@fabasoad/sarif-to-slack 0.1.1 → 0.2.1

package/test-data/sarif/snyk-yarn.sarif

@@ -0,0 +1,2900 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "name": "Snyk Open Source",
+          "properties": {
+            "artifactsScanned": 186
+          },
+          "rules": [
+            {
+              "id": "SNYK-JS-ANSIREGEX-1583908",
+              "shortDescription": {
+                "text": "High severity - Regular Expression Denial of Service (ReDoS) vulnerability in ansi-regex"
+              },
+              "fullDescription": {
+                "text": "(CVE-2021-3807) ansi-regex@2.1.1"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: ansi-regex\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › inquirer@0.12.0 › ansi-regex@2.1.1\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › inquirer@0.12.0 › chalk@1.1.3 › has-ansi@2.0.0 › ansi-regex@2.1.1\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › inquirer@0.12.0 › chalk@1.1.3 › strip-ansi@3.0.1 › ansi-regex@2.1.1\n# Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#&.:=?%@~_]*)*`.\r\n\r\n\r\n## PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i <= 50000; i++) {\r\n    var time = Date.now();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = Date.now() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n# Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n# Remediation\nUpgrade `ansi-regex` to version 3.0.1, 4.1.1, 5.0.1, 6.0.1 or higher.\n# References\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a)\n- [GitHub Commit](https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9)\n- [GitHub PR](https://github.com/chalk/ansi-regex/pull/37)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-400",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 7.5,
+                "security-severity": "7.5"
+              }
+            },
+            {
+              "id": "SNYK-JS-ASYNC-2441827",
+              "shortDescription": {
+                "text": "High severity - Prototype Pollution vulnerability in async"
+              },
+              "fullDescription": {
+                "text": "(CVE-2021-43138) async@2.6.2"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: async\n* Introduced through: server@1.0.0, mongoose@5.6.9 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › async@2.6.2\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › async@2.6.2\n# Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mapValues()` method, due to improper check in `createObjectIterator` function.\r\n\r\n# PoC\r\n\r\n```js\r\n//when objects are parsed, all properties are created as own (the objects can come from outside sources (http requests/ file))\r\nconst hasOwn = JSON.parse('{\"__proto__\": {\"isAdmin\": true}}');\r\n\r\n//does not have the property,  because it's inside object's own \"__proto__\"\r\nconsole.log(hasOwn.isAdmin);\r\n\r\nasync.mapValues(hasOwn, (val, key, cb) => cb(null, val), (error, result) => {\r\n  // after the method executes, hasOwn.__proto__ value (isAdmin: true) replaces the prototype of the newly created object, leading to potential exploits.\r\n  console.log(result.isAdmin);\r\n});\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `async` to version 2.6.4, 3.2.2 or higher.\n# References\n- [GitHub Backport PR](https://github.com/caolan/async/pull/1828)\n- [GitHub Commit](https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2)\n- [GitHub Commit](https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d)\n- [PoC](https://jsfiddle.net/oz5twjd9/)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 7.5,
+                "security-severity": "7.5"
+              }
+            },
+            {
+              "id": "SNYK-JS-AWSSDK-1059424",
+              "shortDescription": {
+                "text": "High severity - Prototype Pollution vulnerability in aws-sdk"
+              },
+              "fullDescription": {
+                "text": "(CVE-2020-28472) aws-sdk@2.507.0"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: aws-sdk\n* Introduced through: server@1.0.0 and aws-sdk@2.507.0\n### Detailed paths\n* _Introduced through_: server@1.0.0 › aws-sdk@2.507.0\n# Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution. If an attacker submits a malicious INI file to an application that parses it with `loadSharedConfigFiles `, they will pollute the prototype on the application. This can be exploited further depending on the context.\r\n\r\n# PoC by Eugene Lim:\r\n\r\npayload.toml:\r\n```\r\n[__proto__]\r\npolluted = \"polluted\"\r\n```\r\n\r\npoc.js:\r\n```\r\nvar fs = require('fs')\r\nvar sharedIniFileLoader = require('@aws-sdk/shared-ini-file-loader')\r\n\r\nasync function main() {\r\nvar parsed = await sharedIniFileLoader.loadSharedConfigFiles({ filepath: './payload.toml' })\r\nconsole.log(parsed)\r\nconsole.log(parsed.__proto__)\r\nconsole.log({}.__proto__)\r\nconsole.log(polluted)\r\n}\r\n\r\nmain()\r\n```\r\n\r\n```\r\n> node poc.js\r\n{\r\nconfigFile: { default: { region: 'ap-southeast-1' } },\r\ncredentialsFile: {}\r\n}\r\n{ polluted: '\"polluted\"' }\r\n{ polluted: '\"polluted\"' }\r\n\"polluted\"\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `aws-sdk` to version 2.814.0 or higher.\n# References\n- [GitHub Commit (v2 SDK)](https://github.com/aws/aws-sdk-js/pull/3585/commits/7d72aff2a941173733fcb6741b104cd83d3bc611)\n- [GitHub Commit (v3 SDK)](https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 7.3,
+                "security-severity": "7.3"
+              }
+            },
+            {
+              "id": "snyk:lic:npm:aws-sdk:Apache-2.0",
+              "shortDescription": {
+                "text": "High severity - Apache-2.0 license vulnerability in aws-sdk"
+              },
+              "fullDescription": {
+                "text": "aws-sdk@2.507.0"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Module: aws-sdk\n* Introduced through: server@1.0.0 and aws-sdk@2.507.0\n### Detailed paths\n* _Introduced through_: server@1.0.0 › aws-sdk@2.507.0\nApache-2.0 license"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "yarn"
+                ],
+                "security-severity": "undefined"
+              }
+            },
+            {
+              "id": "SNYK-JS-BODYPARSER-7926860",
+              "shortDescription": {
+                "text": "High severity - Asymmetric Resource Consumption (Amplification) vulnerability in body-parser"
+              },
+              "fullDescription": {
+                "text": "(CVE-2024-45590) body-parser@1.19.0"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: body-parser\n* Introduced through: server@1.0.0 and body-parser@1.19.0\n### Detailed paths\n* _Introduced through_: server@1.0.0 › body-parser@1.19.0\n* _Introduced through_: server@1.0.0 › express@4.17.1 › body-parser@1.19.0\n# Overview\n\nAffected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) via the `extendedparser` and `urlencoded` functions when the URL encoding process is enabled. An attacker can flood the server with a large number of specially crafted requests.\n# Remediation\nUpgrade `body-parser` to version 1.20.3 or higher.\n# References\n- [GitHub Commit](https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-405",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 8.2,
+                "security-severity": "8.2"
+              }
+            },
+            {
+              "id": "SNYK-JS-BSON-561052",
+              "shortDescription": {
+                "text": "High severity - Internal Property Tampering vulnerability in bson"
+              },
+              "fullDescription": {
+                "text": "(CVE-2020-7610) bson@1.1.1"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: bson\n* Introduced through: server@1.0.0, mongoose@5.6.9 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › bson@1.1.1\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › bson@1.1.1\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › mongodb@3.2.7 › mongodb-core@3.2.7 › bson@1.1.1\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › mongodb@3.2.7 › mongodb-core@3.2.7 › bson@1.1.1\n# Overview\n[bson](https://www.npmjs.com/package/bson) is a BSON Parser for node and browser.\n\nAffected versions of this package are vulnerable to Internal Property Tampering. The package will ignore an unknown value for an object's `_bsotype`, leading to cases where an object is serialized as a document rather than the intended BSON type.\n\n\n **NOTE:** This vulnerability has also been identified as: [CVE-2019-2391](https://security.snyk.io/vuln/SNYK-JS-BSON-6056525)\n\n# Remediation\nUpgrade `bson` to version 1.1.4 or higher.\n# References\n- [GitHub Commit](https://github.com/mongodb/js-bson/commit/3809c1313a7b2a8001065f0271199df9fa3d16a8)\n- [Release Note](https://github.com/mongodb/js-bson/releases/tag/v1.1.4)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-642",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 8.1,
+                "security-severity": "8.1"
+              }
+            },
+            {
+              "id": "SNYK-JS-BSON-6056525",
+              "shortDescription": {
+                "text": "High severity - Internal Property Tampering vulnerability in bson"
+              },
+              "fullDescription": {
+                "text": "(CVE-2019-2391) bson@1.1.1"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: bson\n* Introduced through: server@1.0.0, mongoose@5.6.9 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › bson@1.1.1\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › bson@1.1.1\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › mongodb@3.2.7 › mongodb-core@3.2.7 › bson@1.1.1\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › mongodb@3.2.7 › mongodb-core@3.2.7 › bson@1.1.1\n# Overview\n[bson](https://www.npmjs.com/package/bson) is a BSON Parser for node and browser.\n\nAffected versions of this package are vulnerable to Internal Property Tampering. The package will ignore an unknown value for an object's `_bsotype`, leading to cases where an object is serialized as a document rather than the intended BSON type.\n\n\n **NOTE:** This vulnerability has also been identified as: [CVE-2020-7610](https://security.snyk.io/vuln/SNYK-JS-BSON-561052)\n\n# Remediation\nUpgrade `bson` to version 1.1.4 or higher.\n# References\n- [GitHub Commit](https://github.com/mongodb/js-bson/commit/3809c1313a7b2a8001065f0271199df9fa3d16a8)\n- [Release Note](https://github.com/mongodb/js-bson/releases/tag/v1.1.4)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-642",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 8.1,
+                "security-severity": "8.1"
+              }
+            },
+            {
+              "id": "snyk:lic:npm:bson:Apache-2.0",
+              "shortDescription": {
+                "text": "High severity - Apache-2.0 license vulnerability in bson"
+              },
+              "fullDescription": {
+                "text": "bson@1.1.1"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Module: bson\n* Introduced through: server@1.0.0, mongoose@5.6.9 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › bson@1.1.1\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › bson@1.1.1\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › mongodb@3.2.7 › mongodb-core@3.2.7 › bson@1.1.1\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › mongodb@3.2.7 › mongodb-core@3.2.7 › bson@1.1.1\nApache-2.0 license"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "yarn"
