import { isVersionBelow } from './semver-utils.js';
export const KNOWN_VULNS = {
    lodash: [
        {
            cveId: 'CVE-2020-8203',
            severity: 'high',
            description: 'Prototype pollution via merge',
            fixedIn: '4.17.21',
        },
        {
            cveId: 'CVE-2021-23337',
            severity: 'high',
            description: 'Command injection via template',
            fixedIn: '4.17.21',
        },
    ],
    axios: [
        {
            cveId: 'CVE-2023-45857',
            severity: 'medium',
            description: 'CSRF via header forwarding',
            fixedIn: '1.6.0',
        },
    ],
    qs: [
        {
            cveId: 'CVE-2022-24999',
            severity: 'high',
            description: 'Prototype pollution',
            fixedIn: '6.7.3',
        },
    ],
    semver: [
        {
            cveId: 'CVE-2022-25883',
            severity: 'medium',
            description: 'ReDoS vulnerability',
            fixedIn: '7.5.2',
        },
    ],
    json5: [
        {
            cveId: 'CVE-2022-46175',
            severity: 'high',
            description: 'Prototype pollution',
            fixedIn: '2.2.2',
        },
    ],
    minimist: [
        {
            cveId: 'CVE-2021-44906',
            severity: 'critical',
            description: 'Prototype pollution — no sandbox escape path',
            fixedIn: '1.2.6',
        },
    ],
    tar: [
        {
            cveId: 'CVE-2021-37701',
            severity: 'high',
            description: 'Arbitrary file creation via path traversal',
            fixedIn: '6.1.9',
        },
    ],
    'node-fetch': [
        {
            cveId: 'CVE-2022-0235',
            severity: 'medium',
            description: 'Exposure of sensitive info to unauthorized actor',
            fixedIn: '2.6.7',
        },
    ],
    moment: [
        { cveId: 'CVE-2022-24785', severity: 'high', description: 'Path traversal', fixedIn: '2.29.4' },
        {
            cveId: 'CVE-2022-31129',
            severity: 'high',
            description: 'ReDoS in rfc2822 regex',
            fixedIn: '2.29.4',
        },
    ],
    jsonwebtoken: [
        {
            cveId: 'CVE-2022-23529',
            severity: 'critical',
            description: 'Remote code execution via malicious JWT',
            fixedIn: '9.0.0',
        },
    ],
    'serialize-javascript': [
        {
            cveId: 'CVE-2020-7660',
            severity: 'high',
            description: 'Arbitrary code execution',
            fixedIn: '3.1.0',
        },
    ],
    glob: [
        {
            cveId: 'CVE-2021-21315',
            severity: 'medium',
            description: 'ReDoS vulnerability',
            fixedIn: '7.2.3',
        },
    ],
    'path-parse': [
        {
            cveId: 'CVE-2021-23343',
            severity: 'medium',
            description: 'ReDoS vulnerability',
            fixedIn: '1.0.7',
        },
    ],
};
export function getVulns(name, version) {
    const entries = KNOWN_VULNS[name];
    if (!entries) {
        return [];
    }
    return entries
        .filter((entry) => {
        /* v8 ignore next 1 */
        if (!entry.fixedIn) {
            return true;
        }
        return isVersionBelow(version, entry.fixedIn);
    })
        .map((entry) => ({
        cveId: entry.cveId,
        severity: entry.severity,
        description: entry.description,
        fixedIn: entry.fixedIn,
    }));
}
//# sourceMappingURL=vuln-data.js.map