react-scripts-4.0.3.tgz: 107 vulnerabilities (highest severity is: 10.0) reachable

[mend-for-github-com]

Vulnerable Library - react-scripts-4.0.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Vulnerabilities

Vulnerability	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (react-scripts version)	Remediation Possible**	Reachability
CVE-2023-26159	High	7.3	Proof of concept	0.1%	follow-redirects-1.13.3.tgz	Transitive	5.0.0	✅	Reachable
CVE-2025-13465	High	7.2	Not Defined	0.1%	lodash-4.17.21.tgz	Transitive	N/A*	❌	Reachable
CVE-2024-28849	Medium	6.5	Not Defined	0.70000005%	follow-redirects-1.13.3.tgz	Transitive	5.0.0	✅	Reachable
CVE-2022-0155	Medium	6.5	Not Defined	0.9%	follow-redirects-1.13.3.tgz	Transitive	5.0.0	✅	Reachable
CVE-2022-0536	Low	2.6	Not Defined	0.1%	follow-redirects-1.13.3.tgz	Transitive	5.0.0	✅	Reachable
CVE-2025-6545	Critical	10.0	Not Defined	0.1%	pbkdf2-3.1.1.tgz	Transitive	5.0.0	✅	Unreachable
WS-2021-0153	Critical	9.8	Not Defined		ejs-2.7.4.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2023-42282	Critical	9.8	Not Defined	0.5%	ip-1.1.5.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-37601	Critical	9.8	Not Defined	19.300001%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2022-29078	Critical	9.8	Not Defined	93.5%	ejs-2.7.4.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-42740	Critical	9.8	Not Defined	5.4%	shell-quote-1.7.2.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-3918	Critical	9.8	Not Defined	1.2%	json-schema-0.2.3.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-3757	Critical	9.8	Not Defined	0.6%	immer-8.0.1.tgz	Transitive	N/A*	❌	Unreachable
CVE-2023-45133	Critical	9.3	Not Defined	0.1%	traverse-7.13.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-48949	Critical	9.1	Not Defined	0.2%	elliptic-6.5.4.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-29415	Critical	9.1	Not Defined	87.9%	ip-1.1.5.tgz	Transitive	N/A*	❌	Unreachable
CVE-2022-0686	Critical	9.1	Not Defined	0.1%	url-parse-1.5.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2026-23950	High	8.8	Not Defined	0.0%	tar-6.1.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-33883	High	8.8	Not Defined	1.3000001%	ejs-2.7.4.tgz	Transitive	N/A*	❌	Unreachable
CVE-2025-9288	High	8.7	Not Defined	0.0%	sha.js-2.4.11.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2025-9287	High	8.7	Not Defined	0.1%	cipher-base-1.0.4.tgz	Transitive	N/A*	❌	Unreachable
CVE-2025-7783	High	8.7	Not Defined	0.1%	form-data-2.3.3.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2025-12816	High	8.6	Not Defined	0.1%	node-forge-0.10.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-37713	High	8.2	Not Defined	0.6%	tar-6.1.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-37712	High	8.2	Not Defined	0.0%	tar-6.1.0.tgz	Transitive	N/A*	❌	Unreachable
CVE-2021-37701	High	8.2	Not Defined	0.0%	tar-6.1.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-32804	High	8.2	Not Defined	85.0%	tar-6.1.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-32803	High	8.2	Not Defined	0.2%	tar-6.1.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-1650	High	8.1	Not Defined	1.1%	eventsource-1.0.7.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-43138	High	7.8	Not Defined	0.70000005%	async-2.6.3.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-23386	High	7.7	Not Defined	1.1%	dns-packet-1.3.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2025-66031	High	7.5	Not Defined	0.1%	node-forge-0.10.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-4068	High	7.5	Not Defined	0.2%	detected in multiple dependencies	Transitive	N/A*	❌	Unreachable
CVE-2024-37890	High	7.5	Not Defined	0.5%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2024-21538	High	7.5	Proof of concept	0.1%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2024-21536	High	7.5	Proof of concept	0.4%	http-proxy-middleware-0.19.1.tgz	Transitive	N/A*	❌	Unreachable
CVE-2022-38900	High	7.5	Not Defined	0.5%	decode-uri-component-0.2.0.tgz	Transitive	N/A*	❌	Unreachable
CVE-2022-37603	High	7.5	Not Defined	1.0%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2022-37599	High	7.5	Not Defined	3.2%	detected in multiple dependencies	Transitive	N/A*	❌	Unreachable
CVE-2022-3517	High	7.5	Not Defined	0.5%	minimatch-3.0.4.tgz	Transitive	N/A*	❌	Unreachable
CVE-2022-24999	High	7.5	Not Defined	1.4000001%	qs-6.5.2.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-24772	High	7.5	Not Defined	0.2%	node-forge-0.10.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-24771	High	7.5	Not Defined	0.1%	node-forge-0.10.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-3807	High	7.5	Not Defined	0.2%	detected in multiple dependencies	Transitive	N/A*	❌	Unreachable
CVE-2021-3803	High	7.5	Not Defined	0.1%	nth-check-1.0.2.tgz	Transitive	N/A*	❌	Unreachable
CVE-2021-3777	High	7.5	Not Defined	0.2%	tmpl-1.0.4.tgz	Transitive	N/A*	❌	Unreachable
CVE-2021-29059	High	7.5	Not Defined	2.8000002%	is-svg-3.0.0.tgz	Transitive	N/A*	❌	Unreachable
CVE-2021-28092	High	7.5	Not Defined	0.70000005%	is-svg-3.0.0.tgz	Transitive	N/A*	❌	Unreachable
CVE-2021-27290	High	7.5	Not Defined	2.6000001%	ssri-6.0.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-23424	High	7.5	Proof of concept	0.2%	ansi-html-0.0.7.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-29180	High	7.4	Not Defined	2.5%	webpack-dev-middleware-3.7.3.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-23337	High	7.2	Proof of concept	0.70000005%	lodash.template-4.5.0.tgz	Transitive	N/A*	❌	Unreachable
CVE-2026-23745	High	7.1	Not Defined	0.0%	tar-6.1.0.tgz	Transitive	N/A*	❌	Unreachable
CVE-2022-46175	High	7.1	Not Defined	39.899998%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2025-6547	Medium	6.8	Not Defined	0.1%	pbkdf2-3.1.1.tgz	Transitive	5.0.0	✅	Unreachable
WS-2022-0008	Medium	6.6	Not Defined		node-forge-0.10.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2025-30360	Medium	6.5	Not Defined	0.0%	webpack-dev-server-3.11.1.tgz	Transitive	N/A*	❌	Unreachable
CVE-2024-28863	Medium	6.5	Not Defined	0.5%	tar-6.1.0.tgz	Transitive	N/A*	❌	Unreachable
CVE-2023-46234	Medium	6.5	Not Defined	0.5%	browserify-sign-4.2.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2023-26136	Medium	6.5	Proof of concept	6.8999996%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2022-0691	Medium	6.5	Not Defined	0.1%	url-parse-1.5.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-0639	Medium	6.5	Not Defined	0.0%	url-parse-1.5.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-43788	Medium	6.4	Not Defined	1.8%	webpack-4.44.2.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2025-27789	Medium	6.2	Not Defined	0.1%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2024-47068	Medium	6.1	Not Defined	2.1%	rollup-1.32.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2023-28155	Medium	6.1	Not Defined	0.6%	request-2.88.2.tgz	Transitive	N/A*	❌	Unreachable
CVE-2022-0122	Medium	6.1	Not Defined	0.2%	node-forge-0.10.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2025-14505	Medium	5.6	Not Defined	0.0%	elliptic-6.5.4.tgz	Transitive	N/A*	❌	Unreachable
CVE-2021-23436	Medium	5.6	Proof of concept	0.2%	immer-8.0.1.tgz	Transitive	N/A*	❌	Unreachable
CVE-2024-11831	Medium	5.4	Not Defined	1.7%	detected in multiple dependencies	Transitive	N/A*	❌	Unreachable
