search

ecomplus / app-pag-seguro

MIT License
0 stars 0 forks source link

chore(deps): update dependency json-ptr to 3.0.0 [security] - abandoned #13

Open renovate[bot] opened 3 years ago

renovate[bot] commented 3 years ago

Mend Renovate

This PR contains the following updates:

Package Change
json-ptr 1.3.2 -> 3.0.0

GitHub Vulnerability Alerts

GHSA-rrqv-vjrw-hrcr

There is a security vulnerability in json-ptr versions prior to v2.1.0 in which an unscrupulous actor may execute arbitrary code. If your code sends un-sanitized user input to json-ptr's .get() method, your project is vulnerable to this injection-style vulnerability.

CVE-2020-7766

npm json-ptr before 2.0.0 has an arbitrary code execution vulnerability. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.

CVE-2021-23509

This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.

renovate[bot] commented 1 year ago

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.