Skip to content

winston-3.0.0.tgz: 7 vulnerabilities (highest severity is: 8.5) [master] #145

New issue
New issue
Open
Open
winston-3.0.0.tgz: 7 vulnerabilities (highest severity is: 8.5) [master]#145
@mend-developer-platform-dev

Description

@mend-developer-platform-dev
mend-developer-platform-dev
bot
opened on Sep 30, 2025
📂 Vulnerable Library - winston-3.0.0.tgz

A logger for just about everything.

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/winston/package.json

Findings

Finding Severity 🎯 CVSS Exploit Maturity EPSS Library Type Fixed in Remediation Available Reachability
CVE-2021-43138 🔴 High 8.5 Not Defined < 1% async-2.6.1.tgz Transitive N/A ❌
CVE-2020-8203 🔴 High 8.3 Not Defined 2.4% lodash-4.17.10.tgz Direct lodash - 4.17.19,lodash-es - 4.17.20 ✅
WS-2021-0152 🔴 High 7.5 N/A N/A color-string-0.3.0.tgz Transitive N/A ❌
CVE-2021-23337 🔴 High 7.3 Proof of concept < 1% lodash-4.17.10.tgz Direct lodash-es - 4.17.21,lodash - 4.17.21 ✅
CVE-2019-1010266 🔴 High 7.1 Not Defined < 1% lodash-4.17.10.tgz Direct lodash-amd - 4.17.11,lodash-es - 4.17.11,lodash - 4.17.11 ✅
CVE-2021-29060 🟠 Medium 6.9 Not Defined < 1% color-string-0.3.0.tgz Transitive N/A ❌
CVE-2020-28500 🟠 Medium 5.5 Proof of concept < 1% lodash-4.17.10.tgz Direct lodash - 4.17.21,lodash-es - 4.17.21 ✅

Details

🔴CVE-2021-43138

Vulnerable Library - async-2.6.1.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/winston/node_modules/async/package.json

Dependency Hierarchy:

  • winston-3.0.0.tgz (Root Library)
    • ❌ async-2.6.1.tgz (Vulnerable Library)

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: Apr 06, 2022 12:00 AM

URL: CVE-2021-43138

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.5

Suggested Fix

Type: Upgrade version

Origin: GHSA-fwr7-v2mv-hh25

Release Date: Apr 06, 2022 12:00 AM

Fix Resolution : async - 2.6.4,async - 3.2.2

🔴CVE-2020-8203

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • html-webpack-plugin-3.2.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-chartjs-2-2.7.4.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • redux-form-7.4.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-core-6.26.3.tgz (Root Library)

    • babel-generator-6.26.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • lint-staged-7.2.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-5.4.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • concurrently-4.0.1.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • webpack-cli-3.1.0.tgz (Root Library)

    • inquirer-6.0.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • node-sass-4.9.3.tgz (Root Library)

    • sass-graph-2.2.4.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-cli-6.26.0.tgz (Root Library)

    • babel-register-6.26.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-eslint-8.2.6.tgz (Root Library)

    • traverse-7.0.0-beta.44.tgz
      • generator-7.0.0-beta.44.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-preset-env-1.7.0.tgz (Root Library)

    • babel-plugin-transform-es2015-sticky-regex-6.24.1.tgz
      • babel-helper-regex-6.26.0.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-plugin-import-2.14.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • winston-3.0.0.tgz (Root Library)

    • async-2.6.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-redux-5.0.7.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: Jul 15, 2020 04:10 PM

URL: CVE-2020-8203

Threat Assessment

Exploit Maturity:Not Defined

EPSS:2.4%

Score: 8.3

Suggested Fix

Type: Upgrade version

Origin: GHSA-p6mc-m468-83gw

Release Date: Jul 15, 2020 04:10 PM

Fix Resolution : lodash - 4.17.19,lodash-es - 4.17.20

🔴WS-2021-0152

Vulnerable Library - color-string-0.3.0.tgz

Parser and generator for CSS color strings

Library home page: https://registry.npmjs.org/color-string/-/color-string-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/color-string/package.json

Dependency Hierarchy:

  • winston-3.0.0.tgz (Root Library)
    • diagnostics-1.1.0.tgz
      • colorspace-1.0.1.tgz
        • color-0.8.0.tgz
          • ❌ color-string-0.3.0.tgz (Vulnerable Library)

Vulnerability Details

Regular Expression Denial of Service (ReDoS) was found in color-string before 1.5.5.

