microsoft / microsoft/AdaptiveCards
[Adaptivecards Templating]: adaptivecards-templating depends on vulnerable version of adaptive-expressions
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 2k
- Forks
- 595
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 1
Description
After installing the latest version of adaptivecards-templating, I'm getting a warning about critical vulnerability in the fast-xml-parser that is transitive dependency of adaptive-expressions:
npm audit report
fast-xml-parser 4.1.3 - 5.3.5
Severity: critical
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) - https://github.com/advisories/GHSA-jmr7-xgp7-cmfj
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names - https://github.com/advisories/GHSA-m7jm-9gc2-mpf2
fix available via npm audit fix
node_modules/fast-xml-parser
adaptive-expressions >=4.20.1-rc
Depends on vulnerable versions of fast-xml-parser
node_modules/adaptive-expressions
2 vulnerabilities (1 high, 1 critical)
Tried to fix with npm audit fix, but it does not fix the issue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the dependency declarations for adaptivecards-templating and adaptive-expressions, then run npm audit to reproduce the vulnerable fast-xml-parser report. Done means the dependency chain no longer selects the vulnerable versions and the audit reports no related vulnerability.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100