Published npm-shrinkwrap.json pins [email protected] with vulnerable [email protected]
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 55/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- javascript, node.js
- Domain
- build-system, release, security
Research direction
Start by locating the generation process for the published npm-shrinkwrap.json and inspect how [email protected] enters the @salesforce/cli package. Reproduce a clean installation with npm ci, update the generated dependency to [email protected] or newer, and verify that tar is no longer 7.5.19 before publishing a new CLI release.
Written by the indexing model from the issue text.
Description
Summary
Published @salesforce/cli packages include an npm-shrinkwrap.json that pins [email protected]. That npm release bundles [email protected], which is affected by:
- GHSA-r292-9mhp-454m
- CVE-2026-73566
- Patched in
[email protected]
[email protected] bundles the fixed [email protected].
Affected releases
I confirmed the following published CLI releases contain the same vulnerable dependency chain:
@salesforce/[email protected]@salesforce/[email protected](currentlatest)@salesforce/[email protected](currentlatest-rc)
Dependency path:
@salesforce/cli
└── [email protected]
└── [email protected]
Consumer impact
Dependabot reports this as a high-severity runtime vulnerability. Consumers cannot cleanly remediate it themselves because the published CLI shrinkwrap dictates the nested npm dependency.
I tested the following approaches:
npm update npm
Root-level npm overrides
Overrides scoped beneath @salesforce/cli
Adding [email protected] as a direct dependency
Manually updating the consuming repository's package-lock.json
None fixes a clean installation. npm ci follows the CLI's published shrinkwrap and reinstalls [email protected] and [email protected]. A manual lockfile edit can make dependency scanning appear fixed while leaving the installed package vulnerable.
Requested fix
Please update the CLI's generated shrinkwrap to use [email protected] or newer and publish a new @salesforce/cli release.
Expected dependency path:
Thank you!
- Dominant language
- No language data
- Stars
- 571
- Forks
- 80
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 3
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from forcedotcom/cli
-
investigating validated
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
forcedotcom/cli#3657 · 2 comments ·
-
`sf agent preview` fails with `AgentApiNotFound` against staging (aws-stage1) orgs — `stage.api.salesforce.com` missing from endpoint fallbackPossibly taken A pull request linked to this issue is open or already merged. Openarea:afdx owned by another team
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
forcedotcom/cli#3645 · 2 comments ·
-
bug investigating validated
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
forcedotcom/cli#3644 · 6 comments ·
-
sf agent mcp asset replace --assets null throws raw TypeError instead of InvalidShapePossibly taken @konkonrong-lgtm claimed this 53 days ago. Openarea:afdx bug investigating owned by another team validated
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
forcedotcom/cli#3625 · 4 comments ·
-
area:afdx bug owned by another team
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
forcedotcom/cli#3608 · 2 comments ·
Similar issues
-
5.scope: tracking 6.topic: lua
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
NixOS/nixpkgs#570322 · 3 reactions ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
appandflow/stim#2429 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
lundybernard/batconf#245 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
SocialGouv/iterion#2195 ·
Maintainers usually reply within 1 day