mapbox / mapbox/mapbox-gl-directions
Mapbox Directions depends on vulnerable versions of lodash.template
- Dominant language
- JavaScript
- Stars
- 255
- Forks
- 130
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
I'm starting to work with mapbox directions but I'm having a hard time installing the api and using it. After running "npm install @mapbox/mapbox-directions"
I'm getting the following error:
lodash.template *
Severity: high
Command Injection in lodash - https://github.com/advisories/GHSA-35jh-r3h4-6jhm
No fix available
node_modules/lodash.template
@mapbox/mapbox-gl-directions *
Depends on vulnerable versions of lodash.template
node_modules/@mapbox/mapbox-gl-directions
Is there something that I need to update on my end?
Thanks!
Contributor guide
Research direction
The issue names no source file, test, or entry point; begin by reproducing the npm install output and inspecting the dependency tree for @mapbox/mapbox-gl-directions and lodash.template. Done would require a supported dependency resolution that removes the high-severity advisory, with installation and security checks passing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100