mafintosh / mafintosh/hypervision

Security: 4 dependency vulnerabilities reported by npm (Electron ones are critical/high severity)

Open
#40 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
450
Forks
45
PR merge metrics
No merged PRs in 30d

Description

`npm audit` results below:

```bash
=== npm audit security report ===

# Run npm install electron@2.0.2 to resolve 3 vulnerabilities
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Chromium Remote Code Execution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/539 │
└───────────────┴──────────────────────────────────────────────────────────────┘

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Code Execution by Re-enabling Node.js integration │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/574 │
└───────────────┴──────────────────────────────────────────────────────────────┘

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical │ Remote Code Execution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/563 │
└───────────────┴──────────────────────────────────────────────────────────────┘

# Run npm install sheetify@7.3.2 to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Sandbox Breakout / Arbitrary Code Execution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ static-eval │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ sheetify │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ sheetify > static-eval │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/548 │
└───────────────┴──────────────────────────────────────────────────────────────┘

found 4 vulnerabilities (1 moderate, 2 high, 1 critical) in 1500 scanned packages
4 vulnerabilities require semver-major dependency updates.
```

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Run npm audit to confirm the four reported vulnerabilities and inspect the dependency declarations for electron and sheetify. Update the affected dependencies while checking for the stated semver-major impact, then rerun npm audit and verify that the application still starts.

Written by the indexing model from the issue text.

Assessment

Tech stack
electron, javascript
Domain
desktop, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.