New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prototype Pollution in async #55

Merged

tomap merged 1 commit into hexojs:master from uiolee:master

May 4, 2022

Member

uiolee commented May 4, 2022 •

edited

Loading

hexo-renderer-ejs@2.0.0 requires async@0.9.x via a transitive dependency on jake@10.8.4

The earliest fixed version is 2.6.4.

A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user obtain privileges via the mapValues() method.

update ejs to 3.1.7

mde/ejs@c028c34
jakejs/jake#411


          update ejs to 3.1.7

0ab6628

tomap approved these changes

View reviewed changes

coveralls commented May 4, 2022

Coverage remained the same at 100.0% when pulling 0ab6628 on uiolee:master into d09b00e on hexojs:master.

tomap merged commit b7f27a3 into hexojs:master

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet