search

dvajs / dva

🌱 React and redux based, lightweight and elm-style framework. (Inspired by elm and choo)
https://dvajs.com/
MIT License
16.24k stars 3.17k forks source link

[SECURITY] Prototype Pollution in immer < 8.0.1 #2417

Closed crudo closed 3 years ago

crudo commented 3 years ago

Version 8.0.1 contains a fix for this vulnerability, please update.

CVE-2020-28477 Vulnerable versions: < 8.0.1 Patched version: 8.0.1

See https://github.com/advisories/GHSA-9qmh-276g-x5pj

https://github.com/dvajs/dva/blob/fa5b8a4809d92466c8c2950d4235855830d37c1e/packages/dva-immer/package.json#L10

Please upgrade as soon as possible.

There is already PR https://github.com/dvajs/dva/pull/2415.

crudo commented 3 years ago

@sorrycc Hi, can you please look at this and merge #2415?

Are you looking for help you maintaining this project?

crudo commented 3 years ago

@sorrycc ping :)

crudo commented 3 years ago

Thanks!

sorrycc commented 3 years ago