decaporg / decaporg/decap-cms

Regular Expression Denial of Service in trim

Open
#7,567 1 comment 0 reactions 0 assignees View on GitHub
type: bug
Dominant language
JavaScript
Stars
19.4k
Forks
3.1k
Avg merge
1d 14h
Merged PRs (30d)
9

Description

**Describe the bug**
`decap-cms-app` has a transitive depenency on `trim`, which currently has a security vulnerability for the pinned version.

https://github.com/advisories/GHSA-w5p7-h5w8-2hfq

Image

**To Reproduce**

1. In a new directory `npm init -y && npm i decap-cms-app && npm audit`

npm audit logs
Image

Alternatively:

1. Create a repo with `decap-cms-app` as a package.json dependency
2. Enable dependabot security updates
3. Witness dependabot security alert and inability to update

Logs from dependabot's attempt to update
Image

**Expected behavior**
`decap-cms-app` not to have security vulnerabilities via transitive dependencies

**Applicable Versions:**
- Decap CMS version: 3.8.3

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.