+                ],
+                "security-severity": "undefined"
+              }
+            },
+            {
+              "id": "SNYK-JS-COOKIE-8163060",
+              "shortDescription": {
+                "text": "Medium severity - Cross-site Scripting (XSS) vulnerability in cookie"
+              },
+              "fullDescription": {
+                "text": "(CVE-2024-47764) cookie@0.4.0"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: cookie\n* Introduced through: server@1.0.0, express@4.17.1 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › express@4.17.1 › cookie@0.4.0\n# Overview\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS) via the cookie `name`, `path`, or `domain`, which can be used to set unexpected values to other cookie fields.\r\n\r\n# Workaround\r\nUsers who are not able to upgrade to the fixed version should avoid passing untrusted or arbitrary values for the cookie fields and ensure they are set by the application instead of user input.\n# Details\n\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\n\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\n\nInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\n\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\n \nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \n\n## Types of attacks\nThere are a few methods by which XSS can be manipulated:\n\n|Type|Origin|Description|\n|--|--|--|\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\n\n## Affected environments\nThe following environments are susceptible to an XSS attack:\n\n* Web servers\n* Application servers\n* Web application environments\n\n## How to prevent\nThis section describes the top best practices designed to specifically protect your code: \n\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \n* Give users the option to disable client-side scripts.\n* Redirect invalid requests.\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n# Remediation\nUpgrade `cookie` to version 0.7.0 or higher.\n# References\n- [GitHub Commit](https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c)\n- [GitHub PR](https://github.com/jshttp/cookie/pull/167)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2316549)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-79",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 6.3,
+                "security-severity": "6.3"
+              }
+            },
+            {
+              "id": "SNYK-JS-EXPRESS-6474509",
+              "shortDescription": {
+                "text": "Medium severity - Open Redirect vulnerability in express"
+              },
+              "fullDescription": {
+                "text": "(CVE-2024-29041) express@4.17.1"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: express\n* Introduced through: server@1.0.0 and express@4.17.1\n### Detailed paths\n* _Introduced through_: server@1.0.0 › express@4.17.1\n# Overview\n[express](https://github.com/expressjs/express) is a minimalist web framework.\n\nAffected versions of this package are vulnerable to Open Redirect due to the implementation of URL encoding using `encodeurl` before passing it to the `location` header. This can lead to unexpected evaluations of malformed URLs by common redirect allow list implementations in applications, allowing an attacker to bypass a properly implemented allow list and redirect users to malicious sites.\n# Remediation\nUpgrade `express` to version 4.19.2, 5.0.0-beta.3 or higher.\n# References\n- [Github Commit](https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94)\n- [GitHub Commit](https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd)\n- [Github Issue](https://github.com/koajs/koa/issues/1800)\n- [GitHub PR](https://github.com/expressjs/express/pull/5551)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-601",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 6.1,
+                "security-severity": "6.1"
+              }
+            },
+            {
+              "id": "SNYK-JS-EXPRESS-7926867",
+              "shortDescription": {
+                "text": "Medium severity - Cross-site Scripting vulnerability in express"
+              },
+              "fullDescription": {
+                "text": "(CVE-2024-43796) express@4.17.1"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: express\n* Introduced through: server@1.0.0 and express@4.17.1\n### Detailed paths\n* _Introduced through_: server@1.0.0 › express@4.17.1\n# Overview\n[express](https://github.com/expressjs/express) is a minimalist web framework.\n\nAffected versions of this package are vulnerable to Cross-site Scripting due to improper handling of user input in the `response.redirect` method. An attacker can execute arbitrary code by passing malicious input to this method.\r\n\r\n\r\n**Note**\r\n\r\nTo exploit this vulnerability, the following conditions are required:\r\n\r\n1) The attacker should be able to control the input to `response.redirect()`\r\n\r\n2) express must not redirect before the template appears\r\n\r\n3) the browser must not complete redirection before:\r\n\r\n4) the user must click on the link in the template\n# Remediation\nUpgrade `express` to version 4.20.0, 5.0.0 or higher.\n# References\n- [GitHub Commit](https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-79",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 5.1,
+                "security-severity": "5.1"
+              }
+            },
+            {
+              "id": "SNYK-JS-HOSTEDGITINFO-1088355",
+              "shortDescription": {
+                "text": "Medium severity - Regular Expression Denial of Service (ReDoS) vulnerability in hosted-git-info"
+              },
+              "fullDescription": {
+                "text": "(CVE-2021-23362) hosted-git-info@2.8.2"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: hosted-git-info\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › yargs@4.8.1 › read-pkg-up@1.0.1 › read-pkg@1.1.0 › normalize-package-data@2.5.0 › hosted-git-info@2.8.2\n# Overview\n[hosted-git-info](https://www.npmjs.org/package/hosted-git-info) is a Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression `shortcutMatch ` in the `fromUrl` function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.\r\n\r\n## PoC by Yeting Li\r\n```\r\nvar hostedGitInfo = require(\"hosted-git-info\")\r\nfunction build_attack(n) {\r\n    var ret = \"a:\"\r\n    for (var i = 0; i < n; i++) {\r\n        ret += \"a\"\r\n    }\r\n    return ret + \"!\";\r\n}\r\n\r\nfor(var i = 1; i <= 5000000; i++) {\r\n   if (i % 1000 == 0) {\r\n        var time = Date.now();\r\n        var attack_str = build_attack(i)\r\n       var parsedInfo = hostedGitInfo.fromUrl(attack_str)\r\n        var time_cost = Date.now() - time;\r\n        console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```\n\n# Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n# Remediation\nUpgrade `hosted-git-info` to version 3.0.8, 2.8.9 or higher.\n# References\n- [GitHub Commit](https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-400",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 5.3,
+                "security-severity": "5.3"
+              }
+            },
+            {
+              "id": "SNYK-JS-LODASH-1018905",
+              "shortDescription": {
+                "text": "Medium severity - Regular Expression Denial of Service (ReDoS) vulnerability in lodash"
+              },
+              "fullDescription": {
+                "text": "(CVE-2020-28500) lodash@4.17.15"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: lodash\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › inquirer@0.12.0 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n# Overview\n[lodash](https://www.npmjs.com/package/lodash) is a modern JavaScript utility library delivering modularity, performance, & extras.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions.\r\n\r\n## POC\r\n```\r\nvar lo = require('lodash');\r\n\r\nfunction build_blank (n) {\r\nvar ret = \"1\"\r\nfor (var i = 0; i < n; i++) {\r\nret += \" \"\r\n}\r\n\r\nreturn ret + \"1\";\r\n}\r\n\r\nvar s = build_blank(50000)\r\nvar time0 = Date.now();\r\nlo.trim(s)\r\nvar time_cost0 = Date.now() - time0;\r\nconsole.log(\"time_cost0: \" + time_cost0)\r\n\r\nvar time1 = Date.now();\r\nlo.toNumber(s)\r\nvar time_cost1 = Date.now() - time1;\r\nconsole.log(\"time_cost1: \" + time_cost1)\r\n\r\nvar time2 = Date.now();\r\nlo.trimEnd(s)\r\nvar time_cost2 = Date.now() - time2;\r\nconsole.log(\"time_cost2: \" + time_cost2)\r\n```\n\n# Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n# Remediation\nUpgrade `lodash` to version 4.17.21 or higher.\n# References\n- [GitHub Commit](https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a)\n- [GitHub Fix PR](https://github.com/lodash/lodash/pull/5065)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-400",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 5.3,
+                "security-severity": "5.3"
+              }
+            },
+            {
+              "id": "SNYK-JS-LODASH-1040724",
+              "shortDescription": {
+                "text": "High severity - Code Injection vulnerability in lodash"
+              },
+              "fullDescription": {
+                "text": "(CVE-2021-23337) lodash@4.17.15"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: lodash\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › inquirer@0.12.0 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n# Overview\n[lodash](https://www.npmjs.com/package/lodash) is a modern JavaScript utility library delivering modularity, performance, & extras.\n\nAffected versions of this package are vulnerable to Code Injection via `template`.\r\n\r\n## PoC\r\n```js\r\nvar _ = require('lodash');\r\n\r\n_.template('', { variable: '){console.log(process.env)}; with(obj' })()\r\n```\n# Remediation\nUpgrade `lodash` to version 4.17.21 or higher.\n# References\n- [GitHub Commit](https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c)\n- [Vulnerable Code](https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-94",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 7.2,
+                "security-severity": "7.2"
+              }
+            },
+            {
+              "id": "SNYK-JS-LODASH-567746",
+              "shortDescription": {
+                "text": "High severity - Prototype Pollution vulnerability in lodash"
+              },
+              "fullDescription": {
+                "text": "(CVE-2020-8203) lodash@4.17.15"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: lodash\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › inquirer@0.12.0 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n# Overview\n[lodash](https://www.npmjs.com/package/lodash) is a modern JavaScript utility library delivering modularity, performance, & extras.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The function `zipObjectDeep` can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects.\n# PoC\n```js\r\nconst _ = require('lodash');\r\n\r\n_.zipObjectDeep(['__proto__.z'],[123]);\r\n\r\nconsole.log(z); // 123\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `lodash` to version 4.17.20 or higher.\n# References\n- [GitHub Commit](https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12)\n- [GitHub PR](https://github.com/lodash/lodash/pull/4759)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 8.2,
