Vulnerability: axios (npm)

[WilliamHolmes]

A vulnerable version of the axios package is being included by cldr-data-downloader

https://www.cve.org/CVERecord?id=CVE-2023-45857

│ └─┬ cldr-data@36.0.1
│   └─┬ cldr-data-downloader@1.0.0-1
│     └── axios@0.26.1

[gan0928]

Any update?

[WilliamHolmes]

I guess there's a dependency on this ticket

[acofer]

https://github.com/rxaviers/cldr-data-npm/pull/85 would fix it, opened two weeks ago. Any maintainers around to let us know if that can be merged?

[neginkheradmandian]

• update cldr-data to last version
• update cldr-data-downlaoder to last version

• add

  "overrides": {
  "axios": "latest"
  }, 

  to package.json resolve this issue for me