Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

npm audit high vulnerability issue

See original GitHub issue

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-sass                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ node-sass > gaze > globule > lodash                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/782                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

Issue Analytics

State:
Created 4 years ago
Comments:5

Top GitHub Comments

2reactions

shamacommented, Jul 2, 2019

lodash is tagged in this project with ~4.17.10 which means it will install the latest patch including 4.17.11. Please update your dependencies, remove your package-lock.json and npm install again.

0reactions

evanhooffcommented, Jul 19, 2019

Yes I understand, thank you for your answer. I see the original ticket also mentioned gaze so that’s probably the issue.

Top Results From Across the Web

Auditing package dependencies for security vulnerabilities

A security audit is an assessment of package dependencies for security vulnerabilities. Security audits help you protect your package's users by enabling ...

Fixing security vulnerabilities in npm dependencies in less ...

2.1) To fix any dependency, you need to first know which npm package depends on that. npm audit. This will tell you the...

Don't be alarmed by vulnerabilities after running NPM Install

The NPM registry runs a security audit on NPM packages. ... you see there are over 100 vulnerabilities & of which, 160+ are...

How to Fix Security Vulnerabilities with NPM

Hence, below are a few suggestions to fix the issues. Get a detailed report of the security vulnerabilities with npm audit.

How to Fix Your Security Vulnerabilities with NPM Overrides

You run npm “audit fix”,and it fixes some of the dependencies. What do you do next? Run “npm audit –force”. Well, that's brave...