Snyk Security Database

mailparser is an email parser.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.

zae-limiter is a Rate limiting library backed by DynamoDB with token bucket algorithm

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the acquire function. An attacker can cause elevated latency and rejected requests for high-traffic entities, and potentially impact other entities sharing the same DynamoDB partition, by sending sustained high-rate traffic to a single entity.

Affected versions of this package are vulnerable to Directory Traversal via the uniqueId parameter. An attacker can write files outside the intended media directory by setting the uniqueId to an absolute path when uploading a device image.