Skip to content

Getting vulnerability of underscore module while deploying #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
yashtanu opened this issue Mar 31, 2021 · 3 comments
Closed

Getting vulnerability of underscore module while deploying #49

yashtanu opened this issue Mar 31, 2021 · 3 comments

Comments

@yashtanu
Copy link

We are finding issue with the underscore library being add as a dependency for cfenv module while deployment.See the details below

VULNERABILITY INFO
Name: CVE-2021-23358
Library: underscore-1.9.2.tgz
Library Paths: node_modules/cfenv/node_modules/underscore/package.json
Severity: HIGH
Description: The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

TOP FIX
Fix Resolution: underscore - 1.12.1,1.13.0-2
Message: Upgrade to version

Any help would be appreciated

@pmuellr
Copy link
Member

pmuellr commented Mar 31, 2021

I have a PR to update some of the dependencies, including underscore, here: PR #48 . Still have some work to do on it.

If it's any consolation, cfenv does not use the underscore template method, so you should be safe.

@pmuellr
Copy link
Member

pmuellr commented Apr 3, 2021

I've closed PR #48, and opened PR #50 for this instead. Should be ready to go. An npm audit of the production deps seems clean. I'll wait a bit to merge to see if anyone else wants to verify the new versions.

@pmuellr
Copy link
Member

pmuellr commented Apr 7, 2021

PR #50 has been merged, and version 1.2.4 has been published at npm.

@pmuellr pmuellr closed this as completed Apr 7, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants