orientjs icon indicating copy to clipboard operation
orientjs copied to clipboard

DoS vulnerability in dependency

Open isaactzab opened this issue 5 years ago • 1 comments

The package orientjs > yargs > os-locale > mem has a DoS vulnerability.

From npm audit

                       === npm audit security report ===                        
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ mem                                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.0.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ orientjs                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ orientjs > yargs > os-locale > mem                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1084                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 low severity vulnerability in 2546 scanned packages
  1 vulnerability requires manual review. See the full report for details.

isaactzab avatar Mar 02 '20 17:03 isaactzab

Recomendation: Update "yargs": "^11.0.0" to "yargs": "^13.3.0"

isaactzab avatar Mar 02 '20 17:03 isaactzab