New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: update cheerio and svgo to fix vulns #217

Open

THATDONFC wants to merge 1 commit into remy:master from THATDONFC:patch-1

THATDONFC commented Mar 10, 2021

Reported by npm audit

cheerio 0.14.0 - 0.19.0
Depends on vulnerable versions of lodash
lodash <=4.17.18
Prototype Pollution - https://npmjs.com/advisories/1065
Prototype Pollution - https://npmjs.com/advisories/1523
Prototype Pollution - https://npmjs.com/advisories/577
Prototype Pollution - https://npmjs.com/advisories/782

svgo 0.4.2 - 1.0.5
Depends on vulnerable versions of js-yaml
js-yaml <=3.13.0
Denial of Service - https://npmjs.com/advisories/788
Code Injection - https://npmjs.com/advisories/813


          fix: update cheerio and svgo to fix vulns

7d4af86

Reported by npm audit

cheerio  0.14.0 - 0.19.0
  Depends on vulnerable versions of lodash
lodash  <=4.17.18
Prototype Pollution - https://npmjs.com/advisories/1065
Prototype Pollution - https://npmjs.com/advisories/1523
Prototype Pollution - https://npmjs.com/advisories/577
Prototype Pollution - https://npmjs.com/advisories/782

svgo  0.4.2 - 1.0.5
  Depends on vulnerable versions of js-yaml
js-yaml  <=3.13.0
Denial of Service - https://npmjs.com/advisories/788
Code Injection - https://npmjs.com/advisories/813

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet