Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

`react-dev-utils`: Prototype Pollution in Immer

See original GitHub issue

Describe the bug

The react-dev-utils package uses a vulnerable version (v8.0.4) of Immer.

The fix, commit fa671e5, is part of the v9.0.6 release. The react-dev-utils package should use this specific version of Immer.

GitHub CVE

Prototype Pollution in immer (critical severity): CVE-2021-3757.
Prototype Pollution in immer (high severity): CVE-2021-23436.

Issue Analytics

State:
Created 2 years ago
Reactions:31
Comments:6

Top GitHub Comments

9reactions

furdzikcommented, Nov 3, 2021

Any update on this?

In my project also react-dev-utils@11.0.4 has immer as dependency but still in version 8.0.1.

7reactions

DaisyyKMcommented, Oct 7, 2021

Vulnerability is still there because we are not getting the updated version Linking my comment from PR https://github.com/facebook/create-react-app/pull/11364#issuecomment-938057494

Top Results From Across the Web

reactjs - "Critical Prototype Pollution in immer" Patched >=9.0.6

Install the patched version of immer, in this case 9.0.6 , using the following command: npm install --save immer@9.0.6 · Update the package.json ......

react-dev-utils uses a vulnerable version of immer as ... - GitHub

Describe the bug react-dev-utils package uses a vulnerable version (7.0.9) of immer as a dependency. Here is the GitHub CVE (High Severity) ...

Prototype Pollution in immer | CVE-2021-23436 | Snyk

Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects.

"Critical Prototype Pollution in immer" Patched >=9.0.6-Reactjs

[Solved]-Fix for vulnerability - "Critical Prototype Pollution in immer" ... It has already upgraded transitively via react-dev-utils to immer@^9.0.7.

gatsby | npm - Open Source Insights

Prototype Pollution in immer. 9.8 CRITICAL·GHSA-33f9-j839-rf8h. More details · Prototype pollution in webpack loader-utils. 9.8 CRITICAL·GHSA-76p3-8jx3-jpfq.