Automattic / Automattic/kue

Node Security Project advisory against jade -> uglify-js package <2.6.0

Open
#776 2 comments 0 reactions 0 assignees View on GitHub
needs pull request
Dominant language
JavaScript
Stars
9.4k
Forks
858
PR merge metrics
No merged PRs in 30d

Description

nsp is has flagged an issue with your version of jade -> uglify-js, consider updating it. Here is the report.

```
┌───────────────┬────────────────────────────────────────────┐
│ │ Regular Expression Denial of Service │
├───────────────┼────────────────────────────────────────────┤
│ Name │ uglify-js │
├───────────────┼────────────────────────────────────────────┤
│ Installed │ 2.2.5 │
├───────────────┼────────────────────────────────────────────┤
│ Vulnerable │ <2.6.0 │
├───────────────┼────────────────────────────────────────────┤
│ Patched │ >=2.6.0 │
├───────────────┼────────────────────────────────────────────┤
│ Path │ kue > jade > transformers > uglify-js │
├───────────────┼────────────────────────────────────────────┤
│ More Info │ https://nodesecurity.io/advisories/48 │
└───────────────┴────────────────────────────────────────────┘
┌───────────────┬────────────────────────────────────────────┐
│ │ Incorrect Handling of Non-Boolean Compari… │
├───────────────┼────────────────────────────────────────────┤
│ Name │ uglify-js │
├───────────────┼────────────────────────────────────────────┤
│ Installed │ 2.2.5 │
├───────────────┼────────────────────────────────────────────┤
│ Vulnerable │ <= 2.4.23 │
├───────────────┼────────────────────────────────────────────┤
│ Patched │ >= 2.4.24 │
├───────────────┼────────────────────────────────────────────┤
│ Path │ kue > jade > transformers > uglify-js │
├───────────────┼────────────────────────────────────────────┤
│ More Info │ https://nodesecurity.io/advisories/39 │
└───────────────┴────────────────────────────────────────────┘
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with Node Security advisories 48 and 39, then trace the reported kue > jade > transformers > uglify-js path to find where version 2.2.5 is selected. Update the dependency chain to a patched version and verify that the installed uglify-js no longer matches either vulnerable range.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
backend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.