⚡The Storm-Ops monorepo contains various configurations and tools used to manage the Storm Software repositories
Home Page: https://stormsoftware.com
License: Apache License 2.0
![allcontributors[bot] avatar](https://avatars.githubusercontent.com/in/23186?v=4 "allcontributors[bot]")
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
![mend-bolt-for-github[bot] avatar](https://avatars.githubusercontent.com/in/16809?v=4 "mend-bolt-for-github[bot]")
![renovate[bot] avatar](https://avatars.githubusercontent.com/in/2740?v=4 "renovate[bot]")
Vulnerable Library - @storm-software/linting-tools-1.39.4.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: 675561baa9e00629e2e8cb16423b57bdc05da436
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in (@storm-software/linting-tools version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-42282 |  Critical |
9.8 | detected in multiple dependencies | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-42282
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 675561baa9e00629e2e8cb16423b57bdc05da436
Found in base branch: main
An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function.
Publish Date: 2024-02-08
URL: CVE-2023-42282
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-78xj-cgh5-2h22
Release Date: 2024-02-08
Fix Resolution: ip - 1.1.9,2.0.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - @storm-software/linting-tools-1.39.0.tgzPath to dependency file: /package.json
Path to vulnerable library: /node_modules/.pnpm/[email protected]/node_modules/ip/package.json
Found in HEAD commit: e0a370f87445faccb93b1207d00b2ee8f5d30dd9
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (@storm-software/linting-tools version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-42282 | Critical |
9.8 | ip-1.1.8.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-42282[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/.pnpm/[email protected]/node_modules/ip/package.json
Dependency Hierarchy:
Found in HEAD commit: e0a370f87445faccb93b1207d00b2ee8f5d30dd9
Found in base branch: main
An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function.
Publish Date: 2024-02-08
URL: CVE-2023-42282
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-42282
Release Date: 2024-02-08
Fix Resolution: ip - 2.0.0
Step up your Open Source Security Game with Mend here
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
These updates have all been created already. Click a checkbox below to force a retry/rebase of any.
@angular-devkit/architect, @angular-devkit/core, @angular-devkit/schematics, @swc-node/register, @swc/wasm, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, bundle-require, conventional-changelog-conventionalcommits, eslint-config-prettier, pkg-types, vfile-reporter)@nx/jest, @types/eslint, @types/inquirer)@commitlint/cli, @commitlint/config-conventional, @commitlint/lint, @commitlint/types, @cspell/dict-cpp, @cspell/dict-en-gb, @cspell/dict-en_us, @cspell/dict-php, @cspell/dict-public-licenses, @cspell/dict-software-terms, @manypkg/cli, @manypkg/get-packages, @microsoft/api-extractor, @nx/devkit, @nx/esbuild, @nx/eslint, @nx/eslint-plugin, @nx/jest, @nx/js, @nx/plugin, @nx/workspace, @size-limit/file, @size-limit/time, @swc/cli, @swc/core, @swc/helpers, @types/jest, @types/node, axios, create-nx-workspace, esbuild-plugin-handlebars, esbuild-plugin-pino, inquirer, lefthook, nx, prettier-plugin-packagejson, prettier-plugin-tailwindcss, remark-mdx, remeda, size-limit, typia, verdaccio, zod-to-json-schema)@nx/jest, @types/eslint, @types/fs-extra, jest-resolve)@angular-devkit/architect, @biomejs/biome, @microsoft/api-extractor, @nx/devkit, @nx/esbuild, @nx/eslint, @nx/eslint-plugin, @nx/jest, @nx/js, @nx/plugin, @nx/workspace, @size-limit/file, @size-limit/time, create-nx-workspace, cspell, esbuild, eslint, node, npm-run-path, nx, pnpm, remeda, rollup, semver, size-limit, terser, typescript, typia)@commitlint/cli, @commitlint/config-conventional, @commitlint/lint, @commitlint/types)@typescript-eslint/eslint-plugin, @typescript-eslint/parser).github/actions/setup-workspace/action.yaml
pnpm/action-setup v3.0.0actions/setup-node v4.github/workflows/ci.yml
actions/checkout v4nrwl/nx-set-shas v4.github/workflows/codeql.yml
actions/checkout v4github/codeql-action v3github/codeql-action v3github/codeql-action v3.github/workflows/cr.yml
