balderdashy / balderdashy/sails

sails@1.5.8 captains-log dependency introduces ReDoS Vulnerability

Open
#7,315 5 comments 1 reaction 0 assignees View on GitHub
resolved
Dominant language
JavaScript
Stars
22.8k
Forks
1.9k
PR merge metrics
No merged PRs in 30d

Description

**Node version**: 16
**Sails version** _(sails)_: 1.5.8


We're encountering the following security finding for our sails application:
```
Issues with no direct upgrade or patch:
✗ Regular Expression Denial of Service (ReDoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908] in ansi-regex@2.1.1
introduced by sails@1.5.8 > captains-log@2.0.4 > chalk@1.1.3 > has-ansi@2.0.0 > ansi-regex@2.1.1 and 3 other path(s)
This issue was fixed in versions: 3.0.1, 4.1.1, 5.0.1, 6.0.1
```
Is there any plan to update the chalk version for captains-log?

Contributor guide

Open the contributing guide

Research direction

Start by tracing the reported dependency path from sails@1.5.8 through captains-log, chalk, has-ansi, and ansi-regex. Check the captains-log dependency metadata and existing dependency tests or verification commands. Done means the vulnerable ansi-regex version is no longer introduced by the supported dependency path and the security finding is cleared.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.