CVE-2023-26105 (High) detected in utilities-0.0.37.tgz, utilities-1.0.5.tgz

[mend-bolt-for-github]

CVE-2023-26105 - High Severity Vulnerability

Vulnerable Libraries - utilities-0.0.37.tgz, utilities-1.0.5.tgz

utilities-0.0.37.tgz

A classic collection of JavaScript utilities

Library home page: https://registry.npmjs.org/utilities/-/utilities-0.0.37.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/filelist/node_modules/utilities/package.json

Dependency Hierarchy:

• cli-testlab-1.10.0.tgz (Root Library)
  • jake-8.1.1.tgz
    • filelist-0.0.6.tgz
      • ❌ utilities-0.0.37.tgz (Vulnerable Library)

utilities-1.0.5.tgz

A classic collection of JavaScript utilities

Library home page: https://registry.npmjs.org/utilities/-/utilities-1.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/utilities/package.json

Dependency Hierarchy:

• cli-testlab-1.10.0.tgz (Root Library)
  • jake-8.1.1.tgz
    • ❌ utilities-1.0.5.tgz (Vulnerable Library)

Found in HEAD commit: 05b77206b4cb5591c1b5ff71f8e97005d070b027

Found in base branch: master

Vulnerability Details

All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.

Publish Date: 2023-02-28

URL: CVE-2023-26105

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with Mend here