CVE-2025-66030	Medium	5.3	Not Defined	0.0%	node-forge-0.10.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2025-64718	Medium	5.3	Not Defined	0.0%	js-yaml-3.14.1.tgz	Transitive	N/A*	❌	Unreachable
CVE-2025-30359	Medium	5.3	Not Defined	0.1%	webpack-dev-server-3.11.1.tgz	Transitive	N/A*	❌	Unreachable
CVE-2024-42461	Medium	5.3	Not Defined	6.6%	elliptic-6.5.4.tgz	Transitive	N/A*	❌	Unreachable
CVE-2024-42460	Medium	5.3	Not Defined	0.2%	elliptic-6.5.4.tgz	Transitive	N/A*	❌	Unreachable
CVE-2024-42459	Medium	5.3	Not Defined	0.1%	elliptic-6.5.4.tgz	Transitive	N/A*	❌	Unreachable
CVE-2024-4067	Medium	5.3	Not Defined	0.1%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2023-44270	Medium	5.3	Not Defined	0.2%	detected in multiple dependencies	Transitive	N/A*	❌	Unreachable
CVE-2023-26115	Medium	5.3	Proof of concept	0.0%	word-wrap-1.2.3.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-25883	Medium	5.3	Proof of concept	0.6%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2022-25858	Medium	5.3	Not Defined	3.6%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2022-24773	Medium	5.3	Not Defined	0.1%	node-forge-0.10.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-0512	Medium	5.3	Not Defined	0.0%	url-parse-1.5.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-3664	Medium	5.3	Not Defined	0.3%	url-parse-1.5.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-32640	Medium	5.3	Not Defined	0.5%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2021-23382	Medium	5.3	Not Defined	0.1%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2021-23368	Medium	5.3	Not Defined	0.3%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2021-23364	Medium	5.3	Proof of concept	0.3%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2021-23362	Medium	5.3	Proof of concept	0.6%	hosted-git-info-2.8.4.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-23343	Medium	5.3	Not Defined	0.3%	path-parse-1.0.6.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2020-28469	Medium	5.3	Not Defined	0.9%	glob-parent-3.1.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-48948	Medium	4.8	Not Defined	0.1%	elliptic-6.5.4.tgz	Transitive	N/A*	❌	Unreachable
CVE-2024-55565	Medium	4.3	Not Defined	0.1%	nanoid-3.1.22.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2025-32997	Medium	4.0	Not Defined	0.1%	http-proxy-middleware-0.19.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2025-32996	Medium	4.0	Not Defined	0.2%	http-proxy-middleware-0.19.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-23566	Medium	4.0	Proof of concept	0.0%	nanoid-3.1.22.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2025-15284	Low	3.7	Not Defined	0.1%	qs-6.5.2.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2025-7339	Low	3.4	Not Defined	0.0%	on-headers-1.0.2.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2025-59437	Low	3.2	Not Defined	0.0%	ip-1.1.5.tgz	Transitive	N/A*	❌	Unreachable
CVE-2025-59436	Low	3.2	Not Defined	0.0%	ip-1.1.5.tgz	Transitive	N/A*	❌	Unreachable
CVE-2025-5889	Low	3.1	Proof of concept	0.0%	brace-expansion-1.1.11.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-27088	Low	0.0	Not Defined	1.8%	es5-ext-0.10.53.tgz	Transitive	N/A*	❌	Unreachable
WS-2025-0006	High	8.6	Not Defined		elliptic-6.5.4.tgz	Transitive	5.0.0	✅
CVE-2026-24842	High	8.2	Not Defined	0.0%	tar-6.1.0.tgz	Transitive	5.0.0	✅
CVE-2025-69873	High	7.5	Not Defined		detected in multiple dependencies	Transitive	N/A*	❌
CVE-2025-50537	Medium	5.5	Not Defined	0.0%	eslint-7.22.0.tgz	Transitive	N/A*	❌
CVE-2026-2391	Low	3.7	Not Defined		qs-6.5.2.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (7 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2023-26159

Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • webpack-dev-server-3.11.1.tgz
    • http-proxy-middleware-0.19.1.tgz
      • http-proxy-1.18.1.tgz
        • ❌ follow-redirects-1.13.3.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

insights-dashboard-sample-0.1.1/src/index.js (Application)
  -> axios-0.21.1/index.js (Extension)
   -> axios-0.21.1/lib/axios.js (Extension)
    -> axios-0.21.1/lib/defaults.js (Extension)
     -> axios-0.21.1/lib/adapters/http.js (Extension)
      -> ❌ follow-redirects-1.13.3/index.js (Vulnerable Component)

Vulnerability Details

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Publish Date: 2024-01-02

URL: CVE-2023-26159

Threat Assessment

Exploit Maturity: Proof of concept

EPSS: 0.1%

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159

Release Date: 2024-01-02

Fix Resolution (follow-redirects): 1.15.4

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2025-13465

Vulnerable Library - lodash-4.17.21.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • html-webpack-plugin-4.5.0.tgz
    • pretty-error-2.1.2.tgz
      • ❌ lodash-4.17.21.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

insights-dashboard-sample-0.1.1/src/charts/UsageByParticipantTier.js (Application)
  -> ❌ lodash-4.17.21/lodash.js (Vulnerable Component)

Vulnerability Details

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.
The issue permits deletion of properties but does not allow overwriting their original behavior.
This issue is patched on 4.17.23

Publish Date: 2026-01-21

URL: CVE-2025-13465

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xxjr-mmjv-4gpg

Release Date: 2026-01-21

Fix Resolution: lodash-amd - 4.17.23,lodash - 4.17.23,lodash-es - 4.17.23

CVE-2024-28849

Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • webpack-dev-server-3.11.1.tgz
    • http-proxy-middleware-0.19.1.tgz
      • http-proxy-1.18.1.tgz
        • ❌ follow-redirects-1.13.3.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

insights-dashboard-sample-0.1.1/src/index.js (Application)
  -> axios-0.21.1/index.js (Extension)
   -> axios-0.21.1/lib/axios.js (Extension)
    -> axios-0.21.1/lib/defaults.js (Extension)
     -> axios-0.21.1/lib/adapters/http.js (Extension)
      -> ❌ follow-redirects-1.13.3/index.js (Vulnerable Component)

Vulnerability Details

follow-redirects is an open source, drop-in replacement for Node's "http" and "https" modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2024-03-14

URL: CVE-2024-28849

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.70000005%

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cxjh-pqwp-8mfp

Release Date: 2024-03-14

Fix Resolution (follow-redirects): 1.15.6

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0155

Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • webpack-dev-server-3.11.1.tgz
    • http-proxy-middleware-0.19.1.tgz
      • http-proxy-1.18.1.tgz
        • ❌ follow-redirects-1.13.3.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

insights-dashboard-sample-0.1.1/src/index.js (Application)
  -> axios-0.21.1/index.js (Extension)
   -> axios-0.21.1/lib/axios.js (Extension)
    -> axios-0.21.1/lib/defaults.js (Extension)
     -> axios-0.21.1/lib/adapters/http.js (Extension)
      -> ❌ follow-redirects-1.13.3/index.js (Vulnerable Component)

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.9%

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution (follow-redirects): 1.14.7

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0536

Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • webpack-dev-server-3.11.1.tgz
    • http-proxy-middleware-0.19.1.tgz
      • http-proxy-1.18.1.tgz
        • ❌ follow-redirects-1.13.3.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

insights-dashboard-sample-0.1.1/src/index.js (Application)
  -> axios-0.21.1/index.js (Extension)
   -> axios-0.21.1/lib/axios.js (Extension)
    -> axios-0.21.1/lib/defaults.js (Extension)
     -> axios-0.21.1/lib/adapters/http.js (Extension)
      -> ❌ follow-redirects-1.13.3/index.js (Vulnerable Component)

Vulnerability Details

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2022-02-09

URL: CVE-2022-0536

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (2.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Adjacent
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution (follow-redirects): 1.14.8

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2025-6545

Vulnerable Library - pbkdf2-3.1.1.tgz

This library provides the functionality of PBKDF2 with the ability to use any supported hashing algorithm returned from crypto.getHashes()

Library home page: https://registry.npmjs.org/pbkdf2/-/pbkdf2-3.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • webpack-4.44.2.tgz
    • node-libs-browser-2.2.1.tgz
      • crypto-browserify-3.12.0.tgz
        • ❌ pbkdf2-3.1.1.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js.
This issue affects pbkdf2: from 3.0.10 through 3.1.2.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-06-23

URL: CVE-2025-6545

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (10.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h7cp-r72f-jxh6

Release Date: 2025-06-23

Fix Resolution (pbkdf2): 3.1.3

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

WS-2021-0153

Vulnerable Library - ejs-2.7.4.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • workbox-webpack-plugin-5.1.4.tgz
    • workbox-build-5.1.4.tgz
      • rollup-plugin-off-main-thread-1.4.2.tgz
        • ❌ ejs-2.7.4.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Arbitrary Code Injection vulnerability was found in ejs before 3.1.6. Caused by filename which isn't sanitized for display.

Publish Date: 2021-01-22

URL: WS-2021-0153

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-22

Fix Resolution (ejs): 3.1.6

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.