Npm audit throws several vulnerabilities

[rab1]

I have installed latest package "jscodeshift": "^0.16.0", and executed npm audit.. it throws

7 vulnerabilities (3 high, 4 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

See detailed errors on

  {
  "auditReportVersion": 2,
  "vulnerabilities": {
    "babel-core": {
      "name": "babel-core",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "babel-helpers",
        "babel-register",
        "babel-template",
        "babel-traverse",
        "json5"
      ],
      "effects": [
        "babel-register",
        "jscodeshift"
      ],
      "range": "5.8.20 - 7.0.0-beta.3",
      "nodes": [
        "node_modules/babel-core"
      ],
      "fixAvailable": {
        "name": "jscodeshift",
        "version": "0.15.2",
        "isSemVerMajor": true
      }
    },
    "babel-helpers": {
      "name": "babel-helpers",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "babel-template"
      ],
      "effects": [],
      "range": "*",
      "nodes": [
        "node_modules/babel-helpers"
      ],
      "fixAvailable": true
    },
    "babel-register": {
      "name": "babel-register",
      "severity": "high",
      "isDirect": false,
      "via": [
        "babel-core"
      ],
      "effects": [
        "babel-core"
      ],
      "range": "*",
      "nodes": [
        "node_modules/babel-register"
      ],
      "fixAvailable": {
        "name": "jscodeshift",
        "version": "0.15.2",
        "isSemVerMajor": true
      }
    },
    "babel-template": {
      "name": "babel-template",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "babel-traverse"
      ],
      "effects": [
        "babel-helpers"
      ],
      "range": "*",
      "nodes": [
        "node_modules/babel-template"
      ],
      "fixAvailable": true
    },
    "babel-traverse": {
      "name": "babel-traverse",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1096879,
          "name": "babel-traverse",
          "dependency": "babel-traverse",
          "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code",
          "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92",
          "severity": "critical",
          "cwe": [
            "CWE-184",
            "CWE-697"
          ],
          "cvss": {
            "score": 9.4,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
          },
          "range": "<7.23.2"
        }
      ],
      "effects": [
        "babel-core",
        "babel-template"
      ],
      "range": "*",
      "nodes": [
        "node_modules/babel-traverse"
      ],
      "fixAvailable": {
        "name": "jscodeshift",
        "version": "0.15.2",
        "isSemVerMajor": true
      }
    },
    "jscodeshift": {
      "name": "jscodeshift",
      "severity": "high",
      "isDirect": true,
      "via": [
        "babel-core"
      ],
      "effects": [],
      "range": "0.3.5 - 0.3.20 || >=0.16.0",
      "nodes": [
        "node_modules/jscodeshift"
      ],
      "fixAvailable": {
        "name": "jscodeshift",
        "version": "0.15.2",
        "isSemVerMajor": true
      }
    },
    "json5": {
      "name": "json5",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1096543,
          "name": "json5",
          "dependency": "json5",
          "title": "Prototype Pollution in JSON5 via Parse Method",
          "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
          "severity": "high",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
          },
          "range": "<1.0.2"
        }
      ],
      "effects": [
        "babel-core"
      ],
      "range": "<1.0.2",
      "nodes": [
        "node_modules/babel-core/node_modules/json5"
      ],
      "fixAvailable": {
        "name": "jscodeshift",
        "version": "0.15.2",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 0,
      "high": 3,
      "critical": 4,
      "total": 7
    },
    "dependencies": {
      "prod": 182,
      "dev": 0,
      "optional": 0,
      "peer": 0,
      "peerOptional": 0,
      "total": 181
    }
  }
}

Any can advise on this ?

[Daniel15]

The risk is very minimal given the fact that the entire point of jscodeshift is to run user-supplied code, but we can bump the dependencies to resolve this issue.

[rab1]

@Daniel15 Could you bump the version and make patch release ?

[Daniel15]

Yes, I'll bump it tomorrow.

[Daniel15]

I figured out what happened. #588 bumped the babel-core dependency from 7.0.0-bridge.0 to 6.26.3, I guess since technically it's newer. This caused the security alerts to fire since all babel versions <7.23.2 have the issue.

The security warning is not a problem for jscodeshift though, since babel-core v6 is not actually used in jscodeshift. The only reference to babel-core instead of @babel/core was in the code that outputs the version when you run jscodeshift --version.

I updated that code to use @babel/core and removed the old babel-core package.

I've published a new package with the babel-core dependency removed as v0.16.1.