aws-amplify / aws-amplify/amplify-cli

@aws-amplify/amplify-cli-core inquirer dependency exposes high severity vulnerability in tmp package

Open Beginner friendly
#14,265 3 comments 0 reactions 0 assignees View on GitHub
dependency-issue
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### How did you install the Amplify CLI?

npm

### If applicable, what version of Node.js are you using?

24.8.0

### Amplify CLI Version

14.5.0

### What operating system are you using?

macOS

### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

N/A

### Describe the bug

`@aws-amplify/amplify-cli-core` has a transitive dependency to `tmp@^0.0.33`, which has a high severity security vulnerability:

```
│ └─ @aws-amplify/amplify-cli-core@npm:4.4.2 (via npm:4.4.2)
│ └─ inquirer@npm:7.3.3 (via npm:^7.3.3)
│ └─ external-editor@npm:3.1.0 (via npm:^3.0.3)
│ └─ tmp@npm:0.0.33 (via npm:^0.0.33)
```

### Expected behavior

Dependencies don't expose vulnerabilities.

### Reproduction steps

1. Install `@aws-amplify/amplify-cli-core` and observe the version of `tmp` installed has the following vulnerabilities:

low: https://github.com/advisories/GHSA-52f5-9888-hmc6
high: https://github.com/advisories/GHSA-ph9p-34f9-6g65

### Project Identifier

_No response_

### Log output

_No response_

### Additional information

Upgrading from `inquirer` `7.3.3` to `inquirer` `8.2.7` will solve the issue:

https://github.com/SBoudrias/Inquirer.js/issues/1802#issuecomment-3169341642

### Before submitting, please confirm:

- [x] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [x] I have removed any sensitive information from my code snippets and submission.

Contributor guide

Open the contributing guide

Research direction

Locate the dependency declaration and lockfile entry that bring in @aws-amplify/amplify-cli-core, then reproduce the issue with npm install and an audit. Check the inquirer upgrade path described in the issue; done means the installed tmp dependency no longer reports the listed advisories and the relevant CLI checks still pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, typescript
Domain
cli, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
64/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.