browserstack/browserstack-local-nodejs

Security issue in ps-tree dependency

Closed this issue · 5 comments

cuongluu8 commented

There's a security vulnerability in event-stream, which is used by ps-tree.
More details here - indexzero/ps-tree#33. Not sure if ps-tree is still being maintained, so it might be a good idea to use an alternative library.

punitx commented

@cuongluu8 Thank you so much for giving us a heads up regarding the security issue. We have started working on a fix and will release the fix soon.

raghuhit commented

@cuongluu8 Thank you for raising this issue, for now we have removed the dependency of ps-tree and released a new version.

indexzero commented

FYI ps-tree@1.1.1 locked to event-stream@3.3.4 (which if I read the thread correctly pre-dates the questionable changes).

Thanks to folks for bringing it to my attention: indexzero/ps-tree#34

zubhav commented

Thanks for raising!

raghuhit commented

Released new version 1.3.7 which is locked to ps-tree's version 1.1.1

  • 👍2
  • 🎉1
  • ❤️1