search

mitre-attack / attack-navigator

Web app that provides basic navigation and annotation of ATT&CK matrices
https://mitre-attack.github.io/attack-navigator
Apache License 2.0
2.01k stars 593 forks source link

No fix available (is_js *) #637

Closed leeliu48307 closed 6 months ago

leeliu48307 commented 6 months ago

Build app by npm install, got a lot dependance warning. Using npm audit, got the following error is_js* Severity: High is_js vulerability du to Regular Expression Denial of Service. No fix available node_modules/is_js.

I searched google and got the same error message. 'No fix available'. How to fix it, thanks.

clemiller commented 6 months ago

Hi @leeliu48307,

The vulnerability you've encountered in the is_js package is due to a known issue with ReDoS (is_js GitHub Advisory), specifically in versions 0.9.0 and earlier. The is_js package does not have an available fix for this issue, and as such, we cannot patch this vulnerability within our project. The responsibility to fix this lies with the maintainers of is_js.

It's important to note that despite the vulnerability in the package, the application should still run as expected. Vulnerabilities like these typically pose a risk in scenarios where untrusted input is processed, leading to denial of service attacks. Running the application locally should not present a significant issue if proper security practices are followed and protected from untrusted inputs.

leeliu48307 commented 6 months ago

Understood, it makes sence. Will follow it, thanks.