Skip to content

Conversation

@rachfop
Copy link
Contributor

@rachfop rachfop commented May 1, 2024

npm install yauzl@latest

 yarn list yauzl
yarn list v1.22.22
warning Filtering by arguments is deprecated. Please use the pattern option instead.
├─ [email protected]
│  └─ [email protected]
└─ [email protected]
✨  Done in 0.11s.

"node": ">=6.9.0"
}
},
"node_modules/@babel/core/node_modules/@babel/traverse": {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Risk: Affected versions of @babel/traverse are vulnerable to Incomplete List Of Disallowed Inputs. An attacker can exploit a vulnerability in the internal Babel methods path.evaluate() or path.evaluateTruthy() by compiling specially crafted code, potentially resulting in arbitrary code execution during compilation.

Manual Review Advice: A vulnerability from this advisory is reachable if you use a 3rd party plugin that relies on the path.evaluate()or path.evaluateTruthy() internal Babel methods, or one of the known affected plugins (@babel/plugin-transform-runtime, Any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider, or @babel/preset-env when using its useBuiltIns option)

Fix: Upgrade this library to at least version 7.23.2 at snipsync/package-lock.json:127.

Reference(s): GHSA-67hx-6x53-jw92, CVE-2023-45133

Ignore this finding from ssc-aff5e8de-c638-4356-8a93-120597e35ce9.

@rachfop rachfop changed the title Upgrade yauzl Fix error on Vercel May 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants