Security issues Vulnerability
- Dominant language
- JavaScript
- Stars
- 419
- Forks
- 55
- PR merge metrics
- No merged PRs in 30d
Description
Command ```npm audit``` returned the following list of errors with high severity:
```
High Arbitrary File Write
Package decompress
Patched in No patch available
Dependency of imagemin-pngquant [dev]
Path imagemin-pngquant > pngquant-bin > bin-build > decompress
More info https://npmjs.com/advisories/1217
High Arbitrary File Write
Package decompress
Patched in No patch available
Dependency of imagemin-pngquant [dev]
Path imagemin-pngquant > pngquant-bin > bin-build > download > decompress
More info https://npmjs.com/advisories/1217
High Arbitrary File Write
Package decompress
Patched in No patch available
Dependency of imagemin-pngquant [dev]
Path imagemin-pngquant > pngquant-bin > bin-build > download >
decompress
More info https://npmjs.com/advisories/1217
High Arbitrary File Write
Package decompress
Patched in No patch available
Dependency of imagemin-gifsicle [dev]
Path imagemin-gifsicle > gifsicle > bin-build > decompress
More info https://npmjs.com/advisories/1217
High Arbitrary File Write
Package decompress
Patched in No patch available
Dependency of imagemin-gifsicle [dev]
Path imagemin-gifsicle > gifsicle > bin-build > download > decompress
More info https://npmjs.com/advisories/1217
High Arbitrary File Write
Package decompress
Patched in No patch available
Dependency of imagemin-gifsicle [dev]
Path imagemin-gifsicle > gifsicle > bin-wrapper > download > decompress
More info https://npmjs.com/advisories/1217
High Arbitrary File Write
Package decompress
Patched in No patch available
Dependency of imagemin-mozjpeg [dev]
Path imagemin-mozjpeg > mozjpeg > bin-build > decompress
More info https://npmjs.com/advisories/1217
High Arbitrary File Write
Package decompress
Patched in No patch available
Dependency of imagemin-mozjpeg [dev]
Path imagemin-mozjpeg > mozjpeg > bin-build > download > decompress
More info https://npmjs.com/advisories/1217
High Arbitrary File Write
Package decompress
Patched in No patch available
Dependency of imagemin-mozjpeg [dev]
Path imagemin-mozjpeg > mozjpeg > bin-wrapper > download > decompress
More info https://npmjs.com/advisories/1217
```
Is there a chance to fix this problem?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by running `npm audit` and reviewing the reported `decompress` dependency paths through `imagemin-pngquant`, `imagemin-gifsicle`, and `imagemin-mozjpeg`. Determine whether an upstream remediation or dependency replacement is available; done means the high-severity arbitrary file write findings are resolved or their mitigation is clearly documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100