search

vuejs / vue-cli

🛠️ webpack-based tooling for Vue.js Development
https://cli.vuejs.org/
MIT License
29.78k stars 6.33k forks source link

Security vulnerability - Uncontrolled Resource Consumption in ansi-html #7165

Closed Skrigueztep closed 2 years ago

Skrigueztep commented 2 years ago

Version

5.0.1

Environment info

System:
    OS: Windows 10 10.0.19042
    CPU: (16) x64 AMD Ryzen 7 4800H with Radeon Graphics
  Binaries:
    Node: 14.18.1 - D:\nodejs\node.EXE
    Yarn: Not Found
    npm: 6.14.15 - D:\nodejs\npm.CMD
  Browsers:
    Chrome: Not Found
    Edge: Spartan (44.19041.1266.0), Chromium (101.0.1210.53)
  npmPackages:
    @fortawesome/vue-fontawesome: ^0.1.10 => 0.1.10
    @vue/babel-helper-vue-jsx-merge-props:  1.2.1
    @vue/babel-helper-vue-transform-on:  1.0.2
    @vue/babel-plugin-jsx:  1.1.1
    @vue/babel-plugin-transform-vue-jsx:  1.2.1
    @vue/babel-preset-app:  5.0.1
    @vue/babel-preset-jsx:  1.2.4
    @vue/babel-sugar-composition-api-inject-h:  1.2.1
    @vue/babel-sugar-composition-api-render-instance:  1.2.4
    @vue/babel-sugar-functional-vue:  1.2.2
    @vue/babel-sugar-inject-h:  1.2.2
    @vue/babel-sugar-v-model:  1.2.3
    @vue/babel-sugar-v-on:  1.2.3
    @vue/cli-overlay:  5.0.1
    @vue/cli-plugin-babel: ^5.0.1 => 5.0.1
    @vue/cli-plugin-e2e-nightwatch: ^5.0.1 => 5.0.1
    @vue/cli-plugin-eslint: ^5.0.1 => 5.0.1
    @vue/cli-plugin-router: ^5.0.1 => 5.0.1
    @vue/cli-plugin-unit-jest: ^5.0.1 => 5.0.1
    @vue/cli-plugin-vuex: ^5.0.1 => 5.0.1
    @vue/cli-service: ^5.0.1 => 5.0.1
    @vue/cli-shared-utils:  5.0.1
    @vue/component-compiler-utils:  3.3.0
    @vue/eslint-config-airbnb: ^5.3.0 => 5.3.0
    @vue/test-utils: ^1.1.4 => 1.3.0
    @vue/vue2-jest: ^27.0.0-alpha.3 => 27.0.0-alpha.4
    @vue/web-component-wrapper:  1.3.0
    eslint-plugin-vue: ^7.14.0 => 7.20.0
    jest-serializer-vue:  2.0.2
    vue: ^2.6.12 => 2.6.14
    vue-axios: ^2.0.2 => 2.1.5
    vue-bem-generator: ^1.0.3 => 1.0.3
    vue-cc-input: ^0.1.22 => 0.1.22
    vue-cli-webpack:  1.0.0
    vue-eslint-parser:  7.11.0
    vue-hot-reload-api:  2.3.4
    vue-i18n: ^7.8.0 => 7.8.1
    vue-loader:  17.0.0 (15.9.8)
    vue-mask-directive: ^1.0.4 => 1.0.4
    vue-router: ^3.5.1 => 3.5.3
    vue-slick: ^1.1.16 => 1.1.16
    vue-style-loader:  4.1.3
    vue-svgicon: ^3.2.9 => 3.2.9
    vue-template-compiler: ^2.6.12 => 2.6.14
    vue-template-es2015-compiler:  1.9.1
    vue-ultra-sidenav: ^1.1.0 => 1.1.0
    vuejs-datepicker: ^1.5.4 => 1.6.2
    vuex: ^3.6.2 => 3.6.2
    vuex-router-sync: ^5.0.0 => 5.0.0
  npmGlobalPackages:
    @vue/cli: Not Found

Steps to reproduce

create a new vue (2) project execute npm audit

What is expected?

No vulnerabilities

What is actually happening?

Critical vulnerability in ansi-html by webpack-dev-server

Please update webpack-dev-server to v4.9.1

Skrigueztep commented 2 years ago

At fix it, vulnerabilities solved:

sodatea commented 2 years ago

See https://github.com/vuejs/vue-cli/issues/7164#issuecomment-1143106411