.github/workflows/dependabot-approve.yml
.github/workflows/greetings.yml
.github/workflows/labels.yml
actions/checkout v4micnncim/action-label-syncer v1.3.0.github/workflows/lock.yml
dessant/lock-threads v5packages/workspace-tools/src/generators/preset/files/.github/actions/setup-workspace/action.yaml
actions/setup-node v4pnpm/action-setup v3.0.0actions/setup-node v4packages/workspace-tools/src/generators/preset/files/.github/workflows/code-review.yml
packages/workspace-tools/src/generators/preset/files/.github/workflows/codeql.yml
actions/checkout v4github/codeql-action v3github/codeql-action v3github/codeql-action v3packages/workspace-tools/src/generators/preset/files/.github/workflows/git-guardian.yml
actions/checkout v4packages/workspace-tools/src/generators/preset/files/.github/workflows/greetings.yml
packages/workspace-tools/src/generators/preset/files/.github/workflows/labels.yml
actions/checkout v4micnncim/action-label-syncer v1.3.0packages/workspace-tools/src/generators/preset/files/.github/workflows/lock.yml
dessant/lock-threads v5
package.json
@angular-devkit/architect ^0.1702.0@angular-devkit/core ^17.2.0@angular-devkit/schematics ^17.2.0@biomejs/biome 1.5.3@nx/devkit 18.0.4@nx/esbuild 18.0.4@nx/eslint-plugin 18.0.4@nx/eslint 18.0.4@nx/jest 18.0.4@nx/js 18.0.4@nx/plugin 18.0.4@nx/workspace 18.0.4@swc-node/register ^1.8.0@swc/cli 0.3.2@swc/core 1.4.2@swc/helpers 0.5.3@swc/wasm ^1.4.2@tsconfig/recommended 1.0.3@types/jest 29.5.11@types/node 20.11.20@typescript-eslint/eslint-plugin ^6.13.2@typescript-eslint/parser ^6.13.2conventional-changelog-conventionalcommits ^7.0.2esbuild 0.19.12eslint 8.56.0eslint-config-prettier ^9.0.0jest 29.7.0jest-environment-jsdom 29.7.0jest-environment-node 29.7.0lefthook 1.6.1nx 18.0.4prettier 3.2.5rimraf 5.0.5ts-jest 29.1.2ts-node 10.9.2tslib 2.6.2typescript 5.3.3verdaccio 5.29.0node >=21.0.0pnpm >=8.10.2pnpm 8.14.3packages/build-tools/package.json
@anatine/esbuild-decorators 0.2.19@microsoft/api-extractor 7.40.1@nx/devkit 18.0.4@nx/js 18.0.4@nx/workspace 18.0.4commander 11.1.0esbuild-plugin-environment 0.3.0fs-extra 11.2.0glob 10.3.10typescript 5.3.3packages/config-tools/package.json
cosmiconfig 9.0.0find-up 7.0.0fs-extra 11.2.0locate-path 7.2.0zod 3.22.4@types/fs-extra ^11.0.4packages/config/package.json
zod 3.22.4packages/create-storm-workspace/package.json
@nx/workspace 18.0.4create-nx-workspace 18.0.4enquirer 2.4.1packages/git-tools/package.json
@commitlint/cli 18.6.0@commitlint/config-conventional 18.6.0@commitlint/lint 18.6.0@commitlint/types 18.6.0@nx/devkit 18.0.4any-shell-escape 0.1.1axios 1.6.7commander 11.1.0deep-map 2.0.0doctoc 2.2.1es6-weak-map 2.0.3fuzzy 0.1.3inquirer 9.2.12lodash-es 4.17.21micromatch 4.0.5nx 18.0.4prettier 3.2.5remeda 1.38.0semver 7.5.4ts-node 10.9.2word-wrap 1.2.5zod 3.22.4@types/inquirer 9.0.6@types/prettier 3.0.0packages/linting-tools/package.json
@cspell/dict-ada 4.0.2@cspell/dict-aws 4.0.1@cspell/dict-bash 4.1.3@cspell/dict-companies 3.0.31@cspell/dict-cpp 5.1.1@cspell/dict-cryptocurrencies 5.0.0@cspell/dict-csharp 4.0.2@cspell/dict-css 4.0.12@cspell/dict-dart 2.0.3@cspell/dict-django 4.1.0@cspell/dict-docker 1.1.7@cspell/dict-dotnet 5.0.0@cspell/dict-elixir 4.0.3@cspell/dict-en-common-misspellings 2.0.0@cspell/dict-en-gb 4.1.31@cspell/dict-en_us 4.3.14@cspell/dict-filetypes 3.0.3@cspell/dict-fonts 4.0.0@cspell/dict-fsharp 1.0.1@cspell/dict-fullstack 3.1.5@cspell/dict-gaming-terms 1.0.5@cspell/dict-git 2.0.0@cspell/dict-golang 6.0.5@cspell/dict-haskell 4.0.1@cspell/dict-html 4.0.5@cspell/dict-html-symbol-entities 4.0.0@cspell/dict-java 5.0.6@cspell/dict-k8s 1.0.2@cspell/dict-latex 4.0.0@cspell/dict-lorem-ipsum 4.0.0@cspell/dict-lua 4.0.3@cspell/dict-makefile 1.0.0@cspell/dict-node 4.0.3@cspell/dict-npm 5.0.15@cspell/dict-php 4.0.5@cspell/dict-powershell 5.0.3@cspell/dict-public-licenses 2.0.5@cspell/dict-python 4.1.11@cspell/dict-r 2.0.1@cspell/dict-ruby 5.0.2@cspell/dict-rust 4.0.2@cspell/dict-scala 5.0.0@cspell/dict-software-terms 3.3.16@cspell/dict-sql 2.1.3@cspell/dict-svelte 1.0.2@cspell/dict-swift 2.0.1@cspell/dict-typescript 3.1.2@cspell/dict-vue 3.0.0@manypkg/cli 0.21.2@manypkg/get-packages 2.2.0@size-limit/file 11.0.2@size-limit/time 11.0.2alex 11.0.1check-dependency-version-consistency 4.1.0child_process 1.0.2commander 11.1.0cspell 8.3.2dpdm 3.14.0eslint 8.56.0prettier-plugin-tailwindcss 0.5.11rehype-parse 9.0.0rehype-retext 4.0.0remark-frontmatter 5.0.0remark-gfm 4.0.0remark-mdx 3.0.0remark-parse 11.0.0remark-retext 6.0.0retext-english 5.0.0retext-equality 7.0.0retext-profanities 8.0.0size-limit 11.0.2spawndamnit 2.0.0supports-color 9.4.0unified 11.0.4unified-diff 5.0.0unified-engine 11.2.0vfile-reporter ^8.1.0@types/eslint 8.44.6packages/testing-tools/package.json
@nx/jest 18.0.4jest 29.7.0jest-resolve ^29.7.0@nx/jest 18.0.4jest 29.7.0packages/tsconfig/package.json
@total-typescript/ts-reset 0.5.1@tsconfig/recommended 1.0.3packages/workspace-tools/package.json
@anatine/esbuild-decorators 0.2.19@microsoft/api-extractor 7.40.1@nx/devkit 18.0.4@nx/esbuild 18.0.4@rollup/plugin-json 6.1.0bundle-require ^4.0.2decky 1.1.1esbuild-plugin-environment 0.3.0esbuild-plugin-handlebars 1.0.2esbuild-plugin-pino 2.1.0fs-extra 11.2.0glob 10.3.10npm-run-path 5.2.0pkg-types ^1.0.3prettier 3.2.5prettier-plugin-packagejson 2.4.9rollup 4.10.0rollup-plugin-dts 6.1.0semver 7.5.4terser 5.24.0typia 5.4.1zod 3.22.4zod-to-json-schema 3.22.3
.github/.nvmrc
node 21.0.0packages/workspace-tools/src/generators/preset/files/.github/.nvmrc
Vulnerable Library - @storm-software/linting-tools-1.38.20.tgzPath to dependency file: /package.json
Path to vulnerable library: /node_modules/.pnpm/[email protected]/node_modules/ip/package.json
Found in HEAD commit: 09fe5cb279f44e9169bef8169d2aa15fbfd2d8c8
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (@storm-software/linting-tools version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-42282 | Critical |
9.8 | ip-1.1.8.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-42282[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/.pnpm/[email protected]/node_modules/ip/package.json
Dependency Hierarchy:
Found in HEAD commit: 09fe5cb279f44e9169bef8169d2aa15fbfd2d8c8
Found in base branch: main
An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function.
Publish Date: 2024-02-08
URL: CVE-2023-42282
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-42282
Release Date: 2024-02-08
Fix Resolution: ip - 2.0.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - verdaccio-5.27.0.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: 914859895a632bb4e1fa76e3ef8d5d096d9d3e1d
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (verdaccio version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-28155 |  Medium |
6.1 | request-2.88.2.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-28155Simplified HTTP request client.
Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 914859895a632bb4e1fa76e3ef8d5d096d9d3e1d
Found in base branch: main
The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).NOTE: The request package is no longer supported by the maintainer.
Publish Date: 2023-03-16
URL: CVE-2023-28155
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-p8p7-x288-28g6
Release Date: 2023-03-16
Fix Resolution: @cypress/request - 3.0.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - linting-tools-1.41.4.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: 6a1866e66bebd3aae938df5f3d6a4fc8aafecee0
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (linting-tools version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-42282 | Critical |
9.8 | detected in multiple dependencies | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-42282
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 6a1866e66bebd3aae938df5f3d6a4fc8aafecee0
Found in base branch: main
An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function.
Publish Date: 2024-02-08
URL: CVE-2023-42282
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-78xj-cgh5-2h22
Release Date: 2024-02-08
Fix Resolution: ip - 1.1.9,2.0.1
Step up your Open Source Security Game with Mend here
https://github.com/storm-software/storm-ops?tab=readme-ov-file#readme
No response
Vulnerable Library - linting-tools-1.39.1.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: 3f61e534780985b674e93ddb5388365a1e2ad271
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (linting-tools version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-42282 | Critical |
9.8 | ip-1.1.8.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-42282[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 3f61e534780985b674e93ddb5388365a1e2ad271
Found in base branch: main
An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function.
