mysticatea / npm-run-all

A CLI tool to run multiple npm-scripts in parallel or sequential.
MIT License
5.72k stars 240 forks source link

high vulnerability issue in dependent package minimatch #252

Open ahernandez111 opened 1 year ago

ahernandez111 commented 1 year ago

Description: minimatch package versions before 3.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS). It's possible to cause a denial of service when calling function braceExpand (The regex /{.*}/ is vulnerable and can be exploited).

Solution: Update minimatch version 3.0.4 to 3.0.5.

Vulnerability Link : https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6

Reference: https://github.com/grafana/grafana-image-renderer/issues/329