Security vulnerability for yargs-parser
- Dominant language
- TypeScript
- Stars
- 104
- Forks
- 62
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 5
Description
When running `npm audit` in a project using this package, a vulnerability comes up for `yargs-parser`.
```
┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ yargs-parser │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ oav [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ oav > yargs > yargs-parser │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1500 │
└───────────────┴──────────────────────────────────────────────────────────────┘
```
The vulnerability has been fixed in yargs-parser for a while, but this package still depends on v6 of yargs from ~4 years ago. Any chance yargs can be updated to a newer version to resolve the vulnerability?
Contributor guide
Research direction
Start by locating the package manifest and the dependency path shown in the issue: oav > yargs > yargs-parser. Run npm audit and the repository's existing tests before and after the dependency update; done means the reported prototype-pollution vulnerability is no longer present without breaking oav.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100