search

shakacode / sass-resources-loader

SASS resources (e.g. variables, mixins etc.) loader for Webpack. Also works with less, post-css, etc.
MIT License
980 stars 66 forks source link

async 3.2.0 dependency is vulnerable to CVE-2021-43138 #153

Closed ian-hutchinson closed 2 years ago

ian-hutchinson commented 2 years ago

Versions of async below 3.2.2 are susceptible to prototype pollution.

Github advisory: https://github.com/advisories/GHSA-fwr7-v2mv-hh25 Snyk: https://security.snyk.io/vuln/SNYK-JS-ASYNC-2441827

Opening issue to attach my PR to update dep to.

justin808 commented 2 years ago

Fixed in 2.2.5.