-
Notifications
You must be signed in to change notification settings - Fork 28
Open
Description
npm audit is showing vulnerabilities that exist in the shelljs, yargs, and yargs-parser dependencies included.
# npm audit report
shelljs <=0.8.4
Severity: high
Improper Privilege Management in shelljs - https://github.com/advisories/GHSA-64g7-mvw6-v9qj
Improper Privilege Management in shelljs - https://github.com/advisories/GHSA-4rq4-32rv-6wp6
No fix available
node_modules/shelljs
recursive-install *
Depends on vulnerable versions of shelljs
Depends on vulnerable versions of yargs
node_modules/recursive-install
yargs-parser <=5.0.0
Severity: moderate
yargs-parser Vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-p9pc-299p-vxgp
No fix available
node_modules/recursive-install/node_modules/yargs-parser
yargs 4.0.0-alpha1 - 7.0.0-alpha.3 || 7.1.1
Depends on vulnerable versions of yargs-parser
node_modules/recursive-install/node_modules/yargs
4 vulnerabilities (3 moderate, 1 high)
I believe the issue is resolved, we just need to have a new version released with the updated dependencies.
Metadata
Metadata
Assignees
Labels
No labels