+                "security-severity": "8.2"
+              }
+            },
+            {
+              "id": "SNYK-JS-LODASH-608086",
+              "shortDescription": {
+                "text": "High severity - Prototype Pollution vulnerability in lodash"
+              },
+              "fullDescription": {
+                "text": "lodash@4.17.15"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: lodash\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › inquirer@0.12.0 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n# Overview\n[lodash](https://www.npmjs.com/package/lodash) is a modern JavaScript utility library delivering modularity, performance, & extras.\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `set` and `setwith` functions due to improper user input sanitization.\n# PoC\n```js\r\nlod = require('lodash')\r\nlod.set({}, \"__proto__[test2]\", \"456\")\r\nconsole.log(Object.prototype)\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `lodash` to version 4.17.17 or higher.\n# References\n- [HackerOne Report](https://hackerone.com/reports/864701)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 7.3,
+                "security-severity": "7.3"
+              }
+            },
+            {
+              "id": "SNYK-JS-LODASH-6139239",
+              "shortDescription": {
+                "text": "High severity - Prototype Pollution vulnerability in lodash"
+              },
+              "fullDescription": {
+                "text": "lodash@4.17.15"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: lodash\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › inquirer@0.12.0 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › async@2.6.2 › lodash@4.17.15\n# Overview\n[lodash](https://www.npmjs.com/package/lodash) is a modern JavaScript utility library delivering modularity, performance, & extras.\n\nAffected versions of this package are vulnerable to Prototype Pollution through the `zipObjectDeep` function due to improper user input sanitization in the `baseZipObject` function.\n# PoC\n**lodash.zipobjectdeep:**\r\n\r\n```js\r\nconst zipObjectDeep = require(\"lodash.zipobjectdeep\");\r\n\r\nlet emptyObject = {};\r\n\r\n\r\nconsole.log(`[+] Before prototype pollution : ${emptyObject.polluted}`);\r\n//[+] Before prototype pollution : undefined\r\n\r\nzipObjectDeep([\"constructor.prototype.polluted\"], [true]);\r\n//we inject our malicious attributes in the vulnerable function\r\n\r\nconsole.log(`[+] After prototype pollution : ${emptyObject.polluted}`);\r\n//[+] After prototype pollution : true\r\n```\r\n\r\n**lodash:**\r\n\r\n```js\r\nconst test = require(\"lodash\");\r\n\r\nlet emptyObject = {};\r\n\r\n\r\nconsole.log(`[+] Before prototype pollution : ${emptyObject.polluted}`);\r\n//[+] Before prototype pollution : undefined\r\n\r\ntest.zipObjectDeep([\"constructor.prototype.polluted\"], [true]);\r\n//we inject our malicious attributes in the vulnerable function\r\n\r\nconsole.log(`[+] After prototype pollution : ${emptyObject.polluted}`);\r\n//[+] After prototype pollution : true\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `lodash` to version 4.17.17 or higher.\n# References\n- [GitHub Gist](https://gist.github.com/Sampaguitas/a316bced4fdd501146b07997d1d04eb2)\n- [Vulnerable Code](https://github.com/lodash/lodash/blob/aaa111912cb05e6f0f9f23d1eb8a41ccfcf9c2c2/lodash.zipobjectdeep/index.js#L738)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 7.5,
+                "security-severity": "7.5"
+              }
+            },
+            {
+              "id": "SNYK-JS-MINIMIST-2429795",
+              "shortDescription": {
+                "text": "Low severity - Prototype Pollution vulnerability in minimist"
+              },
+              "fullDescription": {
+                "text": "(CVE-2021-44906) minimist@0.0.8"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: minimist\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mkdirp@0.5.1 › minimist@0.0.8\n# Overview\n[minimist](https://www.npmjs.com/package/minimist) is a parse argument options module.\n\nAffected versions of this package are vulnerable to Prototype Pollution due to a missing handler to `Function.prototype`.\r\n\r\n**Notes:** \r\n\r\n- This vulnerability is a bypass to [CVE-2020-7598](https://security.snyk.io/vuln/SNYK-JS-MINIMIST-559764)\r\n\r\n- The reason for the different CVSS between CVE-2021-44906 to CVE-2020-7598, is that CVE-2020-7598 can pollute objects, while CVE-2021-44906 can pollute only function.\r\n\r\n\r\n# PoC by Snyk\r\n```js\r\nrequire('minimist')('--_.constructor.constructor.prototype.foo bar'.split(' '));\r\nconsole.log((function(){}).foo); // bar\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `minimist` to version 0.2.4, 1.2.6 or higher.\n# References\n- [Fix Commit](https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703)\n- [Fix Commit](https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d)\n- [Vulnerable Code](https://github.com/minimistjs/minimist/blob/master/index.js#L69)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 3.7,
+                "security-severity": "3.7"
+              }
+            },
+            {
+              "id": "SNYK-JS-MINIMIST-559764",
+              "shortDescription": {
+                "text": "Medium severity - Prototype Pollution vulnerability in minimist"
+              },
+              "fullDescription": {
+                "text": "(CVE-2020-7598) minimist@0.0.8"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: minimist\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mkdirp@0.5.1 › minimist@0.0.8\n# Overview\n[minimist](https://www.npmjs.com/package/minimist) is a parse argument options module.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The library could be tricked into adding or modifying properties of `Object.prototype` using a `constructor` or `__proto__` payload.\r\n\r\n# PoC by Snyk\r\n```\r\nrequire('minimist')('--__proto__.injected0 value0'.split(' '));\r\nconsole.log(({}).injected0 === 'value0'); // true\r\n\r\nrequire('minimist')('--constructor.prototype.injected1 value1'.split(' '));\r\nconsole.log(({}).injected1 === 'value1'); // true\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `minimist` to version 0.2.1, 1.2.3 or higher.\n# References\n- [Command Injection PoC](https://gist.github.com/Kirill89/47feb345b09bf081317f08dd43403a8a)\n- [GitHub Fix Commit #1](https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94)\n- [GitHub Fix Commit #2](https://github.com/substack/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9ab)\n- [Snyk Research Blog](https://snyk.io/blog/prototype-pollution-minimist/)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 5.6,
+                "security-severity": "5.6"
+              }
+            },
+            {
+              "id": "SNYK-JS-MONGOOSE-1086688",
+              "shortDescription": {
+                "text": "Medium severity - Prototype Pollution vulnerability in mongoose"
+              },
+              "fullDescription": {
+                "text": "mongoose@5.6.9"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: mongoose\n* Introduced through: server@1.0.0 and mongoose@5.6.9\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9\n# Overview\n[mongoose](https://www.npmjs.com/package/mongoose) is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The `mongoose.Schema()` function is subject to prototype pollution due to the recursively calling of `Schema.prototype.add()` function to add new items into the schema object. This vulnerability allows modification of the Object prototype.\r\n\r\n\r\n## PoC\r\n```\r\nmongoose = require('mongoose');\r\nmongoose.version; //'5.12.0'\r\nvar malicious_payload = '{\"__proto__\":{\"polluted\":\"HACKED\"}}';\r\nconsole.log('Before:', {}.polluted); // undefined\r\nmongoose.Schema(JSON.parse(malicious_payload));\r\nconsole.log('After:', {}.polluted); // HACKED\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `mongoose` to version 5.12.2 or higher.\n# References\n- [GitHub Commit](https://github.com/Automattic/mongoose/commit/3ed44ffa13737be9fc0d709980da9c3c552d54e7)\n- [GitHub Issue](https://github.com/Automattic/mongoose/issues/10035)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 5.6,
+                "security-severity": "5.6"
+              }
+            },
+            {
+              "id": "SNYK-JS-MONGOOSE-2961688",
+              "shortDescription": {
+                "text": "High severity - Prototype Pollution vulnerability in mongoose"
+              },
+              "fullDescription": {
+                "text": "(CVE-2022-2564) mongoose@5.6.9"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: mongoose\n* Introduced through: server@1.0.0 and mongoose@5.6.9\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9\n# Overview\n[mongoose](https://www.npmjs.com/package/mongoose) is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.\n\nAffected versions of this package are vulnerable to Prototype Pollution in the `Schema.path()` function.\r\n\r\n**Note:**\r\nCVE-2022-24304 is a duplicate of CVE-2022-2564.\r\n\r\n\r\n# PoC:\r\n```js\r\nconst mongoose = require('mongoose');\r\nconst schema = new mongoose.Schema();\r\n\r\nmalicious_payload = '__proto__.toString'\r\n\r\nschema.path(malicious_payload, [String])\r\n\r\nx = {}\r\nconsole.log(x.toString())\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `mongoose` to version 5.13.15, 6.4.6 or higher.\n# References\n- [Github Commit](https://github.com/Automattic/mongoose/commit/6a197316564742c0422309e1b5fecfa4faec126e)\n- [GitHub Commit](https://github.com/Automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8)\n- [GitHub Issue](https://github.com/Automattic/mongoose/issues/12085)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 7,
+                "security-severity": "7"
+              }
+            },
+            {
+              "id": "SNYK-JS-MONGOOSE-472486",
+              "shortDescription": {
+                "text": "Medium severity - Information Exposure vulnerability in mongoose"
+              },
+              "fullDescription": {
+                "text": "(CVE-2019-17426) mongoose@5.6.9"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: mongoose\n* Introduced through: server@1.0.0 and mongoose@5.6.9\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9\n# Overview\n[mongoose](https://www.npmjs.com/package/mongoose) is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.\n\nAffected versions of this package are vulnerable to Information Exposure. Any query object with a `_bsontype` attribute is ignored, allowing attackers to bypass access control.\n# Remediation\nUpgrade `mongoose` to version 4.13.21, 5.7.5 or higher.\n# References\n- [GitHub Commit](https://github.com/Automattic/mongoose/commit/f3eca5b94d822225c04e96cbeed9f095afb3c31c)\n- [GitHub Issue](https://github.com/Automattic/mongoose/issues/8222)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-200",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 5.9,
+                "security-severity": "5.9"
+              }
+            },
+            {
+              "id": "SNYK-JS-MONGOOSE-5777721",
+              "shortDescription": {
+                "text": "High severity - Prototype Pollution vulnerability in mongoose"
