firebase-tools-12.4.7.tgz: 10 vulnerabilities (highest severity is: 9.8)

[mend-for-github.1485827954.workers.dev]

Vulnerable Library - firebase-tools-12.4.7.tgz

Library home page: https://registry.npmjs.org/firebase-tools/-/firebase-tools-12.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/package.json

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (firebase-tools version)	Remediation Possible**
CVE-2023-42282	Critical	9.8	detected in multiple dependencies	Transitive	12.4.8	✅
CVE-2024-29415	Critical	9.1	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2024-45296	High	7.5	path-to-regexp-1.8.0.tgz	Transitive	12.4.8	✅
CVE-2024-4068	High	7.5	braces-3.0.2.tgz	Transitive	N/A*	❌
CVE-2024-37890	High	7.5	ws-7.5.9.tgz	Transitive	12.4.8	✅
CVE-2024-21538	High	7.5	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2024-28863	Medium	6.5	tar-6.1.15.tgz	Transitive	N/A*	❌
CVE-2024-47178	Medium	5.3	basic-auth-connect-1.0.0.tgz	Transitive	12.4.8	✅
CVE-2025-5889	Low	3.1	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2024-4128	Low	2.6	firebase-tools-12.4.7.tgz	Direct	N/A	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-42282

Vulnerable Libraries - ip-1.1.8.tgz, ip-2.0.0.tgz

ip-1.1.8.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ip/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • proxy-agent-6.3.0.tgz
    • pac-proxy-agent-7.0.0.tgz
      • pac-resolver-7.0.0.tgz
        • ❌ ip-1.1.8.tgz (Vulnerable Library)

ip-2.0.0.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/socks/node_modules/ip/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • proxy-agent-6.3.0.tgz
    • socks-proxy-agent-8.0.1.tgz
      • socks-2.7.1.tgz
        • ❌ ip-2.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Publish Date: 2024-02-08

URL: CVE-2023-42282

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-42282

Release Date: 2024-02-08

Fix Resolution (ip): 1.1.9

Direct dependency fix Resolution (firebase-tools): 12.4.8

Fix Resolution (ip): 1.1.9

Direct dependency fix Resolution (firebase-tools): 12.4.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-29415

Vulnerable Libraries - ip-2.0.0.tgz, ip-1.1.8.tgz

ip-2.0.0.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/socks/node_modules/ip/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • proxy-agent-6.3.0.tgz
    • socks-proxy-agent-8.0.1.tgz
      • socks-2.7.1.tgz
        • ❌ ip-2.0.0.tgz (Vulnerable Library)

ip-1.1.8.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ip/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • proxy-agent-6.3.0.tgz
    • pac-proxy-agent-7.0.0.tgz
      • pac-resolver-7.0.0.tgz
        • ❌ ip-1.1.8.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282. We assigned a different CVSS score to this CVE because of its potential to result in a Server-Side Request Forgery (SSRF) vulnerability. Additionally, the package is no longer maintained, which increases the associated risk.

Publish Date: 2024-05-27

URL: CVE-2024-29415

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2024-45296

Vulnerable Library - path-to-regexp-1.8.0.tgz

Express style path to RegExp utility

Library home page: https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-1.8.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/node_modules/superstatic/node_modules/path-to-regexp/package.json,/node_modules/superstatic/node_modules/path-to-regexp/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • superstatic-9.0.3.tgz
    • ❌ path-to-regexp-1.8.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

Publish Date: 2024-09-09

URL: CVE-2024-45296

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9wv6-86v2-598j

Release Date: 2024-09-09

Fix Resolution (path-to-regexp): 1.9.0

Direct dependency fix Resolution (firebase-tools): 12.4.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-4068

Vulnerable Library - braces-3.0.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/node_modules/braces/package.json,/node_modules/braces/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • chokidar-3.5.3.tgz
    • ❌ braces-3.0.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The NPM package "braces", versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In "lib/parse.js," if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash. After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.

