Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Acorn is outdated with vulnerability

See original GitHub issue

The version of ESLint you are using. 6.8.0

The problem you want to solve. Regular Expression Denial of Service.

Your take on the correct solution to problem. Update the package version of Acorn to 7.1.1 or later. For now users can use the command: npm update acorn --depth 3

Are you willing to submit a pull request to implement this change? Sure.

Issue Analytics

State:
Created 4 years ago
Reactions:23
Comments:8 (4 by maintainers)

Top GitHub Comments

2reactions

hugoluchessicommented, Mar 9, 2020

Actually is Espree which has an outdated reference to Acorn.

Espree PR https://github.com/eslint/espree/pull/434 to fix that.

We need this PR merged to release a new version to fix it here.

1reaction

kaicataldocommented, Mar 16, 2020

We are not planning to release this in the 6.x line. As mentioned above, this should be fixable by updating your lockfile. Huzzah for semver ranges 😄

Top Results From Across the Web

Regular Expression Denial of Service (ReDoS) in acorn | Snyk

acorn is a tiny, fast JavaScript parser written in JavaScript. Affected versions of this package are vulnerable to Regular Expression Denial of ...

Fixing security vulnerabilities in npm dependencies ... - ITNEXT

Today when I started working I had to deal with this error where acorn and minimist were being reported as security vulnerabilities.

Marlon C. Taylor on LinkedIn: Open-source Acorn takes a new ...

Open-source Acorn takes a new approach to deploy cloud-native apps on Kubernetes ... Every org has a few outdated #IT solutions that still...

Fixing security vulnerabilities in npm ... - DEV Community ‍ ‍

Today when I started working I had to deal with this error where acorn and minimist were being reported as security vulnerabilities.

SID 310827488 - PubChem

Acorn PharmaTech Product List. External ID. ACN-036812. Source Category. Chemical Vendors. Legacy Depositors. Version. 1 OF 3. Revision History. Status. Old ...