CVE in word-wrap

Open
#42 1 comment 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
javascript
Domain
security

Research direction

The report identifies the dependency chain from escodegen 1.14.3 through optionator 0.8.3 to word-wrap 1.2.3. Start by checking the repository’s dependency declarations and current package setup against that chain. Done means the vulnerable path is replaced by the fixed dependency line without breaking the project’s existing checks.

Written by the indexing model from the issue text.

Description

Hi @goto-bus-stop ,

there is a CVE in word-wrap: https://github.com/jonschlinkert/word-wrap/pull/33
It is fixed and integrated in latest optionator 0.9.x, which is used in escodegen 2.x.
Is there any chance to update escodegen to 2.x?
Thanks!

escodegen@1.14.3
│ └─┬ optionator@0.8.3
│ └── word-wrap@1.2.3

Optionator team will not merge the fix to 0.8.x: https://github.com/gkz/optionator/pull/46

Dominant language
JavaScript
Stars
177
Forks
27
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from browserify/static-eval

All issues in browserify/static-eval

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.