piotrwitek / ts-mocha

Mocha thin wrapper that allows running TypeScript tests with TypeScript runtime (ts-node) to get rid of compilation complexity
MIT License
190 stars 25 forks source link

CVE-2022-46175 on module json5 < 1.0.2 #86

Open Omer-AV-MA opened 1 year ago

Omer-AV-MA commented 1 year ago

The library json5 is vulnerable to CVE-2022-46175, which exists in versions < 1.0.2.

severity: High (NVD severity: High).

This vulnerability has a known exploit available. Source: Github.

The vulnerability can be remediated by updating the library to any of the following versions 1.0.2, 2.2.2 or higher, using yarn upgrade json5.