drizzle-kit-0.20.18.tgz: 3 vulnerabilities (highest severity is: 7.5)

[mend-bolt-for-github]

Vulnerable Library - drizzle-kit-0.20.18.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (drizzle-kit version)	Remediation Possible**
CVE-2024-21540	High	7.5	source-map-support-0.5.21.tgz	Transitive	N/A*	❌
CVE-2024-48913	Medium	5.9	hono-4.4.8.tgz	Transitive	0.21.0-178d0dc	❌
CVE-2024-43787	Medium	5.0	hono-4.4.8.tgz	Transitive	0.21.0-178d0dc	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-21540

Vulnerable Library - source-map-support-0.5.21.tgz

Fixes stack traces for files with source maps

Library home page: https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• drizzle-kit-0.20.18.tgz (Root Library)
  • esm-loader-2.6.5.tgz
    • core-utils-3.3.2.tgz
      • ❌ source-map-support-0.5.21.tgz (Vulnerable Library)

Found in base branch: dev

Vulnerability Details

All versions of the package source-map-support are vulnerable to Directory Traversal in the retrieveSourceMap function.

Publish Date: 2024-11-13

URL: CVE-2024-21540

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2024-48913

Vulnerable Library - hono-4.4.8.tgz

Library home page: https://registry.npmjs.org/hono/-/hono-4.4.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• drizzle-kit-0.20.18.tgz (Root Library)
  • ❌ hono-4.4.8.tgz (Vulnerable Library)

Found in base branch: dev

Vulnerability Details

Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. This can allow an attacker to bypass CSRF protection implemented with Hono CSRF middleware. Version 4.6.5 fixes this issue.

Publish Date: 2024-10-15

URL: CVE-2024-48913

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2234-fmw7-43wr

Release Date: 2024-10-15

Fix Resolution (hono): 4.6.8

Direct dependency fix Resolution (drizzle-kit): 0.21.0-178d0dc

Step up your Open Source Security Game with Mend here

CVE-2024-43787

Vulnerable Library - hono-4.4.8.tgz

Library home page: https://registry.npmjs.org/hono/-/hono-4.4.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• drizzle-kit-0.20.18.tgz (Root Library)
  • ❌ hono-4.4.8.tgz (Vulnerable Library)

Found in base branch: dev

Vulnerability Details

Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware using upper-case form-like MIME type. This vulnerability is fixed in 4.5.8.

Publish Date: 2024-08-22

URL: CVE-2024-43787

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rpfr-3m35-5vx5

Release Date: 2024-08-22

Fix Resolution (hono): 4.5.9

Direct dependency fix Resolution (drizzle-kit): 0.21.0-178d0dc

Step up your Open Source Security Game with Mend here