Vulnerabilities: Command Injection + Arbitrary File Overwrite
sylwesterdigital opened this issue · 2 comments
sylwesterdigital commented
I am not able use your icons they seems not safe at the moment. Can you review below what npm audit produced?
$ npm audit
=== npm audit security report ===
┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical │ Command Injection │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ open │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >0.0.5 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ vue-unicons │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ vue-unicons > @iconscout/unicons > fontello-cli > open │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/663 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Arbitrary File Overwrite │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ fstream │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=1.0.12 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ vue-unicons │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ vue-unicons > @iconscout/unicons > fontello-cli > unzip > │
│ │ fstream │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/886 │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 2 vulnerabilities (1 high, 1 critical) in 20543 scanned packages
2 vulnerabilities require manual review. See the full report for details.
ross-crowdsmart commented
I would also like to use this package, but am getting the same report from npm audit.
antonreshetov commented
Closed because it was fixed in v2