Publish Date: 2024-05-13

URL: CVE-2024-4068

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-13

Fix Resolution: braces - 3.0.3

CVE-2024-37890

Vulnerable Library - ws-7.5.9.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.5.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ws/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • ❌ ws-7.5.9.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

Publish Date: 2024-06-17

URL: CVE-2024-37890

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3h5v-q93c-6h6q

Release Date: 2024-06-17

Fix Resolution (ws): 7.5.10

Direct dependency fix Resolution (firebase-tools): 12.4.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-21538

Vulnerable Libraries - cross-spawn-7.0.3.tgz, cross-spawn-6.0.5.tgz

cross-spawn-7.0.3.tgz

Cross platform child_process#spawn and child_process#spawnSync

Library home page: https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cross-spawn/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • ❌ cross-spawn-7.0.3.tgz (Vulnerable Library)

cross-spawn-6.0.5.tgz

Cross platform child_process#spawn and child_process#spawnSync

Library home page: https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/node_modules/cross-env/node_modules/cross-spawn/package.json,/node_modules/cross-env/node_modules/cross-spawn/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • cross-env-5.2.1.tgz
    • ❌ cross-spawn-6.0.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Publish Date: 2024-11-08

URL: CVE-2024-21538

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2024-21538

Release Date: 2024-11-08

Fix Resolution: https://github.com/moxystudio/node-cross-spawn.git - v6.0.6

CVE-2024-28863

Vulnerable Library - tar-6.1.15.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.1.15.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tar/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • ❌ tar-6.1.15.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Publish Date: 2024-03-21

URL: CVE-2024-28863

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f5x3-32g6-xq36

Release Date: 2024-03-21

Fix Resolution: tar - 6.2.1

CVE-2024-47178

Vulnerable Library - basic-auth-connect-1.0.0.tgz

Basic auth middleware for node and connect

Library home page: https://registry.npmjs.org/basic-auth-connect/-/basic-auth-connect-1.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/node_modules/basic-auth-connect/package.json,/node_modules/basic-auth-connect/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • superstatic-9.0.3.tgz
    • ❌ basic-auth-connect-1.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0.

Publish Date: 2024-09-30

URL: CVE-2024-47178

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7p89-p6hx-q4fw

Release Date: 2024-09-30

Fix Resolution (basic-auth-connect): 1.1.0

Direct dependency fix Resolution (firebase-tools): 12.4.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2025-5889

Vulnerable Libraries - brace-expansion-1.1.11.tgz, brace-expansion-2.0.1.tgz

brace-expansion-1.1.11.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/node_modules/brace-expansion/package.json,/node_modules/brace-expansion/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • minimatch-3.1.2.tgz
    • ❌ brace-expansion-1.1.11.tgz (Vulnerable Library)

brace-expansion-2.0.1.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/readdir-glob/node_modules/brace-expansion/package.json,/node_modules/superstatic/node_modules/brace-expansion/package.json,/node_modules/cacache/node_modules/brace-expansion/package.json,/node_modules/protobufjs-cli/node_modules/brace-expansion/package.json

Dependency Hierarchy:

• firebase-tools-12.4.7.tgz (Root Library)
  • archiver-5.3.1.tgz
    • readdir-glob-1.1.3.tgz
      • minimatch-5.1.6.tgz
        • ❌ brace-expansion-2.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A vulnerability was found in juliangruber brace-expansion up to 1.1.11. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to apply a patch to fix this issue.

Publish Date: 2025-06-09

URL: CVE-2025-5889

CVSS 3 Score Details (3.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

CVE-2024-4128

Vulnerable Library - firebase-tools-12.4.7.tgz

Library home page: https://registry.npmjs.org/firebase-tools/-/firebase-tools-12.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/firebase-tools/package.json

Dependency Hierarchy:

• ❌ firebase-tools-12.4.7.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed calls to localhost (ie Chrome before v94), the website could exfiltrate emulator data. We recommend upgrading past version 13.6.0 or commit  068a2b08dc308c7ab4b569617f5fc8821237e3a0 firebase/firebase-tools@068a2b0

Publish Date: 2024-05-02

URL: CVE-2024-4128

CVSS 3 Score Details (2.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

---

⛑️Automatic Remediation will be attempted for this issue.