Closed tr3v3r closed 3 years ago
hi @tr3v3r I'll fix this but FYI: my library has open range dependency spec for handlebars: "^4"
and exact version is likely to be determined by your lockfile. I recommend you to review lockfiles in your application and consider upgrading this transitive dependency on your side via npm update
or yarn upgrade
without changing anything in react-native-ultimate-config.
thanks for the report!
published as part of 3.4.0
@maxkomarychev thanks for the response, but issue was resolved by updating to the last version of your package ( handlebars also updated ). We can close the issue
Describe the bug
SAST scanning of our app detected vulnerable dependency:
Description: `handlebars` before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
OS
Packages
react-native
: 0.64.2react-native-ultimate-config
: 3.2.3Additional context
It's critical for us since we can't move to PROD with this issue.