Speccy uses dompurify with XSS vulnerability
Open
overhead
- Dominant language
- PHP
- Stars
- 500
- Forks
- 99
- PR merge metrics
- No merged PRs in 30d
Description
Thought I would bring this up here as [Speccy ](https://github.com/wework/speccy) is a dead repo (last updated 3 years ago). It looks like Speccy is being used here and the latest version of Speccy is using an older version of [redoc](https://github.com/wework/speccy/blob/master/package-lock.json#L6443) which is using a [bad version](https://github.com/wework/speccy/blob/master/package-lock.json#L6450) of dompurify according to [snyk ](https://snyk.io/vuln/npm:dompurify).
Wondering what are thoughts around removing speccy from the repo?
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.