Automattic / Automattic/knox

This library includes a security vulnerability

Open
#290 4 comments 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
1.7k
Forks
283
PR merge metrics
No merged PRs in 30d

Description

I'm using a tool from the [Node Security Project](https://nodesecurity.io/) called [`nsp`](https://www.npmjs.com/package/nsp) to check for security vulnerabilities.

It looks like this would be fixed by using the latest version of [`debug`](https://www.npmjs.com/package/debug) .

```
~/knox (master) $ nsp check
(+) 1 vulnerabilities found
┌───────────────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ │ Regular Expression Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Name │ ms │
├───────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Installed │ 0.6.2 │
├───────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Vulnerable │ <=0.7.0 │
├───────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Patched │ >0.7.0 │
├───────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Path │ debug > ms │
├───────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ More Info │ https://nodesecurity.io/advisories/46 │
└───────────────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
```

Contributor guide

No contributing guide indexed for this repository

Research direction

No source file or test is named. Start by running the reported nsp check and inspect where debug is declared as a dependency; update it so the installed ms version is above 0.7.0, then rerun the check and confirm the advisory is gone.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.