+              },
+              "fullDescription": {
+                "text": "(CVE-2023-3696) mongoose@5.6.9"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: mongoose\n* Introduced through: server@1.0.0 and mongoose@5.6.9\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9\n# Overview\n[mongoose](https://www.npmjs.com/package/mongoose) is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.\n\nAffected versions of this package are vulnerable to Prototype Pollution in `document.js`, via update functions such as `findByIdAndUpdate()`. This allows attackers to achieve remote code execution.\r\n\r\n**Note:** Only applications using Express and EJS are vulnerable.\n# PoC\n```js\r\n\r\nimport { connect, model, Schema } from 'mongoose';\r\n\r\nawait connect('mongodb://127.0.0.1:27017/exploit');\r\n\r\nconst Example = model('Example', new Schema({ hello: String }));\r\n\r\nconst example = await new Example({ hello: 'world!' }).save();\r\nawait Example.findByIdAndUpdate(example._id, {\r\n    $rename: {\r\n        hello: '__proto__.polluted'\r\n    }\r\n});\r\n\r\n// this is what causes the pollution\r\nawait Example.find();\r\n\r\nconst test = {};\r\nconsole.log(test.polluted); // world!\r\nconsole.log(Object.prototype); // [Object: null prototype] { polluted: 'world!' }\r\n\r\nprocess.exit();\r\n\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `mongoose` to version 5.13.20, 6.11.3, 7.3.4 or higher.\n# References\n- [GitHub Commit](https://github.com/automattic/mongoose/commit/305ce4ff789261df7e3f6e72363d0703e025f80d)\n- [GitHub Commit](https://github.com/Automattic/mongoose/commit/f1efabf350522257364aa5c2cb36e441cf08f1a2)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 8.1,
+                "security-severity": "8.1"
+              }
+            },
+            {
+              "id": "SNYK-JS-MONGOOSE-8446504",
+              "shortDescription": {
+                "text": "High severity - Improper Neutralization of Special Elements in Data Query Logic vulnerability in mongoose"
+              },
+              "fullDescription": {
+                "text": "(CVE-2024-53900) mongoose@5.6.9"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: mongoose\n* Introduced through: server@1.0.0 and mongoose@5.6.9\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9\n# Overview\n[mongoose](https://www.npmjs.com/package/mongoose) is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.\n\nAffected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic due to the improper handling of `$where` in match queries. An attacker can manipulate search queries to inject malicious code.\n# Remediation\nUpgrade `mongoose` to version 6.13.5, 7.8.3, 8.8.3 or higher.\n# References\n- [GitHub Commit](https://github.com/Automattic/mongoose/commit/33679bcf8ca43d74e3e8ecd4cc224826772d805b)\n- [GitHub Commit](https://github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-943",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 8.7,
+                "security-severity": "8.7"
+              }
+            },
+            {
+              "id": "SNYK-JS-MONGOOSE-8623536",
+              "shortDescription": {
+                "text": "High severity - Improper Neutralization of Special Elements in Data Query Logic vulnerability in mongoose"
+              },
+              "fullDescription": {
+                "text": "(CVE-2025-23061) mongoose@5.6.9"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: mongoose\n* Introduced through: server@1.0.0 and mongoose@5.6.9\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9\n# Overview\n[mongoose](https://www.npmjs.com/package/mongoose) is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.\n\nAffected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic due to the improper use of a `$where` filter in conjunction with the `populate()` match. An attacker can manipulate search queries to retrieve or alter information without proper authorization by injecting malicious input into the query.\r\n\r\n**Note:**\r\nThis vulnerability derives from an incomplete fix of [CVE-2024-53900](https://security.snyk.io/vuln/SNYK-JS-MONGOOSE-8446504)\n# Remediation\nUpgrade `mongoose` to version 6.13.6, 7.8.4, 8.9.5 or higher.\n# References\n- [GitHub Commit](https://github.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc)\n- [GitHub Release](https://github.com/Automattic/mongoose/releases/tag/6.13.6)\n- [GitHub Release](https://github.com/Automattic/mongoose/releases/tag/7.8.4)\n- [GitHub Release](https://github.com/Automattic/mongoose/releases/tag/8.9.5)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-943",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 8.7,
+                "security-severity": "8.7"
+              }
+            },
+            {
+              "id": "SNYK-JS-MPATH-1577289",
+              "shortDescription": {
+                "text": "Medium severity - Prototype Pollution vulnerability in mpath"
+              },
+              "fullDescription": {
+                "text": "(CVE-2021-23438) mpath@0.6.0"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: mpath\n* Introduced through: server@1.0.0, mongoose@5.6.9 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › mpath@0.6.0\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › mpath@0.6.0\n# Overview\n[mpath](https://www.npmjs.com/package/mpath) is a package that gets/sets javascript object values using MongoDB-like path notation.\n\nAffected versions of this package are vulnerable to Prototype Pollution. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition `ignoreProperties.indexOf(parts[i]) !== -1` returns `-1` if `parts[i]` is `['__proto__']`. This is because the method that has been called if the input is an array is `Array.prototype.indexOf()` and not `String.prototype.indexOf()`. They behave differently depending on the type of the input.\r\n\r\n## PoC\r\n```\r\nconst mpath = require('mpath');\r\n// mpath.set(['__proto__', 'polluted'], 'yes', {});\r\n// console.log(polluted); // ReferenceError: polluted is not defined\r\n\r\nmpath.set([['__proto__'], 'polluted'], 'yes', {});\r\nconsole.log(polluted); // yes\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `mpath` to version 0.8.4 or higher.\n# References\n- [GitHub Commit](https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc)\n- [Snyk Blog](https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation/)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 5.6,
+                "security-severity": "5.6"
+              }
+            },
+            {
+              "id": "SNYK-JS-MQUERY-1050858",
+              "shortDescription": {
+                "text": "High severity - Prototype Pollution vulnerability in mquery"
+              },
+              "fullDescription": {
+                "text": "(CVE-2020-35149) mquery@3.2.1"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: mquery\n* Introduced through: server@1.0.0, mongoose@5.6.9 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › mquery@3.2.1\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › mquery@3.2.1\n# Overview\n[mquery](https://www.npmjs.org/package/mquery) is an Expressive query building for MongoDB\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `merge` function within `lib/utils.js`.  Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program. \r\n\r\n\r\n## PoC\r\n```\r\n   require('./env').getCollection(function(err, collection) {\r\n      assert.ifError(err);\r\n      col = collection;\r\n      done();\r\n    });\r\n    var payload = JSON.parse('{\"__proto__\": {\"polluted\": \"vulnerable\"}}');\r\n    var m = mquery(payload);\r\n    console.log({}.polluted);\r\n// The empty object {} will have a property called polluted which will print vulnerable\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `mquery` to version 3.2.3 or higher.\n# References\n- [mquery GitHub Commit](https://github.com/aheckmann/mquery/commit/792e69fd0a7281a0300be5cade5a6d7c1d468ad4)\n- [rxdb GitHub Commit](https://github.com/pubkey/rxdb/commit/b72ea7789ed61649ed05926bd6bac6d2bb6662d6)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 7.3,
+                "security-severity": "7.3"
+              }
+            },
+            {
+              "id": "SNYK-JS-MQUERY-1089718",
+              "shortDescription": {
+                "text": "High severity - Prototype Pollution vulnerability in mquery"
+              },
+              "fullDescription": {
+                "text": "mquery@3.2.1"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: mquery\n* Introduced through: server@1.0.0, mongoose@5.6.9 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › mquery@3.2.1\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › mquery@3.2.1\n# Overview\n[mquery](https://www.npmjs.org/package/mquery) is an Expressive query building for MongoDB\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeClone()` function.\r\n\r\n## PoC by zhou, peng\r\n```\r\nmquery = require('mquery');\r\nvar malicious_payload = '{\"__proto__\":{\"polluted\":\"HACKED\"}}';\r\nconsole.log('Before:', {}.polluted); // undefined\r\nmquery.utils.mergeClone({}, JSON.parse(malicious_payload));\r\nconsole.log('After:', {}.polluted); // HACKED\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `mquery` to version 3.2.5 or higher.\n# References\n- [GitHub Commit](https://github.com/aheckmann/mquery/commit/158f059e058579d2d08c2f1380689f5f69336778)\n- [GitHub PR](https://github.com/aheckmann/mquery/pull/121)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 7.5,
+                "security-severity": "7.5"
+              }
+            },
+            {
+              "id": "SNYK-JS-PASSPORT-2840631",
+              "shortDescription": {
+                "text": "Medium severity - Session Fixation vulnerability in passport"
+              },
+              "fullDescription": {
+                "text": "(CVE-2022-25896) passport@0.4.0"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: passport\n* Introduced through: server@1.0.0 and passport@0.4.0\n### Detailed paths\n* _Introduced through_: server@1.0.0 › passport@0.4.0\n# Overview\n[passport](https://www.npmjs.org/package/passport) is a Simple, unobtrusive authentication for Node.js.\n\nAffected versions of this package are vulnerable to Session Fixation. When a user logs in or logs out, the session is regenerated instead of being closed.\n# Remediation\nUpgrade `passport` to version 0.6.0 or higher.\n# References\n- [GitHub Commit](https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608)\n- [GitHub PR](https://github.com/jaredhanson/passport/pull/900)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-384",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 4.8,
+                "security-severity": "4.8"
+              }
+            },
+            {
+              "id": "SNYK-JS-PATHPARSE-1077067",
+              "shortDescription": {
+                "text": "Medium severity - Regular Expression Denial of Service (ReDoS) vulnerability in path-parse"
+              },
+              "fullDescription": {
