Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Child library nth-check is vulnerable to CVE-2021-3803 even with the latest react-scripts@5.0.1 #12778

Open
SunitaIBM opened this issue Oct 14, 2022 · 8 comments · May be fixed by #13778
Open

Comments

@SunitaIBM
Copy link

There is a dependent library nth-check in react-scripts which is vulnerable to CVE-2021-3803. The mend scan is reporting this vulnerability for our project.

-- react-scripts@5.0.1
+-- @svgr/webpack@5.5.0
| -- @svgr/plugin-svgo@5.5.0 | -- svgo@1.3.2
| -- css-select@2.1.0 | -- nth-check@1.0.2

nth-check beyond v2.0.1(including) is available and safe from this vulnerability.

To fix this we have upgraded to the latest version for react-scripts (as shown above) still this dependency is not upgraded. Can you please take some action and upgrade this transitive dependency inside the parent library react-scripts at the earliest possible.

@SunitaIBM
Copy link
Author

Vulnerable react-scripts 5.0.1 makes our product vulnerable. Please upgrade the react-scripts 5.0.1 at the earliest possible with transitive dependencies security patches. It should have the updated transitive dependency for nth-check by upgrading nth-check/1.0.2 to latest available version nth-check/2.1.1.

@mchakshu19
Copy link

We are having the same issue in our project. Please upgrade this child dependency ASAP.

@hemantkd
Copy link

hemantkd commented Oct 31, 2022

A few of our applications are blocked because of this as well. 😢

@VikingProgrammerMW
Copy link

This is also causing me and my team huge problems.

@SunitaIBM
Copy link
Author

Do we have some update on this.

@lebbe
Copy link

lebbe commented Nov 10, 2022

An "Inefficient Regular Expression Complexity" vulnerability is not of any concern in a build tool. Feel safe to waive this security issue. Also look at this pinned post.

@evankanderson
Copy link

This seems to be a dup of #12146, and would be resolved by #11174, #12026, or #12026

It appears that migrating from v5 to v6 of @svgr/webpack requires following a migration guide, so the work may be non-trivial.

@mark-wiemer
Copy link

mark-wiemer commented Feb 20, 2023

#11174 is the correct answer, just move react-scripts out of dependencies and into devDependencies and run npm audit --omit=dev

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
7 participants