Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Vulnerability (low severity) introduced by `find-node-modules`

See original GitHub issue

The braces npm module is vulnerable to Regular Expression Denial of Service (ReDoS).

The braces module is a dependency of commitizen via

commitizen@2.9.6
- find-node-modules@1.0.4
  - findup-sync@0.4.2
    - micromatch@2.3.11
      - braces@1.8.5

There is no new version of findup-sync or find-node-modules available that comes with a braces version >= 2.3.1 to fix the vulnerability.

I suggest using a package other than find-node-modules for the required functionality.

Issue Analytics

State:
Created 5 years ago
Comments:8 (4 by maintainers)

Top GitHub Comments

3reactions

jimthedevcommented, May 24, 2018

Thanks for bringing this up btw. Generally speaking I am not likely to move off a module but would rather put in the PRs to get it up to date. We rely on their functionality so we should contribute back through PRs. If there is a PR that isn’t being merged for a long time that we need merged then we could have that conversation.

0reactions

jimthedevcommented, Feb 21, 2019

We’re good. Thanks all! ❤️

Top Results From Across the Web

"found 1 low severity vulnerability" warning while creating ...

Describe the bug While creating React-App using npx create-react-app command this warning comes: found 1 low severity vulnerability run `npm ...

Vulnerability Severity Levels - Invicti

Vulnerability Severity Levels indicate the seriousness of detected issues. Each vulnerability has a different impact; some are urgent, while others are less ...

Vulnerability Metrics - NVD

NVD Vulnerability Severity Ratings. NVD provides qualitative severity ratings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to ......

Vulnerability management rules - Prisma - Palo Alto Networks

As you build out your policy, you'll create rules that filter out insignificant information, such as low severity vulnerabilities, and surface vital ...

Low Severity Vulnerabilities - Acunetix

Low Severity Vulnerabilities · Vulnerability Categories · Abuse Of Functionality · Acumonitor · Arbitrary File Creation · Authentication Bypass · Bruteforce Possible ...