You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I was testing out scalibr on an older version of an app I was building where I knew about a few known vulnerabilities. I used scalibr to generate an SBOM which I then fed into osv-scanner.
I generated sboms at the root of the npm project.
I ran the following commands: scalibr -o spdx23-json=scalibr.spdx.json --root .
The results of osv scanner on scalibr.spdx.json was:
[email protected] has the following known vulnerabilities:
GHSA-93q8-gq69-wqmw: Inefficient Regular Expression Complexity in chalk/ansi-regex (https://osv.dev/GHSA-93q8-gq69-wqmw)
[email protected] has the following known vulnerabilities:
GHSA-93q8-gq69-wqmw: Inefficient Regular Expression Complexity in chalk/ansi-regex (https://osv.dev/GHSA-93q8-gq69-wqmw)
[email protected] has the following known vulnerabilities:
GHSA-67hx-6x53-jw92: Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code (https://osv.dev/GHSA-67hx-6x53-jw92)
[email protected] has the following known vulnerabilities:
GHSA-cwfw-4gq5-mrqx: Regular Expression Denial of Service (ReDoS) in braces (https://osv.dev/GHSA-cwfw-4gq5-mrqx)
GHSA-g95f-p29q-9xw4: Regular Expression Denial of Service in braces (https://osv.dev/GHSA-g95f-p29q-9xw4)
GHSA-grv7-fg5c-xmjg: Uncontrolled resource consumption in braces (https://osv.dev/GHSA-grv7-fg5c-xmjg)
[email protected] has the following known vulnerabilities:
GHSA-grv7-fg5c-xmjg: Uncontrolled resource consumption in braces (https://osv.dev/GHSA-grv7-fg5c-xmjg)
[email protected] has the following known vulnerabilities:
GHSA-grv7-fg5c-xmjg: Uncontrolled resource consumption in braces (https://osv.dev/GHSA-grv7-fg5c-xmjg)
[email protected] has the following known vulnerabilities:
GHSA-pxg6-pf52-xh8x: cookie accepts cookie name, path, and domain with out of bounds characters (https://osv.dev/GHSA-pxg6-pf52-xh8x)
[email protected] has the following known vulnerabilities:
GHSA-3xgq-45jj-v275: Regular Expression Denial of Service (ReDoS) in cross-spawn (https://osv.dev/GHSA-3xgq-45jj-v275)
[email protected] has the following known vulnerabilities:
GHSA-gxpj-cx7g-858c: Regular Expression Denial of Service in debug (https://osv.dev/GHSA-gxpj-cx7g-858c)
[email protected] has the following known vulnerabilities:
GHSA-w573-4hg7-7wgq: decode-uri-component vulnerable to Denial of Service (DoS) (https://osv.dev/GHSA-w573-4hg7-7wgq)
[email protected] has the following known vulnerabilities:
GHSA-ww39-953v-wcq6: glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex (https://osv.dev/GHSA-ww39-953v-wcq6)
[email protected] has the following known vulnerabilities:
GHSA-9c47-m6qq-7p4h: Prototype Pollution in JSON5 via Parse Method (https://osv.dev/GHSA-9c47-m6qq-7p4h)
[email protected] has the following known vulnerabilities:
GHSA-29mw-wpgm-hmr9: Regular Expression Denial of Service (ReDoS) in lodash (https://osv.dev/GHSA-29mw-wpgm-hmr9)
GHSA-35jh-r3h4-6jhm: Command Injection in lodash (https://osv.dev/GHSA-35jh-r3h4-6jhm)
[email protected] has the following known vulnerabilities:
GHSA-952p-6rrq-rcjv: Regular Expression Denial of Service (ReDoS) in micromatch (https://osv.dev/GHSA-952p-6rrq-rcjv)
[email protected] has the following known vulnerabilities:
GHSA-952p-6rrq-rcjv: Regular Expression Denial of Service (ReDoS) in micromatch (https://osv.dev/GHSA-952p-6rrq-rcjv)
[email protected] has the following known vulnerabilities:
GHSA-952p-6rrq-rcjv: Regular Expression Denial of Service (ReDoS) in micromatch (https://osv.dev/GHSA-952p-6rrq-rcjv)
[email protected] has the following known vulnerabilities:
GHSA-f8q6-p94x-37v3: minimatch ReDoS vulnerability (https://osv.dev/GHSA-f8q6-p94x-37v3)
[email protected] has the following known vulnerabilities:
GHSA-xvch-5gv4-984h: Prototype Pollution in minimist (https://osv.dev/GHSA-xvch-5gv4-984h)
[email protected] has the following known vulnerabilities:
GHSA-qrpm-p2h7-hrv2: Exposure of Sensitive Information to an Unauthorized Actor in nanoid (https://osv.dev/GHSA-qrpm-p2h7-hrv2)
GHSA-mwcw-c2x4-8c55: Predictable results in nanoid generation when given non-integer values (https://osv.dev/GHSA-mwcw-c2x4-8c55)
[email protected] has the following known vulnerabilities:
