CVE-2023-42282 | npm ip package vulnerable to SSRF or RCE

[boxexchanger]

CVE-2023-42282 GHSA-78xj-cgh5-2h22
https://nvd.nist.gov/vuln/detail/CVE-2023-42282
TooTallNate/proxy-agents#280

Severity: high
NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks

Will install pm2@3.5.2, which is a breaking change
node_modules/ip
  pac-resolver  >=1.3.0
  Depends on vulnerable versions of ip
  node_modules/pac-resolver
    pac-proxy-agent  >=1.1.0
    Depends on vulnerable versions of pac-resolver
    node_modules/pac-proxy-agent
      proxy-agent  >=2.1.0
      Depends on vulnerable versions of pac-proxy-agent
      node_modules/proxy-agent
        @pm2/agent  >=0.5.25
        Depends on vulnerable versions of proxy-agent
        node_modules/@pm2/agent
          pm2  >=4.0.0
          Depends on vulnerable versions of @pm2/agent
          node_modules/pm2

[OIRNOIR]

proxy-agent has released an update to fix the vulnerability by removing the ip package it depends on. Run npm update.

[boxexchanger]

Thank you!