+                "text": "(CVE-2021-23343) path-parse@1.0.6"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: path-parse\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › yargs@4.8.1 › read-pkg-up@1.0.1 › read-pkg@1.1.0 › normalize-package-data@2.5.0 › resolve@1.12.0 › path-parse@1.0.6\n# Overview\n[path-parse](https://www.npmjs.org/package/path-parse) is a Node.js path.parse() ponyfill\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `splitDeviceRe`, `splitTailRe`, and `splitPathRe` regular expressions. ReDoS exhibits polynomial worst-case time complexity.\r\n\r\n## PoC\r\n```\r\nvar pathParse = require('path-parse');\r\nfunction build_attack(n) {\r\n    var ret = \"\"\r\n    for (var i = 0; i < n; i++) {\r\n        ret += \"/\"\r\n    }\r\n    return ret + \"◎\";\r\n}\r\n\r\nfor(var i = 1; i <= 5000000; i++) {\r\n    if (i % 10000 == 0) {\r\n        var time = Date.now();\r\n        var attack_str = build_attack(i)\r\n        pathParse(attack_str);\r\n        var time_cost = Date.now() - time;\r\n        console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n }\r\n}\r\n```\n\n# Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n# Remediation\nUpgrade `path-parse` to version 1.0.7 or higher.\n# References\n- [GitHub Issue 1](https://github.com/jbgutierrez/path-parse/issues/8)\n- [GitHub PR](https://github.com/jbgutierrez/path-parse/pull/10)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-400",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 5.3,
+                "security-severity": "5.3"
+              }
+            },
+            {
+              "id": "SNYK-JS-PATHTOREGEXP-7925106",
+              "shortDescription": {
+                "text": "Medium severity - Regular Expression Denial of Service (ReDoS) vulnerability in path-to-regexp"
+              },
+              "fullDescription": {
+                "text": "(CVE-2024-45296) path-to-regexp@0.1.7"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: path-to-regexp\n* Introduced through: server@1.0.0, express@4.17.1 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › express@4.17.1 › path-to-regexp@0.1.7\n# Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when including multiple regular expression parameters in a single segment, which will produce the regular expression `/^\\/([^\\/]+?)-([^\\/]+?)\\/?$/`, if two parameters within a single segment are separated by a character other than a `/` or `.`. Poor performance will block the event loop and can lead to a DoS.\r\n\r\n**Note:**\r\nWhile the 8.0.0 release has completely eliminated the vulnerable functionality, prior versions that have received the patch to mitigate backtracking may still be vulnerable if custom regular expressions are used. So it is strongly recommended for regular expression input to be controlled to avoid malicious performance degradation in those versions. This behavior is enforced as of version 7.1.0 via the `strict` option, which returns an error if a dangerous regular expression is detected.\r\n\r\n# Workaround\r\nThis vulnerability can be avoided by using a custom regular expression for parameters after the first in a segment, which excludes `-` and `/`.\n# PoC\n```js\r\n/a${'-a'.repeat(8_000)}/a\r\n```\n\n# Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n# Remediation\nUpgrade `path-to-regexp` to version 0.1.10, 1.9.0, 3.3.0, 6.3.0, 8.0.0 or higher.\n# References\n- [GitHub Commit](https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f)\n- [GitHub Commit](https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6)\n- [GitHub Commit](https://github.com/pillarjs/path-to-regexp/commit/f73ec6c86b06f544b977119c2b62a16de480a6a9)\n- [Strict Mode Release Note](https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0)\n- [Vulnerability Write-up](https://blakeembrey.com/posts/2024-09-web-redos/)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1333",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 6.9,
+                "security-severity": "6.9"
+              }
+            },
+            {
+              "id": "SNYK-JS-PATHTOREGEXP-8482416",
+              "shortDescription": {
+                "text": "Medium severity - Regular Expression Denial of Service (ReDoS) vulnerability in path-to-regexp"
+              },
+              "fullDescription": {
+                "text": "(CVE-2024-52798) path-to-regexp@0.1.7"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: path-to-regexp\n* Introduced through: server@1.0.0, express@4.17.1 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › express@4.17.1 › path-to-regexp@0.1.7\n# Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when including multiple regular expression parameters in a single segment, when the separator is not `.` (e.g. no `/:a-:b`). Poor performance will block the event loop and can lead to a DoS.\r\n\r\n**Note:**\r\n\r\nThis issue is caused due to an incomplete fix for [CVE-2024-45296](https://security.snyk.io/vuln/SNYK-JS-PATHTOREGEXP-7925106).\r\n\r\n# Workarounds\r\n\r\nThis can be mitigated by avoiding using two parameters within a single path segment, when the separator is not `.` (e.g. no `/:a-:b`). Alternatively, the regex used for both parameters can be defined to ensure they do not overlap to allow backtracking.\n# PoC\n```js\r\n/a${'-a'.repeat(8_000)}/a\r\n```\n\n# Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n# Remediation\nUpgrade `path-to-regexp` to version 0.1.12 or higher.\n# References\n- [Blog Post](https://blakeembrey.com/posts/2024-09-web-redos)\n- [GitHub Commit](https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1333",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 6.9,
+                "security-severity": "6.9"
+              }
+            },
+            {
+              "id": "SNYK-JS-QS-3153490",
+              "shortDescription": {
+                "text": "High severity - Prototype Poisoning vulnerability in qs"
+              },
+              "fullDescription": {
+                "text": "(CVE-2022-24999) qs@6.7.0"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: qs\n* Introduced through: server@1.0.0, body-parser@1.19.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › body-parser@1.19.0 › qs@6.7.0\n* _Introduced through_: server@1.0.0 › express@4.17.1 › qs@6.7.0\n* _Introduced through_: server@1.0.0 › express@4.17.1 › body-parser@1.19.0 › qs@6.7.0\n# Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Prototype Poisoning which allows attackers to cause a Node process to hang, processing an Array object whose prototype has been replaced by one with an excessive length value.\r\n\r\n**Note:** In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b&a[__proto__]&a[length]=100000000`.\n\n# Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n# Remediation\nUpgrade `qs` to version 6.2.4, 6.3.3, 6.4.1, 6.5.3, 6.6.1, 6.7.3, 6.8.3, 6.9.7, 6.10.3 or higher.\n# References\n- [GitHub PR](https://github.com/ljharb/qs/pull/428)\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2150323)\n- [Researcher Advisory](https://github.com/n8tz/CVE-2022-24999)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 7.5,
+                "security-severity": "7.5"
+              }
+            },
+            {
+              "id": "SNYK-JS-REDIS-1255645",
+              "shortDescription": {
+                "text": "Medium severity - Regular Expression Denial of Service (ReDoS) vulnerability in redis"
+              },
+              "fullDescription": {
+                "text": "(CVE-2021-29469) redis@2.8.0"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: redis\n* Introduced through: server@1.0.0 and redis@2.8.0\n### Detailed paths\n* _Introduced through_: server@1.0.0 › redis@2.8.0\n# Overview\n[redis](https://www.npmjs.org/package/redis) is an A high performance Redis client.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). When a client is in monitoring mode, `monitor_regex`, which is used to detected monitor messages` could cause exponential backtracking on some strings, leading to denial of service.\n\n# Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n# Remediation\nUpgrade `redis` to version 3.1.1 or higher.\n# References\n- [GitHub Commit](https://github.com/NodeRedis/node-redis/commit/2d11b6dc9b9774464a91fb4b448bad8bf699629e)\n- [GitHub Release](https://github.com/NodeRedis/node-redis/releases/tag/v3.1.1)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-400",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 5.3,
+                "security-severity": "5.3"
+              }
+            },
+            {
+              "id": "SNYK-JS-SEMVER-3247795",
+              "shortDescription": {
+                "text": "High severity - Regular Expression Denial of Service (ReDoS) vulnerability in semver"
+              },
+              "fullDescription": {
+                "text": "(CVE-2022-25883) semver@5.7.0"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: semver\n* Introduced through: server@1.0.0, mongoose@5.6.9 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › mongodb@3.2.7 › mongodb-core@3.2.7 › require_optional@1.0.1 › semver@5.7.0\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › mongodb@3.2.7 › mongodb-core@3.2.7 › require_optional@1.0.1 › semver@5.7.0\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › yargs@4.8.1 › read-pkg-up@1.0.1 › read-pkg@1.1.0 › normalize-package-data@2.5.0 › semver@5.7.0\n# Overview\n[semver](https://github.com/npm/node-semver) is a semantic version parser used by npm.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the function `new Range`, when untrusted user data is provided as a range.\r\n\r\n\r\n# PoC\r\n\r\n```js\r\n\r\nconst semver = require('semver')\r\nconst lengths_2 = [2000, 4000, 8000, 16000, 32000, 64000, 128000]\r\n\r\nconsole.log(\"n[+] Valid range - Test payloads\")\r\nfor (let i = 0; i =1.2.3' + ' '.repeat(lengths_2[i]) + '<1.3.0';\r\nconst start = Date.now()\r\nsemver.validRange(value)\r\n// semver.minVersion(value)\r\n// semver.maxSatisfying([\"1.2.3\"], value)\r\n// semver.minSatisfying([\"1.2.3\"], value)\r\n// new semver.Range(value, {})\r\n\r\nconst end = Date.now();\r\nconsole.log('length=%d, time=%d ms', value.length, end - start);\r\n}\r\n```\n\n# Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n# Remediation\nUpgrade `semver` to version 5.7.2, 6.3.1, 7.5.2 or higher.\n# References\n- [GitHub Commit](https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0)\n- [GitHub Commit](https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441)\n- [GitHub Commit](https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c)\n- [GitHub PR](https://github.com/npm/node-semver/pull/564)\n- [Vulnerable Code](https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104)\n- [Vulnerable Code](https://github.com/npm/node-semver/blob/main/internal/re.js#L138)\n- [Vulnerable Code](https://github.com/npm/node-semver/blob/main/internal/re.js#L160)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1333",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 7.5,
+                "security-severity": "7.5"
+              }
+            },
+            {
+              "id": "SNYK-JS-SEND-7926862",
+              "shortDescription": {
+                "text": "Low severity - Cross-site Scripting vulnerability in send"
+              },
+              "fullDescription": {
