AdguardTeam / AdguardTeam/HostlistCompiler

Dependencies with high severity vulnerabilities.

Aperta
#36 0 commenti 0 reazioni 1 assegnatario Rivendicata da @maximtop Vedi su GitHub
Priority: P4
Lingua principale
JavaScript
Stelle
232
Fork
30
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

I've used the commands using NPM to try to install the software and I get the following warnings:

`
# npm audit report

axios <=0.21.1
Severity: high
Server-Side Request Forgery in Axios - https://github.com/advisories/GHSA-4w2v-q235-vp99
Incorrect Comparison in axios - https://github.com/advisories/GHSA-cph5-m8f7-6c5x
Depends on vulnerable versions of follow-redirects
No fix available
node_modules/axios
@adguard/hostlist-compiler *
Depends on vulnerable versions of axios
Depends on vulnerable versions of better-ajv-errors
node_modules/@adguard/hostlist-compiler

follow-redirects <=1.14.7
Severity: high
Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects - https://github.com/advisories/GHSA-pw2r-vq6v-hr8c
Exposure of sensitive information in follow-redirects - https://github.com/advisories/GHSA-74fj-2j2h-c42q
No fix available
node_modules/follow-redirects

jsonpointer <5.0.0
Severity: moderate
Prototype Pollution in node-jsonpointer - https://github.com/advisories/GHSA-282f-qqgm-c34q
fix available via `npm audit fix`
node_modules/jsonpointer
better-ajv-errors <=0.8.1
Depends on vulnerable versions of jsonpointer
node_modules/better-ajv-errors

5 vulnerabilities (2 moderate, 3 high)

To address issues that do not require attention, run:
npm audit fix

Some issues need review, and may require choosing
a different dependency.`

Does updating these dependencies with a `npm audit fix --force` break functionality of the tool (looks like only jsonpointer has a fix available at this time)?

Can you please advise?

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.