CVE-2022-37599 found on trivy scan cypress version 13.3.3

[eagle-txec]

Current behavior

Installed version is 1.4.0 A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.

Desired behavior

Upgrade fix versions are 1.4.2, 2.0.4, 3.2.1

Test code to reproduce

.

Cypress Version

13.3.3

Node version

16.20.2

Operating System

Debug Logs

"VulnerabilityID": "CVE-2022-37599",
          "InstalledVersion": "1.4.0",
          "LastModifiedDate": "2023-08-08T14:22:00Z"
        },
        {
          "CVSS": {
            "nvd": {
              "V3Score": 7.5,
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "ghsa": {
              "V3Score": 7.5,
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            },
            "redhat": {
              "V3Score": 7.5,
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            }
          },
          "Layer": {
            "DiffID": "sha256:e2ddedde812d03ee158150d58a19d4458068fc655e610b0b0e3e95b10b30c6af"
          },
          "PkgID": "loader-utils@1.4.0",
          "Title": "regular expression denial of service in interpolateName.js",
          "CweIDs": [
            "CWE-1333"
          ],
          "Status": "fixed",
          "PkgName": "loader-utils",
          "PkgPath": "src/.artifacts/.cache/Cypress/13.3.3/Cypress/resources/app/node_modules/loader-utils/package.json",
          "Severity": "HIGH",
          "DataSource": {
            "ID": "ghsa",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm",
            "Name": "GitHub Security Advisory npm"
          },
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-37599",
          "References": [
            "https://access.redhat.com/security/cve/CVE-2022-37599",
            "https://github.com/advisories/GHSA-hhq3-ff78-jv3g",
            "https://github.com/webpack/loader-utils",
            "https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38",
            "https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L83",
            "https://github.com/webpack/loader-utils/commit/17cbf8fa8989c1cb45bdd2997aa524729475f1fa",
            "https://github.com/webpack/loader-utils/commit/ac09944dfacd7c4497ef692894b09e63e09a5eeb",
            "https://github.com/webpack/loader-utils/commit/d2d752d59629daee38f34b24307221349c490eb1",
            "https://github.com/webpack/loader-utils/issues/211",
            "https://github.com/webpack/loader-utils/issues/216",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-37599",
            "https://www.cve.org/CVERecord?id=CVE-2022-37599"
          ],
          "Description": "A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.",
          "FixedVersion": "1.4.2, 2.0.4, 3.2.1",
          "PublishedDate": "2022-10-11T19:15:00Z",
          "SeveritySource": "ghsa",
          "VulnerabilityID": "CVE-2022-37599",
          "InstalledVersion": "1.4.0",

Other

[cypress-app-bot]

This issue has not had any activity in 180 days. Cypress evolves quickly and the reported behavior should be tested on the latest version of Cypress to verify the behavior is still occurring. It will be closed in 14 days if no updates are provided.

[cypress-app-bot]

This issue has been closed due to inactivity.

[CraigKnottAtlassian]

Was this only closed as not planned due to inactivity? Did renovate not pick this up?