mafintosh / mafintosh/hypervision
Security: 4 dependency vulnerabilities reported by npm (Electron ones are critical/high severity)
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 450
- Forks
- 45
- PR merge metrics
- No merged PRs in 30d
Description
`npm audit` results below:
```bash
=== npm audit security report ===
# Run npm install electron@2.0.2 to resolve 3 vulnerabilities
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Chromium Remote Code Execution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/539 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Code Execution by Re-enabling Node.js integration │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/574 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical │ Remote Code Execution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/563 │
└───────────────┴──────────────────────────────────────────────────────────────┘
# Run npm install sheetify@7.3.2 to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Sandbox Breakout / Arbitrary Code Execution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ static-eval │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ sheetify │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ sheetify > static-eval │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/548 │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 4 vulnerabilities (1 moderate, 2 high, 1 critical) in 1500 scanned packages
4 vulnerabilities require semver-major dependency updates.
```
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Run npm audit to confirm the four reported vulnerabilities and inspect the dependency declarations for electron and sheetify. Update the affected dependencies while checking for the stated semver-major impact, then rerun npm audit and verify that the application still starts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- electron, javascript
- Domain
- desktop, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100