Skip to content

react-chartjs-2-2.7.4.tgz: 5 vulnerabilities (highest severity is: 8.3) [master] #137

New issue
New issue
Open
Open
react-chartjs-2-2.7.4.tgz: 5 vulnerabilities (highest severity is: 8.3) [master]#137
@mend-developer-platform-dev

Description

@mend-developer-platform-dev
mend-developer-platform-dev
bot
opened on Sep 30, 2025
📂 Vulnerable Library - react-chartjs-2-2.7.4.tgz

react-chartjs-2

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/react-chartjs-2/package.json

Findings

Finding Severity 🎯 CVSS Exploit Maturity EPSS Library Type Fixed in Remediation Available Reachability
CVE-2020-8203 🔴 High 8.3 Not Defined 2.4% lodash-4.17.10.tgz Direct lodash - 4.17.19,lodash-es - 4.17.20 ✅
CVE-2020-7746 🔴 High 7.7 Proof of concept < 1% chart.js-2.7.2.tgz Direct chart.js - 2.9.4 ✅
CVE-2021-23337 🔴 High 7.3 Proof of concept < 1% lodash-4.17.10.tgz Direct lodash-es - 4.17.21,lodash - 4.17.21 ✅
CVE-2019-1010266 🔴 High 7.1 Not Defined < 1% lodash-4.17.10.tgz Direct lodash-amd - 4.17.11,lodash-es - 4.17.11,lodash - 4.17.11 ✅
CVE-2020-28500 🟠 Medium 5.5 Proof of concept < 1% lodash-4.17.10.tgz Direct lodash - 4.17.21,lodash-es - 4.17.21 ✅

Details

🔴CVE-2020-8203

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • html-webpack-plugin-3.2.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-chartjs-2-2.7.4.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • redux-form-7.4.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-core-6.26.3.tgz (Root Library)

    • babel-generator-6.26.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • lint-staged-7.2.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-5.4.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • concurrently-4.0.1.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • webpack-cli-3.1.0.tgz (Root Library)

    • inquirer-6.0.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • node-sass-4.9.3.tgz (Root Library)

    • sass-graph-2.2.4.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-cli-6.26.0.tgz (Root Library)

    • babel-register-6.26.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-eslint-8.2.6.tgz (Root Library)

    • traverse-7.0.0-beta.44.tgz
      • generator-7.0.0-beta.44.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-preset-env-1.7.0.tgz (Root Library)

    • babel-plugin-transform-es2015-sticky-regex-6.24.1.tgz
      • babel-helper-regex-6.26.0.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-plugin-import-2.14.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • winston-3.0.0.tgz (Root Library)

    • async-2.6.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-redux-5.0.7.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: Jul 15, 2020 04:10 PM

URL: CVE-2020-8203

Threat Assessment

Exploit Maturity:Not Defined

EPSS:2.4%

Score: 8.3

Suggested Fix

Type: Upgrade version

Origin: GHSA-p6mc-m468-83gw

Release Date: Jul 15, 2020 04:10 PM

Fix Resolution : lodash - 4.17.19,lodash-es - 4.17.20

🔴CVE-2020-7746

Vulnerable Library - chart.js-2.7.2.tgz

Simple HTML5 charts using the canvas element.

Library home page: https://registry.npmjs.org/chart.js/-/chart.js-2.7.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/chart.js/package.json

Dependency Hierarchy:

  • react-chartjs-2-2.7.4.tgz (Root Library)

    • ❌ chart.js-2.7.2.tgz (Vulnerable Library)

  • ❌ chart.js-2.7.2.tgz (Vulnerable Library)

Vulnerability Details

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.

