react-native-web-community/react-native-web-maps

Minor security issue

Opened this issue · 0 comments

byCedric commented

Hi! I have noticed a minor security issue, reported by npm audit, regarding a dependency of this project. It's related to an older version of lodash@<4.17.5 allowing to pollute the prototype namespace by using the merge methods. The exact security report can be found here, https://nodesecurity.io/advisories/577. I also added the full report below.

I know that this project doesn't use lodash itself, but it does include an older version of react-google-maps. You can see this in de added dependency chain. This older version of react-google-maps includes the affected lodash dependency. Luckily, react-google-maps has fixed this issue in versions starting at 8.0.0.

I would recommend update this dependency to >=8.0.0, currently they are at 9.4.5. There is only 1 breaking change when migrating from 7.3.0 to 8.0.0, one of which im not exactly sure if it affects this library (https://github.com/tomchentw/react-google-maps/blob/v8.0.0/CHANGELOG.md#breaking-changes).

Let me know if I can do anything to help resolving this, by creating a PR for example. 😄

Cheers,
Cedric

The dependency chain

<our-project>
└─┬ expo@27.0.2
  └─┬ react-native-web-maps@0.1.0
    └─┬ react-google-maps@7.3.0
      └── lodash@4.16.2

The full report by npm audit

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.5                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ expo                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ expo > react-native-web-maps > react-google-maps > lodash    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/577                       │
└───────────────┴──────────────────────────────────────────────────────────────┘