Critical NPM vulnerability

[antonreshetov]

Command Injection in fontello-cli dependency
https://npmjs.com/advisories/663

[tarunmangukiya]

@antonreshetov Can you create a PR to fix this?

[yumecosmos]

Looks like this is fixed upstream.
Would be happy to make a PR, if that would be welcome, but I'm not totally clear on what the process is... do you have any guidelines for newbies?

[rubensr]

From what I can see all you need to do is apply this:

diff --git a/package.json b/package.json
index 7f9dc51..f0fbd82 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "async": "^2.6.1",
     "axios": "^0.19.0",
     "cheerio": "^1.0.0-rc.2",
-    "fontello-cli": "^0.4.0",
+    "fontello-cli": "^0.5.0",
     "fs-plus": "^3.1.1",
     "glob": "^7.1.3",
     "lodash": "^4.17.15",

then just npm install, which will update your package-lock.json.

[cypressious]

Any updates on this?

[tarunmangukiya]

Thanks to @cypressious for creating the PR.

I've merged it to the live and will release it in next update.