mafintosh / mafintosh/csv-parser
Minimist vulnerability CVE-2021-44906
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 1.5k
- Forks
- 143
- PR merge metrics
- No merged PRs in 30d
Description
* Operating System: Mac OS
* Node Version: v16.13.0
* NPM Version: 6.14.16
* csv-parser Version: 3.0.0
### Expected Behavior / Situation
N/A
### Actual Behavior / Situation
`minimist`: `v1.2.5` brings in a security vulnerability which is currently has [no fix](https://security.snyk.io/vuln/SNYK-JS-MINIMIST-2429795). The following dependency chain makes `csv-parser` a vulnerable package: csv-parser@3.0.0 › minimist@1.2.5.
### Modification Proposal
Request for a security fix to make `csv-parser` package free from security vulnerabilities. We may shift to using `minimist-lite` as suggested [here](https://github.com/substack/minimist/issues/164#issuecomment-1073969162) / eliminate the usage of `minimist` by providing a implementation to parse command line args
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating csv-parser's dependency declaration and the entry point that brings in minimist@1.2.5. Check the proposed replacement or removal options, then verify that the package no longer includes the vulnerable minimist dependency and that its command-line behavior remains covered by the existing tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100