All the vulnerabilities related to the version 1.0.9 of the package
Uncontrolled Resource Consumption in trim-newlines
@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name
As a part of this vulnerability, user was able to se code using __proto__ as a tag or attribute name.
const { XMLParser, XMLBuilder, XMLValidator} = require("fast-xml-parser");
let XMLdata = "<__proto__><polluted>hacked</polluted></__proto__>"
const parser = new XMLParser();
let jObj = parser.parse(XMLdata);
console.log(jObj.polluted) // should return hacked
The problem has been patched in v4.1.2
User can check for "proto" in the XML string before parsing it to the parser.
https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7