loopbackio / loopbackio/loopback-next
Security Scan "Vulnerability" CVE-2023-29827
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 5.1k
- Forks
- 1.1k
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 27
Description
### Describe the bug
@loopback/rest triggers a critical security vulnerability due to strong-error-handler's dependency on [ejs](https://github.com/mde/ejs).
The vulnerability is currently [disputed by ejs](https://nvd.nist.gov/vuln/detail/CVE-2023-29827), but does the Loopback team have an official statement/documentation as to why this isn't a vulnerability in Loopback's usage of ejs or a plan to remove ejs entirely?
Thanks!
Relevant Links:
https://nvd.nist.gov/vuln/detail/CVE-2023-29827
https://github.com/advisories/GHSA-j5pp-6f4w-r5r6
https://github.com/mde/ejs/issues/720#issuecomment-1587399501
### Logs
_No response_
### Additional information
_No response_
### Reproduction
https://nvd.nist.gov/vuln/detail/CVE-2023-29827
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review @loopback/rest’s dependency path through strong-error-handler to ejs, along with the linked CVE, advisory, and ejs discussion. Determine whether LoopBack’s usage is affected; done is official documentation explaining the impact or a defined plan to remove ejs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs, typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100