Security Issue Flagged by Snyk

[gregorymey-dev]

Hi Guys,

Thanks for the awesome tool.

Could you investigate the vulnerabilities that Snyk flagged.

✗ Arbitrary Code Injection [Medium Severity][https://snyk.io/vuln/SNYK-JS-EJS-1049328] in ejs@2.7.4
introduced by react-scripts@4.0.3 > workbox-webpack-plugin@5.1.4 > workbox-build@5.1.4 > @surma/rollup-plugin-off-main-thread@1.4.2 > ejs@2.7.4
This issue was fixed in versions: 3.1.6
✗ Regular Expression Denial of Service (ReDoS) [Medium Severity][https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905] in glob-parent@3.1.0
introduced by react-scripts@4.0.3 > webpack@4.44.2 > watchpack@1.7.5 > watchpack-chokidar2@2.0.1 > chokidar@2.1.8 > glob-parent@3.1.0
This issue was fixed in versions: 5.1.2
✗ Regular Expression Denial of Service (ReDoS) [Medium Severity][https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY2-1079307] in html-parse-stringify2@2.0.1
introduced by react-i18next@11.8.10 > html-parse-stringify2@2.0.1
No upgrade or patch available
✗ Regular Expression Denial of Service (ReDoS) [Medium Severity][https://snyk.io/vuln/SNYK-JS-ISSVG-1085627] in is-svg@3.0.0
introduced by react-scripts@4.0.3 > optimize-css-assets-webpack-plugin@5.0.4 > cssnano@4.1.10 > cssnano-preset-default@4.0.7 > postcss-svgo@4.0.2 > is-svg@3.0.0
This issue was fixed in versions: 4.2.2
✗ Regular Expression Denial of Service (ReDoS) [High Severity][https://snyk.io/vuln/SNYK-JS-SSRI-1085630] in ssri@6.0.1
introduced by react-scripts@4.0.3 > webpack@4.44.2 > terser-webpack-plugin@1.4.5 > cacache@12.0.4 > ssri@6.0.1
This issue was fixed in versions: 8.0.1

[candrews]

See https://snyk.io/vuln/SNYK-JS-SSRI-1085630

This issue is a duplicate of #10699

[carbonphyber]

Note that the first comment is a dump of multiple security reports and the second only describes 1 and refers to another GH Issue about that 1 security issue. Issue #10699 is only a partial duplicate of #10698 (this Issue).

Linkifying the SNYK security reports:

• Arbitrary Code Injection [Medium Severity] https://snyk.io/vuln/SNYK-JS-EJS-1049328 in ejs@2.7.4 introduced by react-scripts@4.0.3 > workbox-webpack-plugin@5.1.4 > workbox-build@5.1.4 > @surma/rollup-plugin-off-main-thread@1.4.2 > ejs@2.7.4. This issue was fixed in versions: 3.1.6
• Regular Expression Denial of Service (ReDoS) [Medium Severity] https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905 in glob-parent@3.1.0 introduced by react-scripts@4.0.3 > webpack@4.44.2 > watchpack@1.7.5 > watchpack-chokidar2@2.0.1 > chokidar@2.1.8 > glob-parent@3.1.0. This issue was fixed in versions: 5.1.2
• Regular Expression Denial of Service (ReDoS) [Medium Severity] https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY2-1079307 in html-parse-stringify2@2.0.1 introduced by react-i18next@11.8.10 > html-parse-stringify2@2.0.1. No upgrade or patch available.
• Regular Expression Denial of Service (ReDoS) [Medium Severity] https://snyk.io/vuln/SNYK-JS-ISSVG-1085627 in is-svg@3.0.0 introduced by react-scripts@4.0.3 > optimize-css-assets-webpack-plugin@5.0.4 > cssnano@4.1.10 > cssnano-preset-default@4.0.7 > postcss-svgo@4.0.2 > is-svg@3.0.0. This issue was fixed in versions: 4.2.2
• Regular Expression Denial of Service (ReDoS) [High Severity] https://snyk.io/vuln/SNYK-JS-SSRI-1085630 in ssri@6.0.1 introduced by react-scripts@4.0.3 > webpack@4.44.2 > terser-webpack-plugin@1.4.5 > cacache@12.0.4 > ssri@6.0.1. This issue was fixed in versions: 8.0.1

[gregorymey-dev]

Note that the first comment is a dump of multiple security reports and the second only describes 1 and refers to another GH Issue about that 1 security issue. Issue #10699 is only a partial duplicate of #10698 (this Issue).

