minimist package 1.2.5 has critical severity vulnerability

corona-warn-app / cwa-documentation

Project overview, general documentation, and white papers. The CWA development ends on May 31, 2023. You still can warn other users until April 30, 2023. More information:

https://coronawarn.app/en/faq/#ramp_down

Apache License 2.0

3.28k stars 345 forks source link

minimist package 1.2.5 has critical severity vulnerability #897

Closed MikeMcC399 closed 2 years ago

MikeMcC399 commented 2 years ago

Problem description

Dependabot alert shows "Prototype Pollution in minimist" with severity "Critical" for cwa-documentation with resolution "minimist": ">=1.2.6"

Steps to reproduce the issue

Execute:

npm audit

10 vulnerabilities (2 low, 3 moderate, 4 high, 1 critical)

minimist  <1.2.6
Severity: critical
Prototype Pollution in minimist - https://github.com/advisories/GHSA-xvch-5gv4-984h
fix available via `npm audit fix`
node_modules/minimist

Expected behavior

There should be no critical vulnerabilities flagged in the repository.

Possible Fix

Pin markdown-link-check to version ~3.8.7. This avoids failures which occur in versions 3.9 and 3.10 when executing npm run checklinks
Execute npm audit fix

MikeMcC399 commented 2 years ago

I plan to submit a PR to resolve this issue, unless the Open Source Team merges https://github.com/corona-warn-app/cwa-documentation/pull/875 (which solves the minimist issue, but not the markdown-link-check issue.)
Before submitting a new PR which affects package-lock.json I would wait for PR https://github.com/corona-warn-app/cwa-documentation/pull/896 to be merged, otherwise there will be a conflict.

larswmh commented 2 years ago

@MikeMcC399 thanks for your offer to submit a PR. We would appreciate it. Your previous PR #896 has been merged

MikeMcC399 commented 2 years ago

@larswmh

thanks for your offer to submit a PR. We would appreciate it. Your previous PR #896 has been merged.

Thanks for merging #896! I have now submitted #898 to solve this issue.

MikeMcC399 commented 2 years ago

PR #898 is merged and npm audit no longer shows any critical vulnerability. 8 vulnerabilities (2 low, 3 moderate, 3 high)