commitizen-2.9.6.tgz: 6 vulnerabilities (highest severity is: 7.4)

[mend-bolt-for-github]

Vulnerable Library - commitizen-2.9.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: 77c7146d0444e2486ff3f42256348ec0130727e7

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (commitizen version)	Remediation Possible**
CVE-2020-8203	High	7.4	lodash-4.17.2.tgz	Transitive	3.0.0	❌
CVE-2020-28499	High	7.3	merge-1.2.0.tgz	Transitive	N/A*	❌
CVE-2021-23337	High	7.2	lodash-4.17.2.tgz	Transitive	4.1.3	❌
CVE-2022-0144	High	7.1	shelljs-0.7.6.tgz	Transitive	4.1.0	❌
CVE-2020-28500	Medium	5.3	lodash-4.17.2.tgz	Transitive	N/A*	❌
CVE-2025-54798	Low	2.5	tmp-0.0.29.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-8203

Vulnerable Library - lodash-4.17.2.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• commitizen-2.9.6.tgz (Root Library)
  • ❌ lodash-4.17.2.tgz (Vulnerable Library)

Found in HEAD commit: 77c7146d0444e2486ff3f42256348ec0130727e7

Found in base branch: dev

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (commitizen): 3.0.0

Step up your Open Source Security Game with Mend here

CVE-2020-28499

Vulnerable Library - merge-1.2.0.tgz

Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.

Library home page: https://registry.npmjs.org/merge/-/merge-1.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• commitizen-2.9.6.tgz (Root Library)
  • find-node-modules-1.0.4.tgz
    • ❌ merge-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 77c7146d0444e2486ff3f42256348ec0130727e7

Found in base branch: dev

Vulnerability Details

All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge . Converted from WS-2020-0218, on 2021-07-21.

Publish Date: 2021-02-18

URL: CVE-2020-28499

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7wpw-2hjm-89gp

Release Date: 2021-02-18

Fix Resolution: merge - 2.1.1

Step up your Open Source Security Game with Mend here

CVE-2021-23337

Vulnerable Library - lodash-4.17.2.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• commitizen-2.9.6.tgz (Root Library)
  • ❌ lodash-4.17.2.tgz (Vulnerable Library)

Found in HEAD commit: 77c7146d0444e2486ff3f42256348ec0130727e7

Found in base branch: dev

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (commitizen): 4.1.3

Step up your Open Source Security Game with Mend here

CVE-2022-0144

Vulnerable Library - shelljs-0.7.6.tgz

Portable Unix shell commands for Node.js

Library home page: https://registry.npmjs.org/shelljs/-/shelljs-0.7.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• commitizen-2.9.6.tgz (Root Library)
  • ❌ shelljs-0.7.6.tgz (Vulnerable Library)

Found in HEAD commit: 77c7146d0444e2486ff3f42256348ec0130727e7

Found in base branch: dev

Vulnerability Details

shelljs is vulnerable to Improper Privilege Management

Publish Date: 2022-01-11

URL: CVE-2022-0144

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-01-11

Fix Resolution (shelljs): 0.8.5

Direct dependency fix Resolution (commitizen): 4.1.0

Step up your Open Source Security Game with Mend here

CVE-2020-28500

Vulnerable Library - lodash-4.17.2.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• commitizen-2.9.6.tgz (Root Library)
  • ❌ lodash-4.17.2.tgz (Vulnerable Library)

Found in HEAD commit: 77c7146d0444e2486ff3f42256348ec0130727e7

Found in base branch: dev

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-29mw-wpgm-hmr9

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21,lodash-es - 4.17.21,lodash-rails - 4.17.21

Step up your Open Source Security Game with Mend here

CVE-2025-54798

Vulnerable Library - tmp-0.0.29.tgz

Temporary file and directory creator

Library home page: https://registry.npmjs.org/tmp/-/tmp-0.0.29.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• commitizen-2.9.6.tgz (Root Library)
  • inquirer-1.2.3.tgz
    • external-editor-1.1.1.tgz
      • ❌ tmp-0.0.29.tgz (Vulnerable Library)

Found in HEAD commit: 77c7146d0444e2486ff3f42256348ec0130727e7

Found in base branch: dev

Vulnerability Details

tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.

Publish Date: 2025-08-07

URL: CVE-2025-54798

CVSS 3 Score Details (2.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-52f5-9888-hmc6

Release Date: 2025-08-07

Fix Resolution: tmp - 0.2.4

Step up your Open Source Security Game with Mend here