search

quaertym / ember-cli-dependency-checker

Ember CLI addon for checking missing node and bower dependencies before running ember commands
MIT License
40 stars 38 forks source link

Transitive dependency on unset-value/1.0.0 #147

Open janpospisil-eaton opened 2 months ago

janpospisil-eaton commented 2 months ago

Hi, our last cyber security scan resulted in a high risk being detected regarding the unset-value dependency that is used within this project. Can you update the find-yarn-workspace-root library and use latest version 2.0.0 ? Are there any other ways how to resolve the issue ?

Thank you.

janpospisil-eaton commented 1 month ago

Hi again,

unset-value is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code, or cause a denial-of-service (DoS) by tricking the library into modifying or adding properties of Object.prototype.

The fix is in 2.0.1 version: https://github.com/jonschlinkert/unset-value/releases

Can you update the find-yarn-workspace-root library and use latest version 2.0.0 ? Are there any compatibility issues with other dependencies ? Does it require broader re-factoring ?

Thank you, Jan