balderdashy / balderdashy/sails
sails@1.5.8 captains-log dependency introduces ReDoS Vulnerability
- Dominant language
- JavaScript
- Stars
- 22.8k
- Forks
- 1.9k
- PR merge metrics
- No merged PRs in 30d
Description
**Node version**: 16
**Sails version** _(sails)_: 1.5.8
We're encountering the following security finding for our sails application:
```
Issues with no direct upgrade or patch:
✗ Regular Expression Denial of Service (ReDoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908] in ansi-regex@2.1.1
introduced by sails@1.5.8 > captains-log@2.0.4 > chalk@1.1.3 > has-ansi@2.0.0 > ansi-regex@2.1.1 and 3 other path(s)
This issue was fixed in versions: 3.0.1, 4.1.1, 5.0.1, 6.0.1
```
Is there any plan to update the chalk version for captains-log?
Contributor guide
Research direction
Start by tracing the reported dependency path from sails@1.5.8 through captains-log, chalk, has-ansi, and ansi-regex. Check the captains-log dependency metadata and existing dependency tests or verification commands. Done means the vulnerable ansi-regex version is no longer introduced by the supported dependency path and the security finding is cleared.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100