aquasecurity / aquasecurity/cloudsploit
Update mocha to v.10.2.0
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
`mocha` `5.1.0 - 9.2.1`
Depends on vulnerable versions of `yargs-unparser <=1.6.3`
which depends on vulnerable versions of `flat` `<5.0.1`
`flat` vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-2j2x-2gpw-g8fm
Upgrading `mocha` will also help upgrade `minimatch`
`minimatch <3.0.5` which has ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3
Contributor guide
Research direction
Start by locating the project's mocha dependency and the associated dependency metadata. Update mocha to v10.2.0, then verify that the vulnerable yargs-unparser/flat and minimatch versions are no longer included and that the existing JavaScript tests still pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100