Repository navigation
Security Issue Flagged by Snyk #10698
Description
Hi Guys,
Thanks for the awesome tool.
Could you investigate the vulnerabilities that Snyk flagged.
✗ Arbitrary Code Injection [Medium Severity][https://snyk.io/vuln/SNYK-JS-EJS-1049328] in ejs@2.7.4
introduced by react-scripts@4.0.3 > workbox-webpack-plugin@5.1.4 > workbox-build@5.1.4 > @surma/rollup-plugin-off-main-thread@1.4.2 > ejs@2.7.4
This issue was fixed in versions: 3.1.6
✗ Regular Expression Denial of Service (ReDoS) [Medium Severity][https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905] in glob-parent@3.1.0
introduced by react-scripts@4.0.3 > webpack@4.44.2 > watchpack@1.7.5 > watchpack-chokidar2@2.0.1 > chokidar@2.1.8 > glob-parent@3.1.0
This issue was fixed in versions: 5.1.2
✗ Regular Expression Denial of Service (ReDoS) [Medium Severity][https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY2-1079307] in html-parse-stringify2@2.0.1
introduced by react-i18next@11.8.10 > html-parse-stringify2@2.0.1
No upgrade or patch available
✗ Regular Expression Denial of Service (ReDoS) [Medium Severity][https://snyk.io/vuln/SNYK-JS-ISSVG-1085627] in is-svg@3.0.0
introduced by react-scripts@4.0.3 > optimize-css-assets-webpack-plugin@5.0.4 > cssnano@4.1.10 > cssnano-preset-default@4.0.7 > postcss-svgo@4.0.2 > is-svg@3.0.0
This issue was fixed in versions: 4.2.2
✗ Regular Expression Denial of Service (ReDoS) [High Severity][https://snyk.io/vuln/SNYK-JS-SSRI-1085630] in ssri@6.0.1
introduced by react-scripts@4.0.3 > webpack@4.44.2 > terser-webpack-plugin@1.4.5 > cacache@12.0.4 > ssri@6.0.1
This issue was fixed in versions: 8.0.1
Activity
candrews commentedon Mar 18, 2021
See https://snyk.io/vuln/SNYK-JS-SSRI-1085630
This issue is a duplicate of #10699
carbonphyber commentedon Mar 21, 2021
Note that the first comment is a dump of multiple security reports and the second only describes 1 and refers to another GH Issue about that 1 security issue. Issue #10699 is only a partial duplicate of #10698 (this Issue).
Linkifying the SNYK security reports:
ejs@2.7.4introduced byreact-scripts@4.0.3>workbox-webpack-plugin@5.1.4>workbox-build@5.1.4>@surma/rollup-plugin-off-main-thread@1.4.2>ejs@2.7.4. This issue was fixed in versions:3.1.6glob-parent@3.1.0introduced byreact-scripts@4.0.3>webpack@4.44.2>watchpack@1.7.5>watchpack-chokidar2@2.0.1>chokidar@2.1.8>glob-parent@3.1.0. This issue was fixed in versions:5.1.2html-parse-stringify2@2.0.1introduced byreact-i18next@11.8.10>html-parse-stringify2@2.0.1. No upgrade or patch available.is-svg@3.0.0introduced byreact-scripts@4.0.3>optimize-css-assets-webpack-plugin@5.0.4>cssnano@4.1.10>cssnano-preset-default@4.0.7>postcss-svgo@4.0.2>is-svg@3.0.0. This issue was fixed in versions:4.2.2ssri@6.0.1introduced byreact-scripts@4.0.3>webpack@4.44.2>terser-webpack-plugin@1.4.5>cacache@12.0.4>ssri@6.0.1. This issue was fixed in versions:8.0.1gregorymey-dev commentedon Mar 24, 2021
Thanks, I've noticed I accidently copied react-i18next@11.8.10 into the message, this section should not be there.
nj314 commentedon Apr 26, 2021
@gregorymey-dev This issue needs to be reopened as there is no other issue covering the
ejs@2.7.4vuln, which currently does not have a patch version available, soreact-scriptsneeds changes to produce an upgrade toejs@^3.1.6. As stated by @carbonphyber , this issue is only a partial duplicate of #10699 . We need this issue to capture the necessary major version upgrade fromejs2 to 3.gusliedke commentedon Apr 30, 2021
Indeed. This still needs to be fixed. We need to upgrade
ejs@2.7.4toejs@3.1.6.senkevichdv commentedon Jun 17, 2021
Any updates on this issue? I see this issue is still closed
gregorymey-dev commentedon Jun 17, 2021
Hi Guys,
Was out of circulation for a while, IO would want to re-open this case.
gaearon commentedon Jul 7, 2021
None of these issues affect how CRA uses these dependencies. There is nothing to address here.
#11174