Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Security vulnerability at js-yaml

See original GitHub issue

@commitlint/load uses a vulnerable version of cosmicconfig (which uses a vulnerable version of js-yml), see https://nodesecurity.io/advisories/788 for more details on the security issue. js-yml 3.13.0 is patched, but cosmicconfig has yet to update its version.

yarn audit output:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate      │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ js-yaml                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.13.0                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ commitlint                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ commitlint > @commitlint/cli > @commitlint/load >            │
│               │ cosmiconfig > js-yaml                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/788                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

Expected Behavior

Use a patched version of cosmicconfig when it’s available, see this issue & pr

Current Behavior

Uses a vulnerable version of cosmiconfig.

Affected packages

cli (load)
core
prompt
config-angular

Possible Solution

Update cosmiconfig

Issue Analytics

State:
Created 4 years ago
Reactions:2
Comments:6 (3 by maintainers)

Top GitHub Comments

1reaction

marioneblcommented, May 31, 2019

Fixed in the meantime

1reaction

escapedcatcommented, Mar 22, 2019

Thx @pyrho!
We’re watching the related issue of cosmiconfig and will update as soon as it’s available.

Top Results From Across the Web

js-yaml - Snyk Vulnerability Database

version published direct vulnerabilities 4.1.0 14 Apr, 2021 0. C. 0. H. 0. M. 0. L 4.0.0 3 Jan, 2021 0. C. 0. H. 0....

Js-yaml Project Js-yaml : List of security vulnerabilities

Security vulnerabilities of Js-yaml Project Js-yaml : List of all related CVE security vulnerabilities. CVSS Scores, vulnerability details and links to full ...

Security vulnerability (High Severity) in js-yaml dependency

As an update, npm audit now yields a high severity error (code injection) on the same dependency. For reference, this is on node...

Code Execution via YAML in JS-YAML Node.js Module

The JS-YAML module for Node.js contained a code execution vulnerability prior to version 2.0.5. The maintainers of JS-YAML have patched this vulnerability and, ......

Arbitrary Code Execution Vulnerability in the js-yaml library (+ ...

js-yaml is vulnerable to arbitrary code execution. The vulnerability exists through the usage of unsafe `load()` function, which allows attackers to inject ...