Publish Date: Mar 12, 2021 12:00 AM

URL: WS-2021-0152

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 7.5

Suggested Fix

Type: Upgrade version

Origin: https://github.com/Qix-/color-string/releases/tag/1.5.5

Release Date: Mar 12, 2021 12:00 AM

Fix Resolution : color-string - 1.5.5

🔴CVE-2021-23337

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • html-webpack-plugin-3.2.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-chartjs-2-2.7.4.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • redux-form-7.4.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-core-6.26.3.tgz (Root Library)

    • babel-generator-6.26.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • lint-staged-7.2.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-5.4.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • concurrently-4.0.1.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • webpack-cli-3.1.0.tgz (Root Library)

    • inquirer-6.0.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • node-sass-4.9.3.tgz (Root Library)

    • sass-graph-2.2.4.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-cli-6.26.0.tgz (Root Library)

    • babel-register-6.26.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-eslint-8.2.6.tgz (Root Library)

    • traverse-7.0.0-beta.44.tgz
      • generator-7.0.0-beta.44.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-preset-env-1.7.0.tgz (Root Library)

    • babel-plugin-transform-es2015-sticky-regex-6.24.1.tgz
      • babel-helper-regex-6.26.0.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-plugin-import-2.14.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • winston-3.0.0.tgz (Root Library)

    • async-2.6.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-redux-5.0.7.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: Feb 15, 2021 12:15 PM

URL: CVE-2021-23337

Threat Assessment

Exploit Maturity:Proof of concept

EPSS:< 1%

Score: 7.3

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: Feb 15, 2021 12:15 PM

Fix Resolution : lodash-es - 4.17.21,lodash - 4.17.21

🔴CVE-2019-1010266

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • html-webpack-plugin-3.2.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-chartjs-2-2.7.4.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • redux-form-7.4.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-core-6.26.3.tgz (Root Library)

    • babel-generator-6.26.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • lint-staged-7.2.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-5.4.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • concurrently-4.0.1.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • webpack-cli-3.1.0.tgz (Root Library)

    • inquirer-6.0.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • node-sass-4.9.3.tgz (Root Library)

    • sass-graph-2.2.4.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-cli-6.26.0.tgz (Root Library)

    • babel-register-6.26.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-eslint-8.2.6.tgz (Root Library)

    • traverse-7.0.0-beta.44.tgz
      • generator-7.0.0-beta.44.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-preset-env-1.7.0.tgz (Root Library)

    • babel-plugin-transform-es2015-sticky-regex-6.24.1.tgz
      • babel-helper-regex-6.26.0.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-plugin-import-2.14.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • winston-3.0.0.tgz (Root Library)

    • async-2.6.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-redux-5.0.7.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: Jul 17, 2019 08:25 PM

URL: CVE-2019-1010266

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 7.1

Suggested Fix

Type: Upgrade version

Origin: GHSA-x5rq-j2xg-h7qm

Release Date: Jul 17, 2019 08:25 PM

Fix Resolution : lodash-amd - 4.17.11,lodash-es - 4.17.11,lodash - 4.17.11

🟠CVE-2021-29060

Vulnerable Library - color-string-0.3.0.tgz

Parser and generator for CSS color strings

Library home page: https://registry.npmjs.org/color-string/-/color-string-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/color-string/package.json

Dependency Hierarchy:

  • winston-3.0.0.tgz (Root Library)
    • diagnostics-1.1.0.tgz
      • colorspace-1.0.1.tgz
        • color-0.8.0.tgz
          • ❌ color-string-0.3.0.tgz (Vulnerable Library)

Vulnerability Details

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.

Publish Date: Jun 21, 2021 03:45 PM

URL: CVE-2021-29060

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 6.9

Suggested Fix

Type: Upgrade version

Origin: GHSA-257v-vj4p-3w2h

Release Date: Jun 21, 2021 03:45 PM

Fix Resolution : color-string - 1.5.5

🟠CVE-2020-28500

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • html-webpack-plugin-3.2.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-chartjs-2-2.7.4.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • redux-form-7.4.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-core-6.26.3.tgz (Root Library)

    • babel-generator-6.26.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • lint-staged-7.2.2.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-5.4.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • concurrently-4.0.1.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • webpack-cli-3.1.0.tgz (Root Library)

    • inquirer-6.0.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • node-sass-4.9.3.tgz (Root Library)

    • sass-graph-2.2.4.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-cli-6.26.0.tgz (Root Library)

    • babel-register-6.26.0.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-eslint-8.2.6.tgz (Root Library)

    • traverse-7.0.0-beta.44.tgz
      • generator-7.0.0-beta.44.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • babel-preset-env-1.7.0.tgz (Root Library)

    • babel-plugin-transform-es2015-sticky-regex-6.24.1.tgz
      • babel-helper-regex-6.26.0.tgz
        • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • eslint-plugin-import-2.14.0.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • winston-3.0.0.tgz (Root Library)

    • async-2.6.1.tgz
      • ❌ lodash-4.17.10.tgz (Vulnerable Library)

  • react-redux-5.0.7.tgz (Root Library)

    • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: Feb 15, 2021 11:10 AM

URL: CVE-2020-28500

Threat Assessment

Exploit Maturity:Proof of concept

EPSS:< 1%

Score: 5.5

Suggested Fix

Type: Upgrade version

Origin: GHSA-29mw-wpgm-hmr9

Release Date: Feb 15, 2021 11:10 AM

Fix Resolution : lodash - 4.17.21,lodash-es - 4.17.21

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions