bcgov / bcgov/entity

WS-2019-0058: webpack-bundle-analyzer vulnerability

Open
#616 3 comments 0 reactions 0 assignees View on GitHub
ENTITY - DO NOT USE NameX NRO
Dominant language
JavaScript
Stars
23
Forks
62
Avg merge
24m
Merged PRs (30d)
1

Description

### WS-2019-0058
moderate severity
Vulnerable versions: < 3.3.2
Patched version: 3.3.2
Versions of webpack-bundle-analyzer prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses JSON.stringify() without properly escaping input which may lead to Cross-Site Scripting.

Also Upgrade webpack-dev-server to version 3.1.11 or later.

### Remediation
Upgrade webpack-bundle-analyzer to version 3.3.2 or later. For example:

```
"dependencies": {
"webpack-bundle-analyzer": ">=3.3.2"
}
```
or…
```
"devDependencies": {
"webpack-bundle-analyzer": ">=3.3.2"
}
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.