Automattic / Automattic/kue

NPM audit shows moderate vulnerabilities alert

Open
#1,248 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
9.4k
Forks
858
PR merge metrics
No merged PRs in 30d

Description

On version 0.11.6

npm audit shows the following moderate vulnerabilities alert:

```
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ extend │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=2.0.2 <3.0.0 || >=3.0.2 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ kue │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ kue > node-redis-warlock > node-redis-scripty > extend │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/996 │
└───────────────┴──────────────────────────────────────────────────────────────┘
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by running npm audit for version 0.11.6 and trace the reported path from kue through node-redis-warlock and node-redis-scripty to extend. Review the available dependency declarations and the patched versions in the report; done means the moderate prototype-pollution alert is no longer reported.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js, redis
Domain
backend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.