browserify / browserify/static-module
Problem with IQ Server vulnerability : sonatype-2020-0067
- Dominant language
- JavaScript
- Stars
- 75
- Forks
- 22
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
Here is my problem.
I want to install "compodoc" in an internal angular project but one dependencies is blocked by Iq server for this reason :
Sonatype-2020-0067 :
**EXPLANATION**
The acorn package is vulnerable to Regular Expression Denial of Service (ReDoS). The RegExpValidationState.prototype.at and RegExpValidationState.prototype.nextIndex functions in acorn.js, acorn.mjs, and acorn.es.js process user-supplied input without properly validating UTF-16 surrogate pairs. A remote attacker can exploit this behavior by submitting a crafted UTF-16 encoded string which, when parsed by the application, will result in an infinite loop, ultimately leading to a DoS condition.
**ROOT CAUSE**
static-module-3.0.4.tgzpackage/dist/acorn.js[5.5.0, 5.7.4)
**ADVISORIES**
Third Party:https://www.npmjs.com/advisories/1488
Is there a solution to fix it in futur version of "static module" ?
Best regards
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.