search

cyntler / react-doc-viewer

File viewer for React.
https://cyntler.github.io/react-doc-viewer
Apache License 2.0
338 stars 119 forks source link

Security vulnerability in react-pdf@7.7.1 #250

Open Ryanv030 opened 2 months ago

Ryanv030 commented 2 months ago

Original vulnerability that affected react-pdf: https://github.com/advisories/GHSA-wgrm-67xf-hhpq

react-pdf fix: https://github.com/advisories/GHSA-87hq-q4gp-9wr4

Updating to react-pdf@7.7.3 will fix the issue.

Thanks!

cyntler commented 2 months ago

@Ryanv030 Try to use the latest version: https://github.com/cyntler/react-doc-viewer/releases/tag/v1.15.0. I updated the version.

Ryanv030 commented 2 months ago

Looks like that worked for fixing the security vulnerability, unfortunately we're still going to be getting flagged even though it's technically fixed.

The maintainer of react-pdf made a comment about his plans on fixing this in the future. (just in case you get more issues about this)

xiaolongkipsi commented 1 month ago

react-pdf is updated. Can it be upgraded so it won't get flagged?

xiaolongkipsi commented 1 month ago

9.0.0 https://github.com/wojtekmaj/react-pdf/releases