Prototype Pollution introduced due to vulnerable minimist version
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 134
- Forks
- 14
- PR merge metrics
- No merged PRs in 30d
Description
`npm audit` reports the following:
```
=== npm audit security report ===
┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ minimist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.2.1 <1.0.0 || >=1.2.3 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @wext/shipit [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @wext/shipit > web-ext > chrome-launcher > mkdirp > minimist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1179 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ minimist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.2.1 <1.0.0 || >=1.2.3 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @wext/shipit [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @wext/shipit > web-ext > mkdirp > minimist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1179 │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 2 low severity vulnerabilities in 13241 scanned packages
2 vulnerabilities require manual review. See the full report for details.
```
This is caused by depending on an old version of web-ext. Unfortunately, a newer web-ext version is not yet released (but fixed in their master).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the npm audit report and trace the listed minimist paths through web-ext, chrome-launcher, mkdirp, and @wext/shipit. Check the current web-ext dependency and its upstream master fix; done means the dependency tree uses a patched minimist version and npm audit no longer reports these vulnerabilities.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100