Operating System: Affects all Node Version: v12.4.0 NPM Versio

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

I've publish a fork of <a href="https://www.npmjs.com/package/loader-fs-cache" rel="no

Indeed it is also coming from standard-version, <div class="snippet-clipboard-cont

Related to this issue in loader-fs-cache : <a class="issue-link js-issue-link" data-er

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

It loks like <a class="user-mention notranslate" data-hovercard-type="user" data-hover

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

please update minimist due to prototype pollution (CVE-2020-7598) about eslint-loader HOT 8 CLOSED

OZZlE commented on June 3, 2024 13

please update minimist due to prototype pollution (CVE-2020-7598)

from eslint-loader.

Comments (8)

ricardogobbosouza commented on June 3, 2024 2

@OZZlE v3.0.4

from eslint-loader.

neokeld commented on June 3, 2024 1

I've publish a fork of https://www.npmjs.com/package/loader-fs-cache (repo https://github.com/viankakrisna/loader-fs-cache) to fix this issue here : https://www.npmjs.com/package/create-fs-cache (repo https://github.com/neokeld/create-fs-cache)
@webmaster128 has published a pull request to the original lib loader-fs-cache and i hope it will be merged soon by @viankakrisna
But if it is needed i will maintain my fork.

from eslint-loader.

neokeld commented on June 3, 2024 1

Indeed it is also coming from standard-version,

|---------------|--------------------------------------------------------------|
| Low           | Prototype Pollution                                          |
|---------------|--------------------------------------------------------------|
| Package       | minimist                                                     |
|---------------|--------------------------------------------------------------|
| Patched in    | >=0.2.1 <1.0.0 || >=1.2.3                                    |
|---------------|--------------------------------------------------------------|
| Dependency of | standard-version [dev]                                       |
|---------------|--------------------------------------------------------------|
| Path          | standard-version > conventional-changelog >                  |
|               | conventional-changelog-core > conventional-changelog-writer  |
|               | > handlebars > optimist > minimist                           |
|---------------|--------------------------------------------------------------|
| More info     | https://npmjs.com/advisories/1179                            |
|---------------|--------------------------------------------------------------|

There is an ongoing pull request on handlebars to fix this vuln : handlebars-lang/handlebars.js#1662

from eslint-loader.

neokeld commented on June 3, 2024

Related to this issue in loader-fs-cache : viankakrisna/loader-fs-cache#5

from eslint-loader.

neokeld commented on June 3, 2024

@viankakrisna has published a new version (1.0.3) of loader-fs-cache with the fix.

from eslint-loader.

vilbergs commented on June 3, 2024

I forked to see if this was an easy fix. Seems that the vulnerability is bubbling up from standard-version.

I assume there's no direct action to be taken here.

from eslint-loader.

OZZlE commented on June 3, 2024

It loks like @neokeld committed a fix but I don't see any new release version.. I took the work time to revisit this again now that I saw it was 'fixed' but it doesn't seem to be.. I installed latest..

from eslint-loader.

ricardogobbosouza commented on June 3, 2024

@OZZlE I haven't launched yet

from eslint-loader.

Recommend Projects