You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We are finding issue with the underscore library being add as a dependency for cfenv module while deployment.See the details below
VULNERABILITY INFO
Name: CVE-2021-23358
Library: underscore-1.9.2.tgz
Library Paths: node_modules/cfenv/node_modules/underscore/package.json
Severity: HIGH
Description: The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
TOP FIX
Fix Resolution: underscore - 1.12.1,1.13.0-2
Message: Upgrade to version
Any help would be appreciated
The text was updated successfully, but these errors were encountered:
I've closed PR #48, and opened PR #50 for this instead. Should be ready to go. An npm audit of the production deps seems clean. I'll wait a bit to merge to see if anyone else wants to verify the new versions.
We are finding issue with the underscore library being add as a dependency for cfenv module while deployment.See the details below
VULNERABILITY INFO
Name: CVE-2021-23358
Library: underscore-1.9.2.tgz
Library Paths: node_modules/cfenv/node_modules/underscore/package.json
Severity: HIGH
Description: The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
TOP FIX
Fix Resolution: underscore - 1.12.1,1.13.0-2
Message: Upgrade to version
Any help would be appreciated
The text was updated successfully, but these errors were encountered: