Azure / Azure/oav

Security vulnerability for yargs-parser

Open
#582 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
104
Forks
62
Avg merge
2d 12h
Merged PRs (30d)
5

Description

When running `npm audit` in a project using this package, a vulnerability comes up for `yargs-parser`.

```
┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ yargs-parser │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ oav [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ oav > yargs > yargs-parser │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1500 │
└───────────────┴──────────────────────────────────────────────────────────────┘
```

The vulnerability has been fixed in yargs-parser for a while, but this package still depends on v6 of yargs from ~4 years ago. Any chance yargs can be updated to a newer version to resolve the vulnerability?

Contributor guide

Open the contributing guide

Research direction

Start by locating the package manifest and the dependency path shown in the issue: oav > yargs > yargs-parser. Run npm audit and the repository's existing tests before and after the dependency update; done means the reported prototype-pollution vulnerability is no longer present without breaking oav.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.