Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

underscore.js-1.12.0 has vulnerability #9222

Closed
tk0miya opened this issue May 12, 2021 · 1 comment
Closed

underscore.js-1.12.0 has vulnerability #9222

tk0miya opened this issue May 12, 2021 · 1 comment
Labels
type:bug
Milestone
4.0.2

Comments

@tk0miya
Copy link
Member

tk0miya commented May 12, 2021

Describe the bug

underscore.js has a security announcement ( CVE-2021-23358 ) for arbitrary code execution. Unfortunately this is fixed in underscore 1.12.1, but Sphinx-4.0.1 is still on 1.12.0.

refs: https://groups.google.com/g/sphinx-users/c/0ukmuNwtNqM

To Reproduce
N/A

Expected behavior
Upgrade it to the latest one.

Your project
N/A

Screenshots
N.A

Environment info
N/A
@tk0miya tk0miya added this to the 4.0.2 milestone May 12, 2021
tk0miya added a commit to tk0miya/sphinx that referenced this issue May 12, 2021
@tk0miya
Fix sphinx-doc#9222: Update Underscore.js to 1.13.1
a8c63f7 
underscore.js 1.12.0 has a security announcement (CVE-2021-23358) for
arbitrary code execution.  So it should be upgraded to the latest
version.
@tk0miya
Copy link
Member Author

tk0miya commented May 12, 2021

refs: https://underscorejs.org/#changelog

@tk0miya tk0miya mentioned this issue May 12, 2021
Merged
tk0miya added a commit that referenced this issue May 15, 2021
@tk0miya
Merge pull request #9223 from tk0miya/underscore.js-1.13.1
1ab7e28 
Fix #9222: Update Underscore.js to 1.13.1
@tk0miya tk0miya closed this as completed May 15, 2021
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jul 10, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
type:bug
Projects
None yet
Milestone
4.0.2
Development

No branches or pull requests
1 participant
@tk0miya