+                "text": "(CVE-2024-43799) send@0.17.1"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: send\n* Introduced through: server@1.0.0, express@4.17.1 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › express@4.17.1 › send@0.17.1\n* _Introduced through_: server@1.0.0 › express@4.17.1 › serve-static@1.14.1 › send@0.17.1\n# Overview\n[send](https://github.com/pillarjs/send) is a Better streaming static file server with Range and conditional-GET support\n\nAffected versions of this package are vulnerable to Cross-site Scripting due to improper user input sanitization passed to the `SendStream.redirect()` function, which executes untrusted code. An attacker can execute arbitrary code by manipulating the input parameters to this method.\r\n\r\n**Note:**\r\n\r\nExploiting this vulnerability requires the following:\r\n\r\n1) The attacker needs to control the input to `response.redirect()`\r\n\r\n2) Express MUST NOT redirect before the template appears\r\n\r\n3) The browser MUST NOT complete redirection before\r\n\r\n4) The user MUST click on the link in the template\n# Details\n\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\n\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\n\nInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\n\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\n \nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \n\n## Types of attacks\nThere are a few methods by which XSS can be manipulated:\n\n|Type|Origin|Description|\n|--|--|--|\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\n\n## Affected environments\nThe following environments are susceptible to an XSS attack:\n\n* Web servers\n* Application servers\n* Web application environments\n\n## How to prevent\nThis section describes the top best practices designed to specifically protect your code: \n\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \n* Give users the option to disable client-side scripts.\n* Redirect invalid requests.\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n# Remediation\nUpgrade `send` to version 0.19.0, 1.1.0 or higher.\n# References\n- [GitHub Commit](https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-79",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 2.1,
+                "security-severity": "2.1"
+              }
+            },
+            {
+              "id": "SNYK-JS-SERVESTATIC-7926865",
+              "shortDescription": {
+                "text": "Low severity - Cross-site Scripting vulnerability in serve-static"
+              },
+              "fullDescription": {
+                "text": "(CVE-2024-43800) serve-static@1.14.1"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: serve-static\n* Introduced through: server@1.0.0, express@4.17.1 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › express@4.17.1 › serve-static@1.14.1\n# Overview\n[serve-static](https://github.com/expressjs/serve-static) is a server.\n\nAffected versions of this package are vulnerable to Cross-site Scripting due to improper sanitization of user input in the `redirect` function. An attacker can manipulate the redirection process by injecting malicious code into the input. \r\n\r\n\r\n**Note**\r\n\r\nTo exploit this vulnerability, the following conditions are required:\r\n\r\n1) The attacker should be able to control the input to `response.redirect()`\r\n\r\n2) express must not redirect before the template appears\r\n\r\n3) the browser must not complete redirection before:\r\n\r\n4) the user must click on the link in the template\n# Details\n\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\n\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\n\nInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\n\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\n \nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \n\n## Types of attacks\nThere are a few methods by which XSS can be manipulated:\n\n|Type|Origin|Description|\n|--|--|--|\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\n\n## Affected environments\nThe following environments are susceptible to an XSS attack:\n\n* Web servers\n* Application servers\n* Web application environments\n\n## How to prevent\nThis section describes the top best practices designed to specifically protect your code: \n\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \n* Give users the option to disable client-side scripts.\n* Redirect invalid requests.\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n# Remediation\nUpgrade `serve-static` to version 1.16.0, 2.1.0 or higher.\n# References\n- [GitHub Commit](https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b)\n- [GitHub Commit](https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-79",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 2.1,
+                "security-severity": "2.1"
+              }
+            },
+            {
+              "id": "SNYK-JS-XML2JS-5414874",
+              "shortDescription": {
+                "text": "Medium severity - Prototype Pollution vulnerability in xml2js"
+              },
+              "fullDescription": {
+                "text": "(CVE-2023-0842) xml2js@0.4.19"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: xml2js\n* Introduced through: server@1.0.0, aws-sdk@2.507.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › aws-sdk@2.507.0 › xml2js@0.4.19\n# Overview\n\nAffected versions of this package are vulnerable to Prototype Pollution due to allowing an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the `__proto__` property to be edited.\n# PoC\n```js\r\nvar parseString = require('xml2js').parseString;\r\n\r\nlet normal_user_request    = \"<role>admin</role>\";\r\nlet malicious_user_request = \"<__proto__><role>admin</role></__proto__>\";\r\n\r\nconst update_user = (userProp) => {\r\n    // A user cannot alter his role. This way we prevent privilege escalations.\r\n    parseString(userProp, function (err, user) {\r\n        if(user.hasOwnProperty(\"role\") && user?.role.toLowerCase() === \"admin\") {\r\n            console.log(\"Unauthorized Action\");\r\n        } else {\r\n            console.log(user?.role[0]);\r\n        }\r\n    });\r\n}\r\n\r\nupdate_user(normal_user_request);\r\nupdate_user(malicious_user_request);\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `xml2js` to version 0.5.0 or higher.\n# References\n- [GitHub Commit](https://github.com/Leonidas-from-XIV/node-xml2js/commit/50a492aef9729b8b9b291c5cb2746ec7dc1369db)\n- [GitHub Issue](https://github.com/Leonidas-from-XIV/node-xml2js/issues/593)\n- [GitHub PR](https://github.com/Leonidas-from-XIV/node-xml2js/pull/603)\n- [GitHub PR](https://github.com/Leonidas-from-XIV/node-xml2js/pull/674)\n- [GitHub PR](https://github.com/Leonidas-from-XIV/node-xml2js/pull/681)\n- [PoC](https://fluidattacks.com/advisories/myers/)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 5.3,
+                "security-severity": "5.3"
+              }
+            },
+            {
+              "id": "SNYK-JS-Y18N-1021887",
+              "shortDescription": {
+                "text": "High severity - Prototype Pollution vulnerability in y18n"
+              },
+              "fullDescription": {
+                "text": "(CVE-2020-7774) y18n@3.2.1"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: y18n\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › yargs@4.8.1 › y18n@3.2.1\n# Overview\n[y18n](https://www.npmjs.com/package/y18n) is a the bare-bones internationalization library used by yargs\n\nAffected versions of this package are vulnerable to Prototype Pollution due to improper sanitization.\r\n# PoC by po6ix:\r\n```js\r\nconst y18n = require('y18n')();\r\n \r\ny18n.setLocale('__proto__');\r\ny18n.updateLocale({polluted: true});\r\n\r\nconsole.log(polluted); // true\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `y18n` to version 3.2.2, 4.0.1, 5.0.5 or higher.\n# References\n- [GitHub Commit](https://github.com/yargs/y18n/commit/a9ac604abf756dec9687be3843e2c93bfe581f25)\n- [GitHub Issue](https://github.com/yargs/y18n/issues/96)\n- [GitHub PR](https://github.com/yargs/y18n/pull/108)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 7.3,
+                "security-severity": "7.3"
+              }
+            },
+            {
+              "id": "SNYK-JS-YARGSPARSER-560381",
+              "shortDescription": {
+                "text": "Medium severity - Prototype Pollution vulnerability in yargs-parser"
+              },
+              "fullDescription": {
+                "text": "(CVE-2020-7608) yargs-parser@2.4.1"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Vulnerable module: yargs-parser\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › yargs@4.8.1 › yargs-parser@2.4.1\n# Overview\n[yargs-parser](https://www.npmjs.com/package/yargs-parser) is a mighty option parser used by yargs.\n\nAffected versions of this package are vulnerable to Prototype Pollution. The library could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.\r\n\r\nOur research team checked several attack vectors to verify this vulnerability:\r\n\r\n1. It could be used for [privilege escalation](https://gist.github.com/Kirill89/dcd8100d010896157a36624119439832).\r\n2. The library could be used to parse user input received from different sources:\r\n    - terminal emulators\r\n    - system calls from other code bases\r\n    - CLI RPC servers\r\n\r\n# PoC by Snyk\r\n```\r\nconst parser = require(\"yargs-parser\");\r\nconsole.log(parser('--foo.__proto__.bar baz'));\r\nconsole.log(({}).bar);\r\n```\n\n# Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.  Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n-   Unsafe `Object` recursive merge\n    \n-   Property definition by path\n    \n\n## Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n  foreach property of source\n\n    if property exists and is an object on both the target and the source\n\n      merge(target[property], source[property])\n\n    else\n\n      target[property] = source[property]\n```\n<br>  \n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n## Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n# Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin  |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client  |This is the most likely attack. <br>DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`). <br> The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.  <br>**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.<br>**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.<br>  **For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n# Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n-   Application server\n    \n-   Web server\n\n-   Web browser\n    \n\n# How to prevent\n\n1.  Freeze the prototype— use `Object.freeze (Object.prototype)`.\n    \n2.  Require schema validation of JSON input.\n    \n3.  Avoid using unsafe recursive merge functions.\n    \n4.  Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n    \n5.  As a best practice use `Map` instead of `Object`.\n\n## For more information on this vulnerability type:\n\n[Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n# Remediation\nUpgrade `yargs-parser` to version 5.0.1, 13.1.2, 15.0.1, 18.1.1 or higher.\n# References\n- [Command Injection PoC](https://gist.github.com/Kirill89/dcd8100d010896157a36624119439832)\n- [GitHub Fix Commit](https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2)\n- [Snyk Research Blog](https://snyk.io/blog/prototype-pollution-minimist/)\n"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "CWE-1321",
+                  "yarn"
+                ],
+                "cvssv3_baseScore": 5.6,
+                "security-severity": "5.6"
+              }
