critical: ReDoS vulnerability from inquirer v8.2.0

commitizen / cz-cli

The commitizen command line utility. #BlackLivesMatter

http://commitizen.github.io/cz-cli/

MIT License

16.89k stars 552 forks source link

critical: ReDoS vulnerability from inquirer v8.2.0 #883

Open ChidanandanP opened 2 years ago

ChidanandanP commented 2 years ago

Hi Team, there is a high vulnerability found in ansi-regex library for Regular Expression Denial of Service (ReDoS). This library is used by inquirer v8.2.0.

Please increase the inquirer library to latest version. Already a PR is open for that, please merge it as soon as possible: https://github.com/commitizen/cz-cli/pull/874

Refer the below urls to find more about vulnerability

https://snyk.io/advisor/npm-package/inquirer https://snyk.io/vuln/npm:ansi-regex

OmgImAlexis commented 2 years ago

https://github.com/commitizen/cz-cli/pull/874 has been merged and new release is out with the changes included. This can be closed.