Snyk reports high risk severity for acorn in react-scripts

Describe the bug

Snyk reports high severity issue with react-scripts. See details below:

Regular Expression Denial of Service (ReDoS)

Vulnerable module: acorn
Introduced through: react-scripts@3.4.0
Exploit maturity: No known exploit
Fixed in: 7.1.1

Detailed paths

Introduced through: react-experiment@0.3.3 › react-scripts@3.4.0 › webpack@4.41.5 › acorn@6.4.0
Remediation: No remediation path available.
Introduced through: react-experiment@0.3.3 › react-scripts@3.4.0 › jest-environment-jsdom-fourteen@1.0.1 › jsdom@14.1.0 › acorn@6.4.0
Remediation: No remediation path available.
Introduced through: react-experiment@0.3.3 › react-scripts@3.4.0 › jest-environment-jsdom-fourteen@1.0.1 › jsdom@14.1.0 › acorn-globals@4.3.4 › acorn@6.4.0
Remediation: No remediation path available.

…and 14 more Overview

acorn is a tiny, fast JavaScript parser written in JavaScript.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via a regex in the form of /[x-\ud800]/u, which causes the parser to enter an infinite loop.

This string is not a valid UTF16 and is therefore not sanitized before reaching the parser. An application which processes untrusted input and passes it directly to acorn, will allow attackers to leverage the vulnerability leading to a Denial of Service.

Did you try recovering your dependencies?

Yes.

Please paste the output of npm --version and/or yarn --version to confirm.

6.13.7

Which terms did you search for in User Guide?

Not applicable.

Environment

Environment Info:

System: OS: Windows 7 6.1.7601 CPU: (8) x64 Intel® Core™ i7-4790K CPU @ 4.00GHz Binaries: Node: 12.16.1 - C:\Program Files\nodejs\node.EXE Yarn: 1.21.1 - C:\Program Files (x86)\Yarn x\bin\yarn.CMD npm: 6.13.7 - C:\Program Files\nodejs\npm.CMD Browsers: Internet Explorer: 11.0.9600.19301 npmPackages: react: ^16.13.0 => 16.13.0 react-dom: ^16.13.0 => 16.13.0 react-scripts: 3.4.0 => 3.4.0 npmGlobalPackages: create-react-app: Not Found

Steps to reproduce

Install new version of React.

(Write your steps here:)

1. npx create-react-app my-app
2. Test with Snyk.io

[vanskins]

This needs to be fixed asap because it affect developers using create-react-app.

[Caruso33]

Running npm, I was able to fix it temporarily by adding to package.json scripts: "preinstall": "npx npm-force-resolutions",

and adding to package.json "resolutions": { "acorn": "^7.1.1" }

waiting for react-scripts update though.