wingsuit-designsystem / wingsuit

Twig for Storybook
GNU General Public License v2.0
91 stars 16 forks source link

Babel vulnerable to arbitrary code execution #288

Open joelpittet opened 1 month ago

joelpittet commented 1 month ago

Describe the bug There are 1 critical security "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code" found in @wingsuit-designsystem/storybook and @wingsuit-designsystem/preset-drupal

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ critical      │ Babel vulnerable to arbitrary code execution when compiling  │
│               │ specifically crafted malicious code                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ babel-traverse                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @wingsuit-designsystem/storybook                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @wingsuit-designsystem/storybook > babel-traverse            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1096879                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ critical      │ Babel vulnerable to arbitrary code execution when compiling  │
│               │ specifically crafted malicious code                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ babel-traverse                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @wingsuit-designsystem/preset-drupal                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @wingsuit-designsystem/preset-drupal >                       │
│               │ @wingsuit-designsystem/storybook > babel-traverse            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1096879                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

To Reproduce Steps to reproduce the behavior:

  1. Run yarn audit

Expected behavior No security vulnerabilities is ideal, but in this case just the criticals

Desktop (please complete the following information):

Additional context I tried to submit a Pull Request but I was not sure exactly how it's integrated, the fix should be just upgrading to a supported version of babel 7 https://babeljs.io/docs/v7-migration