Regular Expression Denial of Service in trim
- Dominant language
- JavaScript
- Stars
- 19.4k
- Forks
- 3.1k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 9
Description
**Describe the bug**
`decap-cms-app` has a transitive depenency on `trim`, which currently has a security vulnerability for the pinned version.
https://github.com/advisories/GHSA-w5p7-h5w8-2hfq
**To Reproduce**
1. In a new directory `npm init -y && npm i decap-cms-app && npm audit`
npm audit logs
Alternatively:
1. Create a repo with `decap-cms-app` as a package.json dependency
2. Enable dependabot security updates
3. Witness dependabot security alert and inability to update
Logs from dependabot's attempt to update
**Expected behavior**
`decap-cms-app` not to have security vulnerabilities via transitive dependencies
**Applicable Versions:**
- Decap CMS version: 3.8.3
Contributor guide
Assessment
This issue has not been assessed yet.