New vulnerabilities in dependent versions of Moment.js and sync-exec (which is probably not needed by node anymore)
Closed this issue · 3 comments
$ npm audit
=== npm audit security report ===
┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Regular Expression Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ moment │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=2.19.3 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gradle [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gradle > xutil > moment │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/532 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Tmp files readable by other users │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ sync-exec │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ No patch available │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gradle [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ gradle > xutil > ipv4 > copy-paste > sync-exec │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/310 │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 2 vulnerabilities (1 low, 1 moderate) in 305 scanned packages
2 vulnerabilities require manual review. See the full report for details.
$
I have the same issue, and have been working through it for days to no avail.
the dependency is:
gradle > xutil > ipv4 > copy-paste > sync-exec
last update by copy-paste is in 2016 and this issue is already raised there:
https://github.com/xavi-/node-copy-paste/issues/61
sync-exec has not been updated since 2015:
https://github.com/gvarsanyi/sync-exec
we could probably change copy-paste to something else in ipv4? @xudafeng