search

yargs / cliui

easily create complex multi-column command-line-interfaces.
ISC License
371 stars 41 forks source link

CLIUI Vulnerable to Inefficient Regular Expression Complexity #148

Open Hunter343 opened 1 year ago

Hunter343 commented 1 year ago

CLIUI is using string-width 4.2.0, strip-ansi 6.0.0, and wrap-ansi 7.0.0 which all use ansi-regex 5.0.1 which contains a known vulnerability (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3807). Updating these packages to the new major version will resolve this vulnerability

shadowspawn commented 1 year ago

The new major versions are a challenge due to changes in supported runtimes. However, we wanted to find a way forward to have word wrapping supported in ESM anyway.

The dependencies are updated in PR #143