RHSA-2020:2625

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function.

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write.

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write.

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite.

index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.