max-mapper / max-mapper/nugget
Security Alert from CVE-2021-33623
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 178
- Forks
- 29
- PR merge metrics
- No merged PRs in 30d
Description
nugget's dependencies contain pretty-bytes "^1.0.2" which is a legacy package, pretty-bytes's dependencies contain meow "^3.1.0", meow's dependencies contain trim-newlines "^1.0.0" which is vulnerable. the trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method. you'd better upgrade pretty-bytes
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting nugget's dependency declarations and the resolved dependency tree to confirm how pretty-bytes brings in the vulnerable trim-newlines version. Update the dependency path so the vulnerable range is no longer installed, then run the project's available checks and verify the dependency tree contains a fixed version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100