search

Surnet / swagger-jsdoc

Generates swagger/openapi specification based on jsDoc comments and YAML files.
MIT License
1.66k stars 224 forks source link

security vulnerability in glob@7.1.6 dependency minimatch@3.0.4 #350

Closed TejaJag closed 1 year ago

TejaJag commented 1 year ago

swagger-jsdoc latest version is using glob@7.1.6 which uses minimatch@3.0.4.

└─┬ swagger-jsdoc@6.2.8 └─┬ glob@7.1.6 └── minimatch@3.0.4

This Minimatch package contains a regular expression denial-of-service (ReDoS) vulnerability because of improper input validation. An attacker could exploit this flaw by calling the braceExpand() function with specific arguments.

Updating glob to latest version(or major version 8) will fix this.

image
stale[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.