aws-amplify / aws-amplify/amplify-cli
@aws-amplify/amplify-cli-core inquirer dependency exposes high severity vulnerability in tmp package
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 825
- Avg merge
- 11d 23h
- Merged PRs (30d)
- 2
Description
### How did you install the Amplify CLI?
npm
### If applicable, what version of Node.js are you using?
24.8.0
### Amplify CLI Version
14.5.0
### What operating system are you using?
macOS
### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
N/A
### Describe the bug
`@aws-amplify/amplify-cli-core` has a transitive dependency to `tmp@^0.0.33`, which has a high severity security vulnerability:
```
│ └─ @aws-amplify/amplify-cli-core@npm:4.4.2 (via npm:4.4.2)
│ └─ inquirer@npm:7.3.3 (via npm:^7.3.3)
│ └─ external-editor@npm:3.1.0 (via npm:^3.0.3)
│ └─ tmp@npm:0.0.33 (via npm:^0.0.33)
```
### Expected behavior
Dependencies don't expose vulnerabilities.
### Reproduction steps
1. Install `@aws-amplify/amplify-cli-core` and observe the version of `tmp` installed has the following vulnerabilities:
low: https://github.com/advisories/GHSA-52f5-9888-hmc6
high: https://github.com/advisories/GHSA-ph9p-34f9-6g65
### Project Identifier
_No response_
### Log output
_No response_
### Additional information
Upgrading from `inquirer` `7.3.3` to `inquirer` `8.2.7` will solve the issue:
https://github.com/SBoudrias/Inquirer.js/issues/1802#issuecomment-3169341642
### Before submitting, please confirm:
- [x] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [x] I have removed any sensitive information from my code snippets and submission.
Contributor guide
Research direction
Locate the dependency declaration and lockfile entry that bring in @aws-amplify/amplify-cli-core, then reproduce the issue with npm install and an audit. Check the inquirer upgrade path described in the issue; done means the installed tmp dependency no longer reports the listed advisories and the relevant CLI checks still pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100