxy-agent-7.0.0.tgz
      • pac-resolver-7.0.0.tgz
        • ❌ ip-1.1.8.tgz (Vulnerable Library)

ip-2.0.0.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/socks/node_modules/ip/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • proxy-agent-6.3.0.tgz
    • socks-proxy-agent-8.0.1.tgz
      • socks-2.7.1.tgz
        • ❌ ip-2.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415. NOTE: in current versions of several applications, connection attempts to the IP address 0 (interpreted as 0.0.0.0) are blocked with error messages such as net::ERR_ADDRESS_INVALID. However, in some situations that depend on both application version and operating system, connection attempts to 0 and 0.0.0.0 are considered connection attempts to 127.0.0.1 (and, for this reason, a false value of isPublic would be preferable).

Publish Date: 2025-09-16

URL: CVE-2025-59437

CVSS 3 Score Details (3.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2025-59436

Vulnerable Libraries - ip-1.1.8.tgz, ip-2.0.0.tgz

ip-1.1.8.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ip/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • proxy-agent-6.3.0.tgz
    • pac-proxy-agent-7.0.0.tgz
      • pac-resolver-7.0.0.tgz
        • ❌ ip-1.1.8.tgz (Vulnerable Library)

ip-2.0.0.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/socks/node_modules/ip/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • proxy-agent-6.3.0.tgz
    • socks-proxy-agent-8.0.1.tgz
      • socks-2.7.1.tgz
        • ❌ ip-2.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415.

Publish Date: 2025-09-16

URL: CVE-2025-59436

CVSS 3 Score Details (3.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2025-5889

Vulnerable Libraries - brace-expansion-1.1.11.tgz, brace-expansion-2.0.1.tgz

brace-expansion-1.1.11.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/node_modules/brace-expansion/package.json,/node_modules/brace-expansion/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • minimatch-3.1.2.tgz
    • ❌ brace-expansion-1.1.11.tgz (Vulnerable Library)

brace-expansion-2.0.1.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/readdir-glob/node_modules/brace-expansion/package.json,/node_modules/superstatic/node_modules/brace-expansion/package.json,/node_modules/cacache/node_modules/brace-expansion/package.json,/node_modules/protobufjs-cli/node_modules/brace-expansion/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • archiver-5.3.1.tgz
    • readdir-glob-1.1.3.tgz
      • minimatch-5.1.6.tgz
        • ❌ brace-expansion-2.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A vulnerability was found in juliangruber brace-expansion up to 1.1.11. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to apply a patch to fix this issue.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-06-09

URL: CVE-2025-5889

CVSS 3 Score Details (3.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-v6h2-p8h4-qcjw

Release Date: 2025-06-09

Fix Resolution (brace-expansion): 1.1.12

Direct dependency fix Resolution (firebase-tools): 12.4.8

Fix Resolution (brace-expansion): 1.1.12

Direct dependency fix Resolution (firebase-tools): 12.4.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-4128

Vulnerable Library - firebase-tools-12.4.7.tgz

Library home page: https://registry.npmjs.org/firebase-tools/-/firebase-tools-12.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/package.json

Dependency Hierarchy:

• ❌ firebase-tools-12.4.7.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed calls to localhost (ie Chrome before v94), the website could exfiltrate emulator data. We recommend upgrading past version 13.6.0 or commit  068a2b08dc308c7ab4b569617f5fc8821237e3a0 firebase/firebase-tools@068a2b0
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2024-05-02

URL: CVE-2024-4128

CVSS 3 Score Details (2.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2025-54798

Vulnerable Libraries - tmp-0.0.33.tgz, tmp-0.2.1.tgz

tmp-0.0.33.tgz

Temporary file and directory creator

Library home page: https://registry.npmjs.org/tmp/-/tmp-0.0.33.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/node_modules/tmp/package.json,/node_modules/external-editor/node_modules/tmp/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • inquirer-8.2.6.tgz
    • external-editor-3.1.0.tgz
      • ❌ tmp-0.0.33.tgz (Vulnerable Library)

tmp-0.2.1.tgz

Temporary file and directory creator

Library home page: https://registry.npmjs.org/tmp/-/tmp-0.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tmp/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • ❌ tmp-0.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.

Publish Date: 2025-08-07

URL: CVE-2025-54798

CVSS 3 Score Details (2.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

---

⛑️Automatic Remediation will be attempted for this issue.