jantimon / jantimon/html-webpack-plugin
CVE-2022-37620 html-minifier-terser dependency vulnerability
- Dominant language
- JavaScript
- Stars
- 10.7k
- Forks
- 1.3k
- Avg merge
- 1m
- Merged PRs (30d)
- 1
Description
OWASP is currently throwing the following security vulnerability error from the latest version of html-webpack-plugin (5.6.3):
```
One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
html-minifier-terser:^6.0.2 (pkg:npm/html-minifier-terser@6.1.0, cpe:2.3:a:terser:html-minifier-terser:6.1.0:*:*:*:*:*:*:*): CVE-2022-37620(7.5)
See the dependency-check report for more details.
```
Contributor guide
No contributing guide indexed for this repository
Research direction
No source file or test is named. Start by inspecting the dependency declaration for html-minifier-terser in html-webpack-plugin 5.6.3 and reproduce the OWASP report for CVE-2022-37620. Done means the reported vulnerable dependency is no longer detected, with the existing dependency checks still passing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, webpack
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100