karolbrennan / letsplaybingo.2020

Let's Play Bingo - 2020 Edition
http://2020.letsplaybingo.io
MIT License
18 stars 13 forks source link

package.json update #99

Open ansimmons opened 1 year ago

ansimmons commented 1 year ago

Hey Karol,

I wanted to inform you about a few vulnerabilities within the code. I hope this was okay to do.

Introduced through react-scripts@5.0.0 Fixed in nth-check@2.0.1

Detailed paths

Introduced through: letsplaybingo-react@3.2.1 › react-scripts@5.0.0 › @svgr/webpack@5.5.0 › @svgr/plugin-svgo@5.5.0 › svgo@1.3.2 › css-select@2.1.0 › nth-check@1.0.2

NVD: [CVSS 7.5](https://nvd.nist.gov/vuln/detail/CVE-2021-3803) - High Severity

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when parsing crafted invalid CSS nth-checks, due to the sub-pattern \s(?:([+-]?)\s(\d+))? in RE_NTH_ELEMENT with quantified overlapping adjacency.

Also,

loader-utils Prototype Pollution, loader-utils, Regular Expression Denial of Service (ReDoS), nwsapi Denial of Service, minimatch Regular Expression Denial of Service (ReDoS), and terser Regular Expression Denial of Service should be updated as well.

Respectfully, ~Anane.