GHSA-mwcw-c2x4-8c55: Predictable results in nanoid generation when given non-integer values (https://osv.dev/GHSA-mwcw-c2x4-8c55)
[email protected] has the following known vulnerabilities:
GHSA-hj48-42vr-x3v9: Regular Expression Denial of Service in path-parse (https://osv.dev/GHSA-hj48-42vr-x3v9)
[email protected] has the following known vulnerabilities:
GHSA-rhx6-c78j-4q9w: Unpatched `path-to-regexp` ReDoS in 0.1.x (https://osv.dev/GHSA-rhx6-c78j-4q9w)
[email protected] has the following known vulnerabilities:
GHSA-gcx4-mw62-g8wm: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS (https://osv.dev/GHSA-gcx4-mw62-g8wm)
[email protected] has the following known vulnerabilities:
GHSA-64vr-g452-qvp3: Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS (https://osv.dev/GHSA-64vr-g452-qvp3)
GHSA-9cwx-2883-4wfx: Vite's `server.fs.deny` is bypassed when using `?import&raw` (https://osv.dev/GHSA-9cwx-2883-4wfx)
[email protected] has the following known vulnerabilities:
GHSA-5j4c-8p2g-v4jx: ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function (https://osv.dev/GHSA-5j4c-8p2g-v4jx)
The results on the npm generated sbom was:
[email protected] has the following known vulnerabilities:
GHSA-pxg6-pf52-xh8x: cookie accepts cookie name, path, and domain with out of bounds characters (https://osv.dev/GHSA-pxg6-pf52-xh8x)
[email protected] has the following known vulnerabilities:
GHSA-3xgq-45jj-v275: Regular Expression Denial of Service (ReDoS) in cross-spawn (https://osv.dev/GHSA-3xgq-45jj-v275)
[email protected] has the following known vulnerabilities:
GHSA-952p-6rrq-rcjv: Regular Expression Denial of Service (ReDoS) in micromatch (https://osv.dev/GHSA-952p-6rrq-rcjv)
[email protected] has the following known vulnerabilities:
GHSA-mwcw-c2x4-8c55: Predictable results in nanoid generation when given non-integer values (https://osv.dev/GHSA-mwcw-c2x4-8c55)
[email protected] has the following known vulnerabilities:
GHSA-rhx6-c78j-4q9w: Unpatched `path-to-regexp` ReDoS in 0.1.x (https://osv.dev/GHSA-rhx6-c78j-4q9w)
[email protected] has the following known vulnerabilities:
GHSA-64vr-g452-qvp3: Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS (https://osv.dev/GHSA-64vr-g452-qvp3)
GHSA-9cwx-2883-4wfx: Vite's `server.fs.deny` is bypassed when using `?import&raw` (https://osv.dev/GHSA-9cwx-2883-4wfx)
[email protected] has the following known vulnerabilities:
GHSA-5j4c-8p2g-v4jx: ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function (https://osv.dev/GHSA-5j4c-8p2g-v4jx)
For example scalibr thinks that [email protected] is installed but in my package.json, npm generated sbom, npm ls --all and just searching around in the files I could only find a reference to [email protected]. I can't tell if this is a false positive or if scalibr detected something npm itself didn't know about. If it was the latter I want to see if there's an easy way to understand what it did to detect it.
Here is the output of npm ls --all just for additional info:
To be sure before running the above tests I deleted node_modules folder inside the project and started over. And doing ripgrep I don't see any reference to the older version of lodash anywhere in the directory.
I was testing out scalibr on an older version of an app I was building where I knew about a few known vulnerabilities. I used
scalibr
to generate an SBOM which I then fed intoosv-scanner
.I generated sboms at the root of the npm project.
I ran the following commands:
scalibr -o spdx23-json=scalibr.spdx.json --root .
and
npm sbom --sbom-format spdx > npm.spdx.json
I have attached scalibr.spdx.json and npm.spdx.json.
npm.spdx.json
scalibr.spdx.json
The results of osv scanner on scalibr.spdx.json was:
The results on the npm generated sbom was:
For example scalibr thinks that
[email protected]
is installed but in my package.json, npm generated sbom,npm ls --all
and just searching around in the files I could only find a reference to[email protected]
. I can't tell if this is a false positive or if scalibr detected something npm itself didn't know about. If it was the latter I want to see if there's an easy way to understand what it did to detect it.Here is the output of
npm ls --all
just for additional info:The text was updated successfully, but these errors were encountered: