mlbrilliance/aurora-demo-lockfileAURORA demo target — deliberately vulnerable lockfiles (CVE-2019-10744, CVE-2018-18074, CVE-2020-26160)
Demo target for AURORA — the UiPath for Coding Agents challenge submission at
mlbrilliance/uipath-for-coding-agents.
This repo intentionally contains three vulnerable lockfiles so AURORA's Maestro
process (OssSupplyChainDefender) has something to detect, triage, and remediate. Do
not use any of these dependencies in real code.
| Lockfile | Package | Pinned version | Advisory |
|---|---|---|---|
package-lock.json | lodash | 4.17.10 | CVE-2019-10744 — prototype pollution |
package-lock.json | minimist | 1.2.0 | CVE-2020-7598 — prototype pollution |
requirements.txt | requests | 2.20.0 | CVE-2018-18074 — Authorization header on redirect |
requirements.txt | urllib3 | 1.24.1 | CVE-2019-11324 — CRLF injection |
go.sum | github.com/dgrijalva/jwt-go | v3.2.0+incompatible | CVE-2020-26160 — missing audience check |
When AURORA's Maestro OssSupplyChainDefender instance runs:
OpenAutoPR Coded WorkflowMIT.