search

mdaines / viz-js

Graphviz in your browser
https://viz-js.com/
MIT License
4.1k stars 353 forks source link

DockerFile uses Expat 2.5.0 which is vulnerable for CVE-2023-52425 #244

Closed lievendf closed 6 months ago

lievendf commented 6 months ago

Hi,

viz.js got flagged during security scan for the reference to Expat 2.5.0 in the DockerFile. That version seems to be vulnerable for CVE-2023-52425. I don't know if this is a false positive for viz.js itself, but if it isn't can the Expat version be upgraded?

Regards, Lieven

mdaines commented 6 months ago

I don't know if this particular issue affects Viz.js or not, since it seems like it depends on how Expat is called by Graphviz? However, Expat 2.5.0 is a little bit behind, so I'll update it and make a Viz.js release soon. Thank you for the reminder.

mdaines commented 6 months ago

Released in 3.6.0.