rishabhbhatia / react-native-awesome-alerts

Awesome alerts for React Native, works with iOS and Android.
MIT License
520 stars 71 forks source link

项目引用了shell-quote等637个开源组件,存在4个漏洞,建议升级 #107

Closed ghost closed 2 years ago

ghost commented 2 years ago

大佬,看你这个项目调用了shell-quote等637个开源组件,存在4个安全漏洞,建议你升级下。

漏洞标题:shell-quote 安全漏洞
漏洞编号:CVE-2021-42740
漏洞描述:
shell-quote是开源的一个软件包。用于解析和引用 shell 命令。
shell-quote package存在安全漏洞,攻击者可利用该漏洞可以植入任意代码从而执行相关操作。
影响范围:(∞, 1.7.3)
最小修复版本:1.7.3
引入路径:
react-native-awesome-alerts@1.5.2->react-native@0.64.1->@react-native-community/cli@5.0.1->@react-native-community/cli-hermes@5.0.1->@react-native-community/cli-tools@5.0.1->shell-quote@1.6.1
react-native-awesome-alerts@1.5.2->react-native@0.64.1->@react-native-community/cli@5.0.1->@react-native-community/cli-server-api@5.0.1->@react-native-community/cli-tools@5.0.1->shell-quote@1.6.1
react-native-awesome-alerts@1.5.2->react-native@0.64.1->@react-native-community/cli@5.0.1->@react-native-community/cli-tools@5.0.1->shell-quote@1.6.1
react-native-awesome-alerts@1.5.2->react-native@0.64.1->react-devtools-core@4.13.5->shell-quote@1.6.1
react-native-awesome-alerts@1.5.2->react-native@0.64.1->@react-native-community/cli-platform-android@5.0.1->@react-native-community/cli-tools@5.0.1->shell-quote@1.6.1
react-native-awesome-alerts@1.5.2->react-native@0.64.1->@react-native-community/cli-platform-ios@5.0.1->@react-native-community/cli-tools@5.0.1->shell-quote@1.6.1

另外3个漏洞 ,信息有点多我就不贴了,你自己看下完整报告:https://www.mfsec.cn/jr?p=ac6d89 你对这个issues有任何疑问可以回复我,我能看见哈。