assaf / zombie

Insanely fast, full-stack, headless browser testing using node.js
http://zombie.js.org/
MIT License
5.65k stars 520 forks source link

Verify zombie is not vulnerable to CVE-2021-20066 #1211

Open johnstacy opened 3 years ago

johnstacy commented 3 years ago

CVE-2021-20066 is a vulnerability in jsdom that will not be fixed. It appears it is up to the users of jsdom to ensure they are not insecurely using it. According to the Red Hat writeup, there are only certain situations where a caller could be vulnerable. Just wanted to confirm that zombie is not using jsdom in an insecure manner.