AdguardTeam / AdguardTeam/HostlistCompiler
Dependencies with high severity vulnerabilities.
- 主要语言
- JavaScript
- 星标
- 232
- 派生
- 30
- PR 合并指标
- 30 天内没有已合并 PR
描述
I've used the commands using NPM to try to install the software and I get the following warnings:
`
# npm audit report
axios <=0.21.1
Severity: high
Server-Side Request Forgery in Axios - https://github.com/advisories/GHSA-4w2v-q235-vp99
Incorrect Comparison in axios - https://github.com/advisories/GHSA-cph5-m8f7-6c5x
Depends on vulnerable versions of follow-redirects
No fix available
node_modules/axios
@adguard/hostlist-compiler *
Depends on vulnerable versions of axios
Depends on vulnerable versions of better-ajv-errors
node_modules/@adguard/hostlist-compiler
follow-redirects <=1.14.7
Severity: high
Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects - https://github.com/advisories/GHSA-pw2r-vq6v-hr8c
Exposure of sensitive information in follow-redirects - https://github.com/advisories/GHSA-74fj-2j2h-c42q
No fix available
node_modules/follow-redirects
jsonpointer <5.0.0
Severity: moderate
Prototype Pollution in node-jsonpointer - https://github.com/advisories/GHSA-282f-qqgm-c34q
fix available via `npm audit fix`
node_modules/jsonpointer
better-ajv-errors <=0.8.1
Depends on vulnerable versions of jsonpointer
node_modules/better-ajv-errors
5 vulnerabilities (2 moderate, 3 high)
To address issues that do not require attention, run:
npm audit fix
Some issues need review, and may require choosing
a different dependency.`
Does updating these dependencies with a `npm audit fix --force` break functionality of the tool (looks like only jsonpointer has a fix available at this time)?
Can you please advise?
贡献指南
这个仓库没有索引到贡献指南
评估
这个 Issue 还没有评估数据。