Has high severity vulnerabilities
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript, node.js
- Domain
- security
Research direction
Start by installing the latest CodeceptJS release and reproducing the shown npm audit report. Trace the cross-spawn dependency through child-process-promise, detox, and @codeceptjs/detox-helper; done means the high-severity vulnerability is resolved without introducing an unreviewed breaking change.
Written by the indexing model from the issue text.
Description
I installed CodeceptJS at latest, then Node.js showed it has vulnerabirities. I audited and the result is:
# npm audit report
cross-spawn <6.0.6
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
fix available via `npm audit fix --force`
Will install codeceptjs@3.5.9, which is a breaking change
node_modules/child-process-promise/node_modules/cross-spawn
child-process-promise >=2.2.0
Depends on vulnerable versions of cross-spawn
node_modules/child-process-promise
detox >=4.1.1
Depends on vulnerable versions of child-process-promise
node_modules/detox
@codeceptjs/detox-helper *
Depends on vulnerable versions of detox
node_modules/@codeceptjs/detox-helper
codeceptjs 2.2.1 || 3.5.1-2.beta.7 || >=3.5.10
Depends on vulnerable versions of @codeceptjs/detox-helper
node_modules/codeceptjs
- Dominant language
- JavaScript
- Stars
- 4.2k
- Forks
- 756
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 16
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from codeceptjs/CodeceptJS
-
stale
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
codeceptjs/CodeceptJS#5420 · 1 comment ·
-
stale
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
codeceptjs/CodeceptJS#5358 · 1 comment ·
-
stale
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
codeceptjs/CodeceptJS#4958 · 10 comments · 2 reactions ·
-
stale
Difficulty 1/5 Under an hour Newbie friendliness 72/100
codeceptjs/CodeceptJS#4778 · 3 comments ·
-
stale
Difficulty 4/5 3-5 days Newbie friendliness 38/100
codeceptjs/CodeceptJS#5618 · 1 comment ·
All issues in codeceptjs/CodeceptJS
Similar issues
-
bug confirmed issue
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
open-webui/open-webui#30750 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Mend: dependency security vulnerability untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 70/100