WS-2018-0215 (Medium) detected in cached-path-relative-1.0.1.tgz

[mend-bolt-for-github]

WS-2018-0215 - Medium Severity Vulnerability

Vulnerable Library - cached-path-relative-1.0.1.tgz

Memoize the results of the path.relative function

Library home page: https://registry.npmjs.org/cached-path-relative/-/cached-path-relative-1.0.1.tgz

Path to dependency file: /spa-deploy/package.json

Path to vulnerable library: /tmp/git/spa-deploy/node_modules/cached-path-relative/package.json

Dependency Hierarchy:

• karma-2.0.0.tgz (Root Library)
  • browserify-14.5.0.tgz
    • ❌ cached-path-relative-1.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 0bb85093b8f677bcf34edb77e84b6e9685a9c040

Vulnerability Details

Version of cached-path-relative before 1.0.2 are vulnerable to prototype pollution.

Publish Date: 2018-12-06

URL: WS-2018-0215

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: ashaffer/cached-path-relative@a43cffe

Release Date: 2018-12-06

Fix Resolution: 1.0.2

---

Step up your Open Source Security Game with WhiteSource here