Publish Date: 2024-02-08
URL: CVE-2023-42282
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-42282
Release Date: 2024-02-08
Fix Resolution: ip - 2.0.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - @storm-software/linting-tools-1.41.1.tgzPath to dependency file: /package.json
Path to vulnerable library: /node_modules/.pnpm/[email protected]/node_modules/ip/package.json
Found in HEAD commit: b626bcf83378667aae820c1233ceb126da22a12d
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (@storm-software/linting-tools version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-42282 | Critical |
9.8 | detected in multiple dependencies | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-42282
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/.pnpm/[email protected]/node_modules/ip/package.json
Dependency Hierarchy:
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/.pnpm/[email protected]/node_modules/ip/package.json
Dependency Hierarchy:
Found in HEAD commit: b626bcf83378667aae820c1233ceb126da22a12d
Found in base branch: main
An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function.
Publish Date: 2024-02-08
URL: CVE-2023-42282
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-78xj-cgh5-2h22
Release Date: 2024-02-08
Fix Resolution: ip - 1.1.9,2.0.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - linting-tools-1.41.3.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: d7a966ff3d2b4d675e30b70210b7cb92f0af8477
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (linting-tools version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-42282 | Critical |
9.8 | detected in multiple dependencies | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-42282
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: d7a966ff3d2b4d675e30b70210b7cb92f0af8477
Found in base branch: main
An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function.
Publish Date: 2024-02-08
URL: CVE-2023-42282
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-78xj-cgh5-2h22
Release Date: 2024-02-08
Fix Resolution: ip - 1.1.9,2.0.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - @storm-software/linting-tools-1.41.4.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: 006776a81746ab5ebe0fe128c400e105e1141840
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (@storm-software/linting-tools version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-42282 | Critical |
9.8 | detected in multiple dependencies | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-42282
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 006776a81746ab5ebe0fe128c400e105e1141840
Found in base branch: main
An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function.
Publish Date: 2024-02-08
URL: CVE-2023-42282
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-78xj-cgh5-2h22
Release Date: 2024-02-08
Fix Resolution: ip - 1.1.9,2.0.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - linting-tools-1.42.0.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: a24174e30613cf48da1fbdd12e178a7574b6f2c7
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (linting-tools version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-42282 | Critical |
9.8 | detected in multiple dependencies | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-42282
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: a24174e30613cf48da1fbdd12e178a7574b6f2c7
Found in base branch: main
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
Publish Date: 2024-02-08
URL: CVE-2023-42282
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-78xj-cgh5-2h22
Release Date: 2024-02-08
Fix Resolution: ip - 1.1.9,2.0.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - @storm-software/linting-tools-1.42.0.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: 38ba1a33c541e2ff282baeb4117a221c02bdeac6
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (@storm-software/linting-tools version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-42282 | Critical |
9.8 | detected in multiple dependencies | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-42282
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 38ba1a33c541e2ff282baeb4117a221c02bdeac6
Found in base branch: main
An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function.
Publish Date: 2024-02-08
URL: CVE-2023-42282
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-78xj-cgh5-2h22
Release Date: 2024-02-08
Fix Resolution: ip - 1.1.9,2.0.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - linting-tools-1.41.0.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: cb5c820cd54c5cd578ea3eedf654bad6f6758932
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (linting-tools version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-42282 | Critical |
9.8 | detected in multiple dependencies | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-42282
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: cb5c820cd54c5cd578ea3eedf654bad6f6758932
Found in base branch: main
An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function.
Publish Date: 2024-02-08
URL: CVE-2023-42282
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-78xj-cgh5-2h22
Release Date: 2024-02-08
Fix Resolution: ip - 1.1.9,2.0.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - @storm-software/linting-tools-1.39.1.tgzPath to dependency file: /package.json
Path to vulnerable library: /node_modules/.pnpm/[email protected]/node_modules/ip/package.json
Found in HEAD commit: ffe79b6facec3cb5d9f7829dfea49d7c25b459a6
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (@storm-software/linting-tools version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-42282 | Critical |
9.8 | ip-1.1.8.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-42282[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/.pnpm/[email protected]/node_modules/ip/package.json
Dependency Hierarchy:
Found in HEAD commit: ffe79b6facec3cb5d9f7829dfea49d7c25b459a6
Found in base branch: main
An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function.
Publish Date: 2024-02-08
URL: CVE-2023-42282
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-42282
Release Date: 2024-02-08
Fix Resolution: ip - 2.0.0
Step up your Open Source Security Game with Mend here
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.