-
-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SECURITY - Cucumber affected by Marak/colors.js#285 #1885
Comments
Malicious code introduced in colors.js v1.4.1 and 1.4.2 causes all versions of Cucumber.js to fall into an infinite loop; to avoid the issue, projects consuming Cucumber.js should specify an explicit dependency on colors 1.4.0 until cucumber/cucumber-js#1885 is addressed. For more information, see
Due to this incidence, it should raise our concerns of using third-party libraries. Perhaps, a viable and preferable way is to lock down the versions of the dependencies, especially for those being widely used. |
An update:
So I think the immediate work needed is done, between all of that. I've opened #1888 to deal with switching to chalk. Thanks again @mannyluvstacos for submitting the critical fix! |
Yes, big thanks @mannyluvstacos! |
…sue has now been addressed Offending versions of colors.js have been removed from npmjs.com Closes cucumber/cucumber-js#1885
Describe the bug
Malicious code introduced in
colors
version 1.4.1 and 1.4.2 causes Cucumber.js to fall into an infinite loop, printing gibberish to the terminal.CC: @davidjgoss @aslakhellesoy @jbpros
To Reproduce
Use any feature that prints to the terminal, for example:
Screenshots
If applicable, add screenshots to help explain your problem.
Desktop (please complete the following information):
cli-table3
and/orcolors
)TO FIX
Short term:
colors
to1.4.0
- see Zalgo issue withv1.4.44-liberty-2
release Marak/colors.js#285 (comment), or ideally"@dabh/colors": "1.4.0"
, since there's no guaranteecolors
1.4.0
will not get compromised nextcli-table3
to^0.6.1
- seecolors.js
has issues cli-table/cli-table3#251Long term:
colors
withchalk
Additional context
Add any other context about the problem here.
Marak/colors.js#285
The text was updated successfully, but these errors were encountered: