A dependency of this repository contains a critical VM escape vulnerability

[Southclaws]

Details here:

• https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac
• https://nvd.nist.gov/vuln/detail/CVE-2023-32314

Dependency tree:

• ibm-openapi-validator
• @stoplight/spectral-cli
• proxy-agent
• pac-proxy-agent
• pac-resolver
• degenerator
• vm2

Vulnerable code does not seem to be used at any point in the dependency stack, for reference this is where it's called: https://github.com/TooTallNate/proxy-agents/blob/95729e1563fb4d6edcb7287bdd7e1a8126016da4/packages/pac-resolver/src/index.ts#L48-L53

Related issues:

• https://github.com/stoplightio/spectral/issues/2510
• https://github.com/TooTallNate/proxy-agents/issues/218

[padamstx]

@Southclaws Thanks for opening the issue. We are waiting a bit in hopes that the @stoplight/spectral-cli package will have a new release soon which addresses this vulnerability. Alternatively, if one of its transitive dependencies (proxy-agent, pac-proxy-agent, etc.) publishes a new version that no longer uses vm2, we could potentially use "overrides" in package.json to force the use of a new transitive dependency by spectral-cli. Rest assured, we're keeping an eye on this situation.

[padamstx]

It turns out that a new version of proxy-agent (direct dependency of spectral-cli) is available today that removes the "vm2" dependency altogether.

[ibm-devx-sdk]

:tada: This issue has been resolved in version 1.2.0 :tada:

The release is available on npm package (@latest dist-tag)

Your semantic-release bot :package::rocket:

[ibm-devx-sdk]

:tada: This issue has been resolved in version 1.2.0 :tada:

The release is available on npm package (@latest dist-tag)

Your semantic-release bot :package::rocket:

[ibm-devx-sdk]

:tada: This issue has been resolved in version 1.2.0 :tada:

The release is available on npm package (@latest dist-tag)

Your semantic-release bot :package::rocket: