web3.js icon indicating copy to clipboard operation
web3.js copied to clipboard

web3-bzz `swarm-js` dependency introduces vulnerability to `got <11.8.5`

Open oliviera9 opened this issue 3 years ago • 0 comments

https://github.com/ChainSafe/web3.js/blob/8620cba19f2a9250d395e0717669b274a89521a5/packages/web3-bzz/package.json#L20

# npm audit report

got  <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/swarm-js/node_modules/got
  swarm-js  0.1.1 - 0.1.17 || >=0.1.35
  Depends on vulnerable versions of got
  node_modules/swarm-js
    web3-bzz  *
    Depends on vulnerable versions of swarm-js
    node_modules/web3-bzz
      web3  1.0.0-beta.1 - 3.0.0-rc.0
      Depends on vulnerable versions of web3-bzz
      node_modules/web3

4 moderate severity vulnerabilities

oliviera9 avatar Aug 05 '22 10:08 oliviera9