search

Element84 / filmdrop-ui

A web UI to search and display results from the FilmDrop STAC API.
Other
23 stars 1 forks source link

Resolve latest round of vite CVEs (5 moderate) #406

Closed parksjr closed 2 weeks ago

parksjr commented 3 weeks ago

Relatively new CVE's posted to GH's advisory board, and being reported in the audit hook.

╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
║                                                                            === npm audit security report ===                                                                             ║
║                                                                                                                                                                                          ║
║ ID      │ Module     │ Title                                              │ Paths                                   │ Sev.     │ URL                                               │ Ex. ║
║ 1098681 │ micromatch │ Regular Expression Denial of Service (ReDoS) in    │ micromatch                              │ moderate │ https://github.com/advisories/GHSA-952p-6rrq-rcjv │ n   ║
║         │            │ micromatch                                         │                                         │          │                                                   │     ║
║ 1099690 │ vite       │ Vite DOM Clobbering gadget found in vite bundled   │ @types/vite-plugin-react-svg>vite       │ moderate │ https://github.com/advisories/GHSA-64vr-g452-qvp3 │ n   ║
║         │            │ scripts that leads to XSS                          │ vite                                    │          │                                                   │     ║
║ 1099692 │ vite       │ Vite DOM Clobbering gadget found in vite bundled   │ @types/vite-plugin-react-svg>vite       │ moderate │ https://github.com/advisories/GHSA-64vr-g452-qvp3 │ n   ║
║         │            │ scripts that leads to XSS                          │ vite                                    │          │                                                   │     ║
║ 1099695 │ vite       │ Vite's `server.fs.deny` is bypassed when using     │ @types/vite-plugin-react-svg>vite       │ moderate │ https://github.com/advisories/GHSA-9cwx-2883-4wfx │ n   ║
║         │            │ `?import&raw`                                      │ vite                                    │          │                                                   │     ║
║ 1099697 │ vite       │ Vite's `server.fs.deny` is bypassed when using     │ @types/vite-plugin-react-svg>vite       │ moderate │ https://github.com/advisories/GHSA-9cwx-2883-4wfx │ n   ║
║         │            │ `?import&raw`                                      │ vite                                    │          │                                                   │     ║
╚═════════╧════════════╧════════════════════════════════════════════════════╧═════════════════════════════════════════╧══════════╧═══════════════════════════════════════════════════╧═════╝

Resolution:

Fix the CVE's