Security vulnerability in `tunnel-agent`
- Dominant language
- JavaScript
- Stars
- 41
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
You may already be aware of this issue, but I figured I'd post it here anyway, just in case I'm wrong. (I don't see it already posted.)
When running an `npm audit` on my Laravel project, I get several Moderate security vulnerabilities related to the `tunnel-agent` dependency. It seems there _is_ a patch available, but it requires that you update `caw` so that it will use `tunnel-agent` version `>=0.6.0`:
```
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ laravel-mix [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ laravel-mix > img-loader > imagemin-gifsicle > gifsicle > │
│ │ bin-build > download > caw > tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by inspecting caw's dependency declarations and running the reported npm audit path for tunnel-agent. Confirm that the dependency resolves to version 0.6.0 or newer, then verify that the vulnerability is no longer reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100