Critical vulnerability in simple-plist package (Prototype Pollution using .parse())

apache / cordova-node-xcode

Apache cordova

Apache License 2.0

190 stars 97 forks source link

Critical vulnerability in simple-plist package (Prototype Pollution using .parse()) #124

Open Sujay-shetty opened 2 years ago

Sujay-shetty commented 2 years ago

Hi,

There is a critical vulnerability found in plist which is used in simple-plist. According to below commit this has been fixed in plist and simple-plist.

https://github.com/wollardj/simple-plist/issues/60

Could you please update simple-plist package to 1.3.1 version

Thanks, Sujay

breautek commented 2 years ago

You should be able to reinstall or run npm update to have the dependency patched in.