MetaMask / MetaMask/metamask-extension
Yarn Audit: new or newly blocking advisories on main (3713388885)
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
**1** new or newly blocking advisory detected on push to `main` (0 release-blocking).
CI run: https://github.com/MetaMask/metamask-extension/actions/runs/31642962921
## Informational (dev-only or low severity)
- **extract-zip** (high, dev-only) — extract-zip unvalidated symlink path traversal
https://github.com/advisories/GHSA-jmr9-qjv8-65gv
Native audit tree
```
├─ extract-zip
│ ├─ ID: 1139346
│ ├─ Issue: extract-zip unvalidated symlink path traversal
│ ├─ URL: https://github.com/advisories/GHSA-jmr9-qjv8-65gv
│ ├─ Severity: high
│ ├─ Vulnerable Versions: <=2.0.1
│ │
│ ├─ Tree Versions
│ │ ├─ 1.7.0
│ │ └─ 2.0.1
│ │
│ └─ Dependents
│ ├─ electron@npm:23.3.0
│ └─ puppeteer-core@npm:2.1.1
│
```
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked CI run and the native audit tree, then trace how extract-zip is brought in through electron@23.3.0 and puppeteer-core@2.1.1. Done means the GitHub advisory GHSA-jmr9-qjv8-65gv is no longer reported by the audit.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- electron
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 48/100