Feng Xiao

**Name of the Vulnerable Software and Affected Versions** git-commit-info versions prior to 2.0.2 **Description** The issue arises from the `gitCommitInfo()` method failing to sanitize its `commit` parameter, which later flows into a sensitive command execution API. This allows attackers to inject malicious commands once they control the hash content, potentially leading to command injection attacks. The vulnerability enables attackers to inject arguments to the git binary. **Recommendations** For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `gitCommitInfo()` function until a patch is available. Avoid using the `commit` parameter in sensitive command execution APIs until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** @pendo324/get-process-by-name versions all **Description** The issue is related to Arbitrary Code Execution due to improper sanitization of the `getProcessByName` function. This allows for potential code execution without proper validation. **Recommendations** For all versions, consider disabling the `getProcessByName` function until a patch is available to prevent potential Arbitrary Code Execution. Restrict access to this function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** mc-kill-port versions all **Description** The issue concerns Arbitrary Command Execution via the `kill` function due to missing sanitization of the `port` argument. This allows for potential exploitation. No information is provided about the estimated number of affected devices or real-world incidents. **Recommendations** For all versions, consider disabling the `kill` function as a temporary workaround until a patch is available. Restrict access to the `port` argument in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** @acrontum/filesystem-template versions prior to 0.0.2 **Description** The issue is related to Arbitrary Command Injection due to the `fetchRepo` API missing sanitization of the `href` field of external input. This allows for potential command injection attacks. **Recommendations** For versions prior to 0.0.2, update to version 0.0.2 or later to resolve the issue. As a temporary workaround, consider disabling the `fetchRepo` API or restricting access to it until a patch is available. Avoid using the `href` field in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** gatsby-plugin-mdx versions 3.0.0 through 3.15.1 gatsby-plugin-mdx versions 2.14.0 and earlier **Description** The gatsby-plugin-mdx plugin is vulnerable to Deserialization of Untrusted Data when passing input through to the `gray-matter` package, due to its default configurations that are missing input sanitization. This vulnerability can be exploited when passing input in both webpack (MDX files in `src/pages` or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). The injected JavaScript executes in the context of the build server. To exploit this vulnerability, untrusted/unsanitized input would need to be sourced or added into an MDX file. **Recommendations** For gatsby-plugin-mdx versions 3.0.0 through 3.15.1, update to version 3.15.2 or later. For gatsby-plugin-mdx versions 2.14.0 and earlier, update to version 2.14.1 or later. If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing. As a temporary workaround, consider disabling the `JSFrontmatterEngine` option to mitigate the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** post-loader versions 0.0.0 and later **Description** The issue concerns the post-loader package, which is a webpack loader for blog posts written in Markdown. It is vulnerable to Arbitrary Code Execution due to the use of a markdown parser in an unsafe way. This allows any JavaScript code inside the markdown input files to be evaluated and executed. **Recommendations** For post-loader versions 0.0.0 and later, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** object-extend versions 0.0.0 through 0.5.0 **Description** The issue concerns Prototype Pollution via the object-extend package. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For versions 0.0.0 through 0.5.0, update to a version later than 0.5.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** js-bson library version 1.1.3 and prior **Description** The issue is caused by incorrect parsing of certain JSON input, which may result in js-bson not correctly serializing BSON. This can cause unexpected application behavior, including data disclosure. **Recommendations** For js-bson library version 1.1.3 and prior, update to a version later than 1.1.3 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** valib versions through 2.0.0 **Description** The issue allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object. It is possible for a crafted payload to overwrite this function to manipulate the inspection results to bypass security checks. **Recommendations** For valib versions through 2.0.0, consider disabling the use of the `hasOwnProperty` function from unsafe user-input until a patch is available. Restrict access to the inspection functions provided by valib to minimize the risk of exploitation. Avoid using the `hasOwnProperty` function in the affected JavaScript objects until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** taffydb versions up to and including 2.7.3 **Description** The issue allows attackers to forge adding additional properties into user-input processed by taffy, which can allow access to any data items in the DB. Taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properties into user-input. If an index is found in the query, taffyDB will ignore other query conditions and directly return the indexed data item. Moreover, the internal index is in an easily-guessable format, such as `T000002R000001`. As such, attackers can use this vulnerability to access any data items in the DB. **Recommendations** For versions up to and including 2.7.3, consider disabling the use of internal indexes until a patch is available or an alternative solution is implemented. Restrict access to sensitive data items to minimize the risk of exploitation. Avoid using the taffydb module until a maintained successor or a fixed version is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** schema-inspector versions prior to 1.6.9 **Description** A maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` functions used within schema-inspector. **Recommendations** For versions prior to 1.6.9, update to version 1.6.9 or later to resolve the issue.