Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Child library nth-check is vulnerable to CVE-2021-3803 even with the latest react-scripts@5.0.1

See original GitHub issue

There is a dependent library nth-check in react-scripts which is vulnerable to CVE-2021-3803. The mend scan is reporting this vulnerability for our project.

– react-scripts@5.0.1 ±- @svgr/webpack @5.5.0 | -- @svgr/plugin-svgo@5.5.0 | – svgo@1.3.2 | -- css-select@2.1.0 | – nth-check@1.0.2

nth-check beyond v2.0.1(including) is available and safe from this vulnerability.

To fix this we have upgraded to the latest version for react-scripts (as shown above) still this dependency is not upgraded. Can you please take some action and upgrade this transitive dependency inside the parent library react-scripts at the earliest possible.

Issue Analytics

State:
Created a year ago
Reactions:15
Comments:7

Top GitHub Comments

4reactions

SunitaIBMcommented, Oct 19, 2022

Vulnerable react-scripts 5.0.1 makes our product vulnerable. Please upgrade the react-scripts 5.0.1 at the earliest possible with transitive dependencies security patches. It should have the updated transitive dependency for nth-check by upgrading nth-check/1.0.2 to latest available version nth-check/2.1.1.

1reaction

lebbecommented, Nov 10, 2022

An “Inefficient Regular Expression Complexity” vulnerability is not of any concern in a build tool. Feel safe to waive this security issue. Also look at this pinned post.

Top Results From Across the Web

Inefficient Regular Expression Complexity in nth-check - Stack ...

Since react-scripts is essentially a build tool, even if the vulnerability was indeed genuine, it would be considered only a development ...

How to migrate Create-React-App to React version 18

My experience migrating my Create-React-App (CRA) to React Version 18. How to deal with the breaking changes and handle errors (Typescript ...

react-scripts@4.0.3 - Snyk Vulnerability Database

Report a new vulnerability Found a mistake? Direct Vulnerabilities. No direct vulnerabilities have been found for this package in Snyk's vulnerability database.

6 high severity vulnerabilities to address all issues ... - You.com

When I enter npm install in the relevant react project folder, ... webpack Depends on vulnerable versions of webpack-dev-server node_modules/react-scripts ...

react-scripts: Versions - Openbase

npm install --save --save-exact react-scripts@5.0.1 ... ESLint 7 and added many new rules including some for Jest and React Testing Library as well...