High Severity Vulnerability

[navjotjsingh]

This is the output of npm audit command.

                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ validator                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.22.1                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ hexo-migrator-rss                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ hexo-migrator-rss > feedparser > resanitize > validator      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/42                              │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ XSS Filter Bypass via Encoded URL                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ validator                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.0.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ hexo-migrator-rss                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ hexo-migrator-rss > feedparser > resanitize > validator      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/43                              │
└───────────────┴──────────────────────────────────────────────────────────────┘

And this is the contents of the /var/www/html/node_modules/hexo-migrator-rss/package.json

{
  "_from": "hexo-migrator-rss",
  "_id": "[email protected]",
  "_inBundle": false,
  "_integrity": "sha512-A1ykFSEL6NyOlzX5ayDjikNu/DoL2ikPNg+N1JZXUZ4hAcgTrOSRwSPBMigJK0z8AjGyrvv+8hXz8w2tQ5J3MQ==",
  "_location": "/hexo-migrator-rss",
  "_phantomChildren": {},
  "_requested": {
    "type": "tag",
    "registry": true,
    "raw": "hexo-migrator-rss",
    "name": "hexo-migrator-rss",
    "escapedName": "hexo-migrator-rss",
    "rawSpec": "",
    "saveSpec": null,
    "fetchSpec": "latest"
  },
  "_requiredBy": [
    "#USER",
    "/"
  ],
  "_resolved": "https://registry.npmjs.org/hexo-migrator-rss/-/hexo-migrator-rss-0.1.4.tgz",
  "_shasum": "636156cb031a49773599a845cb230e08a9c06297",
  "_spec": "hexo-migrator-rss",
  "_where": "/var/www/diary/html",
  "author": {
    "name": "Tommy Chen",
    "email": "[email protected]",
    "url": "http://zespia.tw"
  },
  "bugs": {
    "url": "https://github.com/hexojs/hexo-migrator-rss/issues"
  },
  "bundleDependencies": false,
  "dependencies": {
    "async": "^0.9.0",
    "chai": "^3.4.1",
    "feedparser": "0.16.6",
    "request": "^2.36.0",
    "to-markdown": "0.0.1",
    "url": "^0.11.0"
  },
  "deprecated": false,
  "description": "RSS migrator plugin for Hexo",
  "homepage": "https://github.com/hexojs/hexo-migrator-rss#readme",
  "keywords": [
    "hexo",
    "rss",
    "feed",
    "atom",
    "migrator"
  ],
  "license": {
    "type": "MIT",
    "url": "https://raw.github.com/hexojs/hexo-migrator-rss/master/LICENSE"
  },
  "main": "index",
  "maintainers": [
    {
      "name": "Abner Chou",
      "email": "[email protected]",
      "url": "http://abnerchou.me"
    }
  ],
  "name": "hexo-migrator-rss",
  "repository": {
    "type": "git",
    "url": "git+https://github.com/hexojs/hexo-migrator-rss.git"
  },
  "scripts": {
    "test": "mocha test"
  },
  "version": "0.1.4"
}

I even reinstalled the plugin the issue remains.

[curbengh]

Already fixed in the master branch. We intend to publish a new version.

[curbengh]

#62
#34