Vulnerable Dependency: macaddress

Hi, apologies if this isn’t the right place for this.

Using create-react-app and running npm audit (available as npm 6) returns a vulnerable dependency report with Critical tag:

=== npm audit security report ===

Package: macaddress Dependency of: react-scripts Path: react-scripts > css-loader > cssnano > postcss-filter-plugins > uniqid > macaddress More info: https://nodesecurity.io/advisories/654

[gaearon]

From the vulnerability description you linked to:

For this vulnerability to be exploited an attacker needs to control the iface argument to the one method.

If you look at the code for uniqid you’ll see this is not the case.

So there is no actual vulnerability you’re being exposed to.

Feel free to send us a PR that bumps the package version when downstream packages stop using the vulnerable one but there is no issue that we need to address on our side.

[gaearon]

It’s said here:

https://nodesecurity.io/advisories/654

For this vulnerability to be exploited an attacker needs to control the iface argument to the one method.

The macaddress package exports a method called one that takes a single argument. If that argument was supplied by an attacker they could trigger the vulnerability. However, in our case that argument is hardcoded in the uniq implementation I linked to above:

// ...
var mac = typeof __webpack_require__ !== 'function' ? require('macaddress').one(macHandler) : null ;
// ...
function macHandler(error){
  // ...
}

It’s not based on user input and can’t be controlled by an attacker. So there is no vulnerability in this case.

Does this explanