Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resolve latest round of vite CVEs (5 moderate) #406

Closed
parksjr opened this issue Sep 23, 2024 · 0 comments · Fixed by #407
Closed

Resolve latest round of vite CVEs (5 moderate) #406

parksjr opened this issue Sep 23, 2024 · 0 comments · Fixed by #407

Comments

@parksjr
Copy link
Contributor

parksjr commented Sep 23, 2024

Relatively new CVE's posted to GH's advisory board, and being reported in the audit hook.

╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
║                                                                            === npm audit security report ===                                                                             ║
║                                                                                                                                                                                          ║
║ ID      │ Module     │ Title                                              │ Paths                                   │ Sev.     │ URL                                               │ Ex. ║
║ 1098681 │ micromatch │ Regular Expression Denial of Service (ReDoS) in    │ micromatch                              │ moderate │ https://github.com/advisories/GHSA-952p-6rrq-rcjv │ n   ║
║         │            │ micromatch                                         │                                         │          │                                                   │     ║
║ 1099690 │ vite       │ Vite DOM Clobbering gadget found in vite bundled   │ @types/vite-plugin-react-svg>vite       │ moderate │ https://github.com/advisories/GHSA-64vr-g452-qvp3 │ n   ║
║         │            │ scripts that leads to XSS                          │ vite                                    │          │                                                   │     ║
║ 1099692 │ vite       │ Vite DOM Clobbering gadget found in vite bundled   │ @types/vite-plugin-react-svg>vite       │ moderate │ https://github.com/advisories/GHSA-64vr-g452-qvp3 │ n   ║
║         │            │ scripts that leads to XSS                          │ vite                                    │          │                                                   │     ║
║ 1099695 │ vite       │ Vite's `server.fs.deny` is bypassed when using     │ @types/vite-plugin-react-svg>vite       │ moderate │ https://github.com/advisories/GHSA-9cwx-2883-4wfx │ n   ║
║         │            │ `?import&raw`                                      │ vite                                    │          │                                                   │     ║
║ 1099697 │ vite       │ Vite's `server.fs.deny` is bypassed when using     │ @types/vite-plugin-react-svg>vite       │ moderate │ https://github.com/advisories/GHSA-9cwx-2883-4wfx │ n   ║
║         │            │ `?import&raw`                                      │ vite                                    │          │                                                   │     ║
╚═════════╧════════════╧════════════════════════════════════════════════════╧═════════════════════════════════════════╧══════════╧═══════════════════════════════════════════════════╧═════╝

Resolution:

Fix the CVE's

@parksjr parksjr mentioned this issue Sep 24, 2024
1 task
@parksjr parksjr linked a pull request Sep 24, 2024 that will close this issue
1 task
parksjr added a commit that referenced this issue Sep 24, 2024
@parksjr parksjr mentioned this issue Sep 24, 2024
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant