LinusBorg / LinusBorg/vue-cli-plugin-test-attrs

同学,您这个项目引入了951个开源组件,存在31个漏洞,辛苦升级一下

Open
#49 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
62
Forks
9
PR merge metrics
No merged PRs in 30d

Description

检测到 LinusBorg/vue-cli-plugin-test-attrs 一共引入了951个开源组件,存在31个漏洞
```
漏洞标题:serialize-javascript 代码问题漏洞
缺陷组件:serialize-javascript@2.1.2
漏洞编号:CVE-2020-7660
漏洞描述:Verizon serialize-javascript是美国威瑞森电信(Verizon)公司的一款支持将JavaScript序列化为 JSON超集的软件包。
serialize-javascript 3.1.0之前版本中存在代码问题漏洞。远程攻击者可借助index.js文件中的‘deleteFunctions’函数利用该漏洞注入任意代码。
国家漏洞库信息:https://www.cnvd.org.cn/flaw/show/CNVD-2020-53801
影响范围:(∞, 3.1.0)
最小修复版本:3.1.0
缺陷组件引入路径:vue-cli-plugin-test-attrs@0.1.4->@vue/cli-service@3.12.1->terser-webpack-plugin@1.4.3->serialize-javascript@2.1.2
vue-cli-plugin-test-attrs@0.1.4->@vue/cli-service@3.12.1->copy-webpack-plugin@4.6.0->serialize-javascript@2.1.2
vue-cli-plugin-test-attrs@0.1.4->@vue/cli-plugin-eslint@3.12.1->webpack@4.42.0->terser-webpack-plugin@1.4.3->serialize-javascript@2.1.2
vue-cli-plugin-test-attrs@0.1.4->@vue/cli-service@3.12.1->webpack@4.42.0->terser-webpack-plugin@1.4.3->serialize-javascript@2.1.2
```
另外还有31个漏洞,详细报告:https://mofeisec.com/jr?p=ic76c6

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the dependency audit for vue-cli-plugin-test-attrs and trace the reported paths through @vue/cli-service, terser-webpack-plugin, copy-webpack-plugin, and webpack. Review the detailed report for all 31 vulnerabilities; done means the vulnerable dependency set is addressed without breaking the plugin's existing tests or build.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
build-system, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.