adobe / adobe/leonardo

High severity vulnerabilities for ciebase > mout when installing with npm

Open
#202 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
2.1k
Forks
130
PR merge metrics
No merged PRs in 30d

Description

## Description

High severity vulnerabilities are flagged when installing via npm.

## Steps to reproduce

### Install leonardo-contrast-colors

```bash
$ npm i @adobe/leonardo-contrast-colors

added 6 packages, and audited 454 packages in 5s

4 high severity vulnerabilities

To address issues that do not require attention, run:
npm audit fix

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.

$ npm audit fix

up to date, audited 454 packages in 6s

npm audit report

mout <=1.2.3
Severity: high
Prototype Pollution in mout - https://github.com/advisories/GHSA-pc58-wgmc-hfjr
Prototype Pollution in mout - https://github.com/advisories/GHSA-vvv8-xw5f-3f88
fix available via `npm audit fix --force`
Will install undefined@undefined, which is a breaking change
node_modules/mout
ciebase >=0.1.1
Depends on vulnerable versions of mout
node_modules/ciebase
@adobe/leonardo-contrast-colors *
Depends on vulnerable versions of ciebase
node_modules/@adobe/leonardo-contrast-colors
ciecam02 >=0.4.6
Depends on vulnerable versions of mout
node_modules/ciecam02
```

## Expected behavior

Zero vulnerabilities

## Leonardo package and version

**@leonardo-contrast-colors version:** 1.0.0-alpha.17

Contributor guide

Open the contributing guide

Research direction

Reproduce the report by installing @adobe/leonardo-contrast-colors version 1.0.0-alpha.17 and running npm audit. Trace the vulnerable mout dependency through ciebase and ciecam02, then determine whether dependency updates remove the reported vulnerabilities without an unintended breaking change. Done means the package audit no longer reports these high-severity vulnerabilities.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.