muxinc / strapi-plugin-mux-video-uploader

A Strapi plugin for managing uploads to Mux.
https://mux.com
23 stars 16 forks source link

[Snyk] Fix for 5 vulnerabilities #57

Open snyk-bot opened 1 year ago

snyk-bot commented 1 year ago

Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.

Changes included in this PR

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory. If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 534/1000
Why? Has a fix available, CVSS 6.4
Improper Authentication
SNYK-JS-JSONWEBTOKEN-3180022
Yes No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5
Improper Restriction of Security Token Assignment
SNYK-JS-JSONWEBTOKEN-3180024
Yes No Known Exploit
medium severity 554/1000
Why? Has a fix available, CVSS 6.8
Use of a Broken or Risky Cryptographic Algorithm
SNYK-JS-JSONWEBTOKEN-3180026
Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
Regular Expression Denial of Service (ReDoS)
SNYK-JS-LUXON-3225081
No Proof of Concept
medium severity 454/1000
Why? Has a fix available, CVSS 4.8
Undesired Behavior
SNYK-JS-STYLEDCOMPONENTS-3149924
No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: šŸ§ View latest project report

šŸ›  Adjust project settings

šŸ“š Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

šŸ¦‰ Use of a Broken or Risky Cryptographic Algorithm šŸ¦‰ Regular Expression Denial of Service (ReDoS)

jaredsmith commented 1 year ago

@erikpena, can you please take a look at this PR, and make sure it doesn't break the uploader?