Open isaacs opened 3 months ago
merlyn-at-netlify
commented
2 months ago Thanks, @isaacs. For context the impact is not very severe given the context that Netlify CLI runs in:
Affected versions of this package are vulnerable to Uncontrolled resource consumption due improper limitation of the number of characters it can handle, through the parse function. An attacker can cause the application to allocate excessive memory and potentially crash by sending imbalanced braces as input.
isaacs
commented
2 months ago Yeah, it's more annoying than actually hazardous, for sure. But such is life in a world that incentivizes getting your name on a CVE more than it does the subtle nuance of actual security.
G-Rath
commented
2 months ago Related:
I'd really love to see the shrinkwrapping go, as it makes our live a lot harder and would let me make a very solid case for moving us off Vercel as they pin their direct dependencies while also remaining very behind the ball
G-Rath
commented
1 month ago there's now a new micromatch vulnerability that we cannot update due to the shrinkwrap: GHSA-952p-6rrq-rcjv
cc @sarahetter
Describe the bug
Because this module ships with a shrinkwrap, it is impossible to avoid using the insecure
braces@3.0.2, even using overrides.Please either keep all dependencies up to date with security advisories, or remove the shrinkwrap from the deployment so that we can get security updates.
Steps to reproduce
Observe that
braces@3.0.2is present in the tree, and cannot be overridden, due to the npm-shrinkwrap.jsonConfiguration
Not relevant.
Environment
System: OS: macOS 14.5 CPU: (16) arm64 Apple M3 Max Memory: 14.46 GB / 128.00 GB Shell: 5.2.0 - /usr/local/bin/bash Binaries: Node: 20.13.1 - /usr/local/bin/node Yarn: 1.22.18 - /usr/local/bin/yarn npm: 10.7.0 - /usr/local/bin/npm pnpm: 9.2.0 - /usr/local/bin/pnpm bun: 1.1.6 - ~/bin/bun npmPackages: netlify-cli: ^17.29.0 => 17.29.0