typestack / routing-controllers

Create structured, declarative and beautifully organized class-based controllers with heavy decorators usage in Express / Koa using TypeScript and Routing Controllers Framework.
MIT License
4.42k stars 394 forks source link

CVE-2024-21538 & CVE-2024-21538 #1458

Open matthew2564 opened 2 weeks ago

matthew2564 commented 2 weeks ago

High & Medium severity vulnerability reported by Snyk

Issues with no direct upgrade or patch:
  ✗ Cross-site Scripting (XSS) [Medium Severity][https://security.snyk.io/vuln/SNYK-JS-COOKIE-8163060] in cookie@0.5.0
    introduced by routing-controllers@0.10.4 > cookie@0.5.0
  This issue was fixed in versions: 0.7.0

  ✗ Regular Expression Denial of Service (ReDoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230] in cross-spawn@7.0.3
    introduced by routing-controllers@0.10.4 > glob@10.3.12 > foreground-child@3.1.1 > cross-spawn@7.0.3
  This issue was fixed in versions: 7.0.5

Can a new version please be published with upgrades for these both?

Thanks.