bahmutov / bahmutov/onbeforeunload-example

同学,您这个项目引入了218个开源组件,存在1个漏洞,辛苦升级一下

Open
#47 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3
Forks
1
PR merge metrics
No merged PRs in 30d

Description

检测到 bahmutov/onbeforeunload-example 一共引入了218个开源组件,存在1个漏洞
```
漏洞标题:Axios 安全漏洞
缺陷组件:axios@0.21.1
漏洞编号:CVE-2021-3749
漏洞描述:Axios是一款基于Promise(异步编程的一种解决方案)的HTTP客户端。
Axios 存在安全漏洞,该漏洞源于在 axios 包中发现了一个 ReDoS(正则表达式拒绝服务)缺陷。攻击者可利用该漏洞为修剪功能提供精心设计的输入导致应用程序消耗过多的 CPU。
影响范围:(∞, 0.21.3)
最小修复版本:0.21.3
缺陷组件引入路径:onbeforeunload-example@1.0.0->start-server-and-test@1.14.0->wait-on@6.0.0->axios@0.21.1
```
另外还有几个漏洞,详细报告:https://mofeisec.com/jr?p=a05568

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the dependency path in the issue body: onbeforeunload-example@1.0.0 -> start-server-and-test@1.14.0 -> wait-on@6.0.0 -> axios@0.21.1. Inspect the repository's dependency metadata to update Axios to at least 0.21.3, then run the project's existing checks. Done means the vulnerable Axios version is no longer present in the dependency tree.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.