We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
yargs-parser are vulnerable to prototype pollution in version 3.4.1
should fix the security issue.
yargs-parser are vulnerable to prototype pollution in version 3.4.1.
The text was updated successfully, but these errors were encountered:
yargs-parser@3.4.1 doesn't exist.
yargs-parser@3.4.1
Sorry, something went wrong.
@ianschmitz I believe this issue is referring to react-scripts version 3.4.1 not yargs-parser.
-- react-scripts@3.4.1 +-- jest@24.9.0 | -- jest-cli@24.9.0 | -- -- yargs@13.3.2 | -- -- -- yargs-parser@13.1.2 -- webpack-dev-server@3.10.3 -- -- yargs@12.0.5 -- -- -- yargs-parser@11.1.1
Why was this issue closed if the issue has not been fixed? react-scripts 3.4.1 is still vulnerable and will cause an npm audit to return non-zero:
Low Prototype Pollution Package yargs-parser Patched in >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2 Dependency of react-scripts [dev] Path react-scripts > webpack-dev-server > yargs > yargs-parser More info https://npmjs.com/advisories/1500
this has been resolved on master but not yet released: #8975
master
Any sense of when that release will be?
No branches or pull requests
Describe the bug
yargs-parser are vulnerable to prototype pollution in version 3.4.1
Expected behavior
should fix the security issue.
Actual behavior
yargs-parser are vulnerable to prototype pollution in version 3.4.1.
The text was updated successfully, but these errors were encountered: