Comments (6)
from plato.
From: https://nodesecurity.io/advisories/577
Versions of lodash before 4.17.5 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via proto causing the addition or modification of an existing property that will exist on all objects.
Remediation
Update to version 4.17.5 or later.
@jsoverson Please fix this.
> npm audit
=== npm audit security report ===
Manual Review
Some vulnerabilities require your attention to resolve
Visit https://go.npm.me/audit-guide for additional guidance
Low Prototype Pollution
Package lodash
Patched in >=4.17.5
Dependency of plato [dev]
Path plato > lodash
More info https://nodesecurity.io/advisories/577
found 1 low severity vulnerability in 19605 scanned packages
1 vulnerability requires manual review. See the full report for details.
from plato.
@jsoverson any chance we can update the dependency to >=4.17.5?
from plato.
@jsoverson sorry for the direct mentioning again. But any chance we can update the dependency to >=4.17.5 for the matter of security?
from plato.
+1 please
from plato.
I totally understand the desire but I'm hesitant to accept and publish any changes because it makes this project appear maintained when it isn't. This project needs active maintainers and there aren't any. If there is a fork that has been generally accepted as the-next-best-repo then I can link to it in the readme.
from plato.
Related Issues (20)
- Complete ES6+ / ES7 / edge complexity reporting support HOT 4
- Example of how to combine with babel for ES6 module imports HOT 2
- Complexity Numbers are inconsistent (Main Page and Per-File)
- TypeError: undefined is not a function HOT 3
- Unexpected ESLint error "Newline required at end of file but not found." HOT 5
- Eslint config different from original
- Do you want a PR for es6-capability / eslint? HOT 4
- -x exclude files or folders is not working HOT 3
- Error running with node v6.9.1; Cannot read property 'lastIndexOf' HOT 3
- Security static analysis HOT 1
- Project maintenance HOT 24
- Plato is listing LintErrors not found with ESLint HOT 3
- Arrow functions are being shown as anonymous functions HOT 2
- Disable JSHint errors report HOT 1
- dynamic import causes SyntaxError: Unexpected token (37:30) HOT 1
- How to Specify Valid File Extensions?
- Not support async function
- runtime error, if path not existing HOT 1
- Plato HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from plato.