[Apiiro] SCA OSS Vulnerabilities - Medium CVSS score · Critical Risk

[haimlebo]

555

Discovered on: Jul 28, 2024 12:16
Due date: Jul 31, 2024 12:16
Dependency: react-dev-utils
Version: 11.0.0
Type: Sub dependency
Introduced through:

• react-scripts: 4.0.0 > react-dev-utils: 11.0.0

Vulnerabilities

• react-dev-utils OS Command Injection in function with CVSS score 5.6. fixed version: 11.0.4

About this package:

External dependency: react-dev-utils - https://www.npmjs.com/package/react-dev-utils
Package details: webpack utilities used by Create React App
Latest version: 12.0.1
License: MIT
Insights:

• Adequate maintainer count - This package is maintained by at least 3 developers
• Adequately tested - Testing practices are thoroughly followed
• Popularity - This package has many weekly downloads and high popularity scores
• Has vulnerabilities - One or more vulnerabilities have been reported for this package

Remediation

react-dev-utils is a sub-dependency referenced by the following top-level dependencies:

• react-scripts declared in src/client/package.json
  Upgrade these top-level dependencies to a version that uses react-dev-utils with version 11.0.4
  View in Apiiro