+            },
+            {
+              "id": "snyk:lic:npm:jmespath:Apache-2.0",
+              "shortDescription": {
+                "text": "High severity - Apache-2.0 license vulnerability in jmespath"
+              },
+              "fullDescription": {
+                "text": "jmespath@0.15.0"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Module: jmespath\n* Introduced through: server@1.0.0, aws-sdk@2.507.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › aws-sdk@2.507.0 › jmespath@0.15.0\nApache-2.0 license"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "yarn"
+                ],
+                "security-severity": "undefined"
+              }
+            },
+            {
+              "id": "snyk:lic:npm:kareem:Apache-2.0",
+              "shortDescription": {
+                "text": "High severity - Apache-2.0 license vulnerability in kareem"
+              },
+              "fullDescription": {
+                "text": "kareem@2.3.0"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Module: kareem\n* Introduced through: server@1.0.0, mongoose@5.6.9 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › kareem@2.3.0\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › kareem@2.3.0\nApache-2.0 license"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "yarn"
+                ],
+                "security-severity": "undefined"
+              }
+            },
+            {
+              "id": "snyk:lic:npm:mongodb-core:Apache-2.0",
+              "shortDescription": {
+                "text": "High severity - Apache-2.0 license vulnerability in mongodb-core"
+              },
+              "fullDescription": {
+                "text": "mongodb-core@3.2.7"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Module: mongodb-core\n* Introduced through: server@1.0.0, mongoose@5.6.9 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › mongodb-core@3.2.7\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › mongodb@3.2.7 › mongodb-core@3.2.7\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › mongodb-core@3.2.7\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › mongodb@3.2.7 › mongodb-core@3.2.7\nApache-2.0 license"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "yarn"
+                ],
+                "security-severity": "undefined"
+              }
+            },
+            {
+              "id": "snyk:lic:npm:mongodb:Apache-2.0",
+              "shortDescription": {
+                "text": "High severity - Apache-2.0 license vulnerability in mongodb"
+              },
+              "fullDescription": {
+                "text": "mongodb@3.2.7"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Module: mongodb\n* Introduced through: server@1.0.0, mongoose@5.6.9 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › mongodb@3.2.7\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › mongodb@3.2.7\nApache-2.0 license"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "yarn"
+                ],
+                "security-severity": "undefined"
+              }
+            },
+            {
+              "id": "snyk:lic:npm:mongoose-legacy-pluralize:Apache-2.0",
+              "shortDescription": {
+                "text": "High severity - Apache-2.0 license vulnerability in mongoose-legacy-pluralize"
+              },
+              "fullDescription": {
+                "text": "mongoose-legacy-pluralize@1.0.2"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Module: mongoose-legacy-pluralize\n* Introduced through: server@1.0.0, mongoose@5.6.9 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › mongoose-legacy-pluralize@1.0.2\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › mongoose-legacy-pluralize@1.0.2\nApache-2.0 license"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "yarn"
+                ],
+                "security-severity": "undefined"
+              }
+            },
+            {
+              "id": "snyk:lic:npm:require_optional:Apache-2.0",
+              "shortDescription": {
+                "text": "High severity - Apache-2.0 license vulnerability in require_optional"
+              },
+              "fullDescription": {
+                "text": "require_optional@1.0.1"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Module: require_optional\n* Introduced through: server@1.0.0, mongoose@5.6.9 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › mongoose@5.6.9 › mongodb@3.2.7 › mongodb-core@3.2.7 › require_optional@1.0.1\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › mongoose@5.6.9 › mongodb@3.2.7 › mongodb-core@3.2.7 › require_optional@1.0.1\nApache-2.0 license"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "yarn"
+                ],
+                "security-severity": "undefined"
+              }
+            },
+            {
+              "id": "snyk:lic:npm:rx-lite:Apache-2.0",
+              "shortDescription": {
+                "text": "High severity - Apache-2.0 license vulnerability in rx-lite"
+              },
+              "fullDescription": {
+                "text": "rx-lite@3.1.2"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Module: rx-lite\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › inquirer@0.12.0 › rx-lite@3.1.2\nApache-2.0 license"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "yarn"
+                ],
+                "security-severity": "undefined"
+              }
+            },
+            {
+              "id": "snyk:lic:npm:spdx-correct:Apache-2.0",
+              "shortDescription": {
+                "text": "High severity - Apache-2.0 license vulnerability in spdx-correct"
+              },
+              "fullDescription": {
+                "text": "spdx-correct@3.1.0"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Module: spdx-correct\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › yargs@4.8.1 › read-pkg-up@1.0.1 › read-pkg@1.1.0 › normalize-package-data@2.5.0 › validate-npm-package-license@3.0.4 › spdx-correct@3.1.0\nApache-2.0 license"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "yarn"
+                ],
+                "security-severity": "undefined"
+              }
+            },
+            {
+              "id": "snyk:lic:npm:validate-npm-package-license:Apache-2.0",
+              "shortDescription": {
+                "text": "High severity - Apache-2.0 license vulnerability in validate-npm-package-license"
+              },
+              "fullDescription": {
+                "text": "validate-npm-package-license@3.0.4"
+              },
+              "help": {
+                "text": "",
+                "markdown": "* Package Manager: yarn\n* Module: validate-npm-package-license\n* Introduced through: server@1.0.0, migrate-mongoose@4.0.0 and others\n### Detailed paths\n* _Introduced through_: server@1.0.0 › migrate-mongoose@4.0.0 › yargs@4.8.1 › read-pkg-up@1.0.1 › read-pkg@1.1.0 › normalize-package-data@2.5.0 › validate-npm-package-license@3.0.4\nApache-2.0 license"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "yarn"
+                ],
+                "security-severity": "undefined"
+              }
+            }
+          ]
+        }
+      },
+      "results": [
+        {
+          "ruleId": "SNYK-JS-ANSIREGEX-1583908",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable ansi-regex package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "ansi-regex@2.1.1"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-ASYNC-2441827",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable async package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "async@2.6.2"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to mongoose@5.7.3"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "mongoose@5.7.3"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-AWSSDK-1059424",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable aws-sdk package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "aws-sdk@2.507.0"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to aws-sdk@2.814.0"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "aws-sdk@2.814.0"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "snyk:lic:npm:aws-sdk:Apache-2.0",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable aws-sdk package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "aws-sdk@2.507.0"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-BODYPARSER-7926860",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable body-parser package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "body-parser@1.19.0"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to body-parser@1.20.3"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "body-parser@1.20.3"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-BSON-561052",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable bson package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "bson@1.1.1"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to mongoose@5.6.9"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "mongoose@5.6.9"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-BSON-6056525",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable bson package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "bson@1.1.1"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to mongoose@5.6.9"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "mongoose@5.6.9"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "snyk:lic:npm:bson:Apache-2.0",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable bson package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "bson@1.1.1"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-COOKIE-8163060",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable cookie package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "cookie@0.4.0"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to express@4.21.1"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "express@4.21.1"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-EXPRESS-6474509",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable express package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "express@4.17.1"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to express@4.19.2"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "express@4.19.2"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-EXPRESS-7926867",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable express package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "express@4.17.1"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to express@4.20.0"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "express@4.20.0"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-HOSTEDGITINFO-1088355",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable hosted-git-info package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "hosted-git-info@2.8.2"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-LODASH-1018905",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable lodash package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "lodash@4.17.15"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-LODASH-1040724",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable lodash package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "lodash@4.17.15"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-LODASH-567746",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable lodash package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "lodash@4.17.15"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-LODASH-608086",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable lodash package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "lodash@4.17.15"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-LODASH-6139239",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable lodash package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "lodash@4.17.15"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-MINIMIST-2429795",
+          "level": "note",
+          "message": {
+            "text": "This file introduces a vulnerable minimist package with a low severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "minimist@0.0.8"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-MINIMIST-559764",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable minimist package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "minimist@0.0.8"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to migrate-mongoose@4.0.0"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "migrate-mongoose@4.0.0"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-MONGOOSE-1086688",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable mongoose package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "mongoose@5.6.9"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to mongoose@5.12.2"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "mongoose@5.12.2"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-MONGOOSE-2961688",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable mongoose package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "mongoose@5.6.9"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to mongoose@5.13.15"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "mongoose@5.13.15"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-MONGOOSE-472486",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable mongoose package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "mongoose@5.6.9"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to mongoose@5.7.5"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "mongoose@5.7.5"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-MONGOOSE-5777721",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable mongoose package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "mongoose@5.6.9"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to mongoose@5.13.20"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "mongoose@5.13.20"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-MONGOOSE-8446504",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable mongoose package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "mongoose@5.6.9"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to mongoose@6.13.5"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "mongoose@6.13.5"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-MONGOOSE-8623536",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable mongoose package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "mongoose@5.6.9"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to mongoose@6.13.6"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "mongoose@6.13.6"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-MPATH-1577289",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable mpath package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "mpath@0.6.0"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to mongoose@5.13.9"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "mongoose@5.13.9"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-MQUERY-1050858",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable mquery package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "mquery@3.2.1"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to mongoose@5.11.7"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "mongoose@5.11.7"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-MQUERY-1089718",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable mquery package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "mquery@3.2.1"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to mongoose@5.12.3"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "mongoose@5.12.3"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-PASSPORT-2840631",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable passport package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "passport@0.4.0"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to passport@0.6.0"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "passport@0.6.0"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-PATHPARSE-1077067",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable path-parse package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "path-parse@1.0.6"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-PATHTOREGEXP-7925106",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable path-to-regexp package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "path-to-regexp@0.1.7"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to express@4.20.0"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "express@4.20.0"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-PATHTOREGEXP-8482416",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable path-to-regexp package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "path-to-regexp@0.1.7"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to express@4.21.2"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "express@4.21.2"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-QS-3153490",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable qs package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "qs@6.7.0"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to body-parser@1.19.2"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "body-parser@1.19.2"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-REDIS-1255645",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable redis package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "redis@2.8.0"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to redis@3.1.1"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "redis@3.1.1"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-SEMVER-3247795",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable semver package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "semver@5.7.0"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to mongoose@5.7.0"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "mongoose@5.7.0"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-SEND-7926862",
+          "level": "note",
+          "message": {
+            "text": "This file introduces a vulnerable send package with a low severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "send@0.17.1"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to express@4.20.0"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "express@4.20.0"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-SERVESTATIC-7926865",
+          "level": "note",
+          "message": {
+            "text": "This file introduces a vulnerable serve-static package with a low severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "serve-static@1.14.1"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to express@4.20.0"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "express@4.20.0"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-XML2JS-5414874",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable xml2js package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "xml2js@0.4.19"
+                }
+              ]
+            }
+          ],
+          "fixes": [
+            {
+              "description": {
+                "text": "Upgrade to aws-sdk@2.1354.0"
+              },
+              "artifactChanges": [
+                {
+                  "artifactLocation": {
+                    "uri": "package.json"
+                  },
+                  "replacements": [
+                    {
+                      "deletedRegion": {
+                        "startLine": 1
+                      },
+                      "insertedContent": {
+                        "text": "aws-sdk@2.1354.0"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-Y18N-1021887",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable y18n package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "y18n@3.2.1"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "SNYK-JS-YARGSPARSER-560381",
+          "level": "warning",
+          "message": {
+            "text": "This file introduces a vulnerable yargs-parser package with a medium severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "yargs-parser@2.4.1"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "snyk:lic:npm:jmespath:Apache-2.0",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable jmespath package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "jmespath@0.15.0"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "snyk:lic:npm:kareem:Apache-2.0",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable kareem package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "kareem@2.3.0"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "snyk:lic:npm:mongodb-core:Apache-2.0",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable mongodb-core package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "mongodb-core@3.2.7"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "snyk:lic:npm:mongodb:Apache-2.0",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable mongodb package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "mongodb@3.2.7"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "snyk:lic:npm:mongoose-legacy-pluralize:Apache-2.0",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable mongoose-legacy-pluralize package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "mongoose-legacy-pluralize@1.0.2"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "snyk:lic:npm:require_optional:Apache-2.0",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable require_optional package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "require_optional@1.0.1"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "snyk:lic:npm:rx-lite:Apache-2.0",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable rx-lite package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "rx-lite@3.1.2"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "snyk:lic:npm:spdx-correct:Apache-2.0",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable spdx-correct package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "spdx-correct@3.1.0"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "ruleId": "snyk:lic:npm:validate-npm-package-license:Apache-2.0",
+          "level": "error",
+          "message": {
+            "text": "This file introduces a vulnerable validate-npm-package-license package with a high severity vulnerability."
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "logicalLocations": [
+                {
+                  "fullyQualifiedName": "validate-npm-package-license@3.0.4"
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}