Linkifying the SNYK security reports:

• Arbitrary Code Injection [Medium Severity] https://snyk.io/vuln/SNYK-JS-EJS-1049328 in ejs@2.7.4 introduced by react-scripts@4.0.3 > workbox-webpack-plugin@5.1.4 > workbox-build@5.1.4 > @surma/rollup-plugin-off-main-thread@1.4.2 > ejs@2.7.4. This issue was fixed in versions: 3.1.6
• Regular Expression Denial of Service (ReDoS) [Medium Severity] https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905 in glob-parent@3.1.0 introduced by react-scripts@4.0.3 > webpack@4.44.2 > watchpack@1.7.5 > watchpack-chokidar2@2.0.1 > chokidar@2.1.8 > glob-parent@3.1.0. This issue was fixed in versions: 5.1.2
• Regular Expression Denial of Service (ReDoS) [Medium Severity] https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY2-1079307 in html-parse-stringify2@2.0.1 introduced by react-i18next@11.8.10 > html-parse-stringify2@2.0.1. No upgrade or patch available.
• Regular Expression Denial of Service (ReDoS) [Medium Severity] https://snyk.io/vuln/SNYK-JS-ISSVG-1085627 in is-svg@3.0.0 introduced by react-scripts@4.0.3 > optimize-css-assets-webpack-plugin@5.0.4 > cssnano@4.1.10 > cssnano-preset-default@4.0.7 > postcss-svgo@4.0.2 > is-svg@3.0.0. This issue was fixed in versions: 4.2.2
• Regular Expression Denial of Service (ReDoS) [High Severity] https://snyk.io/vuln/SNYK-JS-SSRI-1085630 in ssri@6.0.1 introduced by react-scripts@4.0.3 > webpack@4.44.2 > terser-webpack-plugin@1.4.5 > cacache@12.0.4 > ssri@6.0.1. This issue was fixed in versions: 8.0.1

Thanks, I've noticed I accidently copied react-i18next@11.8.10 into the message, this section should not be there.

[nj314]

@gregorymey-dev This issue needs to be reopened as there is no other issue covering the ejs@2.7.4 vuln, which currently does not have a patch version available, so react-scripts needs changes to produce an upgrade to ejs@^3.1.6. As stated by @carbonphyber , this issue is only a partial duplicate of #10699 . We need this issue to capture the necessary major version upgrade from ejs 2 to 3.

[gusliedke]

Indeed. This still needs to be fixed. We need to upgrade ejs@2.7.4 to ejs@3.1.6.

Arbitrary Code Injection
Affected module: ejs@2.7.4
Exploit maturity: Proof of Concept
Fixed in: ejs@3.1.6

react-scripts@4.0.3  ›  workbox-webpack-plugin@5.1.4  ›  workbox-build@5.1.4  ›  @surma/rollup-plugin-off-main-thread@1.4.2  ›  ejs@2.7.4```

[senkevichdv]

Any updates on this issue? I see this issue is still closed

Arbitrary Code Injection
Affected module: ejs@2.7.4
Introduced through: react-scripts@4.0.3
Exploit maturity: Proof of Concept
Fixed in: ejs@3.1.6

Introduced through:   react-scripts@4.0.3  ›  workbox-webpack-plugin@5.1.4  ›  workbox-build@5.1.4  ›  @surma/rollup-plugin-off-main-thread@1.4.2  ›  ejs@2.7.4

[gregorymey-dev]

Hi Guys,

Was out of circulation for a while, IO would want to re-open this case.

[gaearon]

None of these issues affect how CRA uses these dependencies. There is nothing to address here.
#11174