Publish Date: Oct 29, 2020 08:05 AM

URL: CVE-2020-7746

Threat Assessment

Exploit Maturity:Proof of concept

EPSS:< 1%

Score: 7.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-h68q-55jf-x68w

Release Date: Oct 29, 2020 08:05 AM

Fix Resolution : chart.js - 2.9.4

🔴CVE-2021-23337

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • html-webpack-plugin-3.2.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-chartjs-2-2.7.4.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • redux-form-7.4.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-core-6.26.3.tgz (Root Library)

    • babel-generator-6.26.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • lint-staged-7.2.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-5.4.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • concurrently-4.0.1.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • webpack-cli-3.1.0.tgz (Root Library)

    • inquirer-6.0.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • node-sass-4.9.3.tgz (Root Library)

    • sass-graph-2.2.4.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-cli-6.26.0.tgz (Root Library)

    • babel-register-6.26.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-eslint-8.2.6.tgz (Root Library)

    • traverse-7.0.0-beta.44.tgz
      • generator-7.0.0-beta.44.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-preset-env-1.7.0.tgz (Root Library)

    • babel-plugin-transform-es2015-sticky-regex-6.24.1.tgz
      • babel-helper-regex-6.26.0.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-plugin-import-2.14.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • winston-3.0.0.tgz (Root Library)

    • async-2.6.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-redux-5.0.7.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: Feb 15, 2021 12:15 PM

URL: CVE-2021-23337

Threat Assessment

Exploit Maturity:Proof of concept

EPSS:< 1%

Score: 7.3

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: Feb 15, 2021 12:15 PM

Fix Resolution : lodash-es - 4.17.21,lodash - 4.17.21

🔴CVE-2019-1010266

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • html-webpack-plugin-3.2.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-chartjs-2-2.7.4.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • redux-form-7.4.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-core-6.26.3.tgz (Root Library)

    • babel-generator-6.26.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • lint-staged-7.2.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-5.4.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • concurrently-4.0.1.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • webpack-cli-3.1.0.tgz (Root Library)

    • inquirer-6.0.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • node-sass-4.9.3.tgz (Root Library)

    • sass-graph-2.2.4.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-cli-6.26.0.tgz (Root Library)

    • babel-register-6.26.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-eslint-8.2.6.tgz (Root Library)

    • traverse-7.0.0-beta.44.tgz
      • generator-7.0.0-beta.44.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-preset-env-1.7.0.tgz (Root Library)

    • babel-plugin-transform-es2015-sticky-regex-6.24.1.tgz
      • babel-helper-regex-6.26.0.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-plugin-import-2.14.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • winston-3.0.0.tgz (Root Library)

    • async-2.6.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-redux-5.0.7.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: Jul 17, 2019 08:25 PM

URL: CVE-2019-1010266

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 7.1

Suggested Fix

Type: Upgrade version

Origin: GHSA-x5rq-j2xg-h7qm

Release Date: Jul 17, 2019 08:25 PM

Fix Resolution : lodash-amd - 4.17.11,lodash-es - 4.17.11,lodash - 4.17.11

🟠CVE-2020-28500

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • html-webpack-plugin-3.2.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-chartjs-2-2.7.4.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • redux-form-7.4.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-core-6.26.3.tgz (Root Library)

    • babel-generator-6.26.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • lint-staged-7.2.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-5.4.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • concurrently-4.0.1.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • webpack-cli-3.1.0.tgz (Root Library)

    • inquirer-6.0.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • node-sass-4.9.3.tgz (Root Library)

    • sass-graph-2.2.4.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-cli-6.26.0.tgz (Root Library)

    • babel-register-6.26.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-eslint-8.2.6.tgz (Root Library)

    • traverse-7.0.0-beta.44.tgz
      • generator-7.0.0-beta.44.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-preset-env-1.7.0.tgz (Root Library)

    • babel-plugin-transform-es2015-sticky-regex-6.24.1.tgz
      • babel-helper-regex-6.26.0.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-plugin-import-2.14.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • winston-3.0.0.tgz (Root Library)

    • async-2.6.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-redux-5.0.7.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: Feb 15, 2021 11:10 AM

URL: CVE-2020-28500

Threat Assessment

Exploit Maturity:Proof of concept

EPSS:< 1%

Score: 5.5

Suggested Fix

Type: Upgrade version

Origin: GHSA-29mw-wpgm-hmr9

Release Date: Feb 15, 2021 11:10 AM

Fix Resolution : lodash - 4.17.21,lodash-es - 4.17.21

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions