Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

ANSI-HTML is vulnerable and unmaintained

See original GitHub issue

Describe the bug

When running yarn audit it shows a vulnerability in ansi-html

adding a resolution does not help as no patch is available, looking at the effected package ansi-html is no longer maintained by anyone.

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Uncontrolled Resource Consumption in ansi-html               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ ansi-html                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-scripts > webpack-dev-server > ansi-html               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/4035                        │
└───────────────┴──────────────────────────────────────────────────────────────┘

Did you try recovering your dependencies?

yes

Which terms did you search for in User Guide?

N/A

Environment

mac-mini M1 running in zsh

Steps to reproduce

run yarn audit on a project using altest react-scripts

Expected behavior

SHould either pass audit (many dependencies out of date) or use packages that allow a manual resolution of issue

Actual behavior

Declares no patch available for the issue, suggest switching to ansi-html-community

Issue Analytics

State:
Created 2 years ago
Reactions:13
Comments:10

Top GitHub Comments

5reactions

slutske22commented, Oct 8, 2021

Having the same issue. This seems to be related to Create a c3.11.3 to resolve vulnerability in dependency ansi-html, which was closed, as the webpack-dev-server team is no longer maintaining v^3, as v^4 is out. Seems the issue is that react-scripts is still depending on outdated version of webpack (4.44.2) and webpack-dev-server (3.11.1). I think fixing this would involve a fairly big upgrade to react-scripts and CRA?

2reactions

vkpraveencommented, Oct 18, 2021

We are able resolve it by following https://github.com/Tjatse/ansi-html/issues/19.

Top Results From Across the Web

How to fix ansi-html vulnerability - Mahdyar's Blog

Uncontrolled Resource Consumption in ansi-html (CVE-2021-23424) is a vulnerability that won't be fixed by the project's author.

ansi-html vulnerabilities - Snyk

version published direct vulnerabilities 0.0.9 28 Feb, 2022 0. C. 0. H. 0. M. 0. L 0.0.8 28 Feb, 2022 0. C. 1. H. 0....

Recent Vulnerability in ansi_term () - Vulert

The most accurate and complete database of ansi_term Vulnerabilities. Contain detailed information and remediation guidance for vulnerabilities.

RUSTSEC-2021-0139: ansi_term

ansi_term is Unmaintained ... INFO Unmaintained; Details: https://github.com/ogham/rust-ansi-term/issues/72; Patched: no patched versions ...

Vulnerability Summary for the Week of March 1, 2021 | CISA

Primary Vendor ‑‑ Product Published CVSS Score adguard ‑‑ adguard 2021‑03‑03 not yet calculated advantech ‑‑ webaccess/scada 2021‑03‑03 not yet calculated afterlogic ‑‑ aurora 2021‑03‑04 not...