search

JedWatson / react-select

The Select Component for React.js
https://react-select.com/
MIT License
27.44k stars 4.1k forks source link

Vulnerability in yaml dependency #5779

Open chkp-eugenef opened 9 months ago

chkp-eugenef commented 9 months ago

Are you reporting a bug or runtime error?

Vulnerability

Output of running jf audit --extended-table in the project root directory:

┌──────────┬──────────────┬────────────┬────────────┬────────────┬──────────┬──────┬───────────────┬──────┬──────┬───────────┐
│ SEVERITY │ DIRECT       │ DIRECT     │ IMPACTED   │ IMPACTED   │ FIXED    │ TYPE │ CVE           │ CVSS │ CVSS │ ISSUE ID  │
│          │ DEPENDENCY   │ DEPENDENCY │ DEPENDENCY │ DEPENDENCY │ VERSIONS │      │               │ V2   │ V3   │           │
│          │              │ VERSION    │ NAME       │ VERSION    │          │      │               │      │      │           │
├──────────┼──────────────┼────────────┼────────────┼────────────┼──────────┼──────┼───────────────┼──────┼──────┼───────────┤
│ Medium   │ react-select │ 5.7.7      │ yaml       │ 1.10.2     │ [2.2.2,) │ npm  │ CVE-2023-2251 │      │      │ XRAY-N187 │
│          │              │            │            │            │          │      │               │      │      │           │
└──────────┴──────────────┴────────────┴────────────┴────────────┴──────────┴──────┴───────────────┴──────┴──────┴───────────┘

Need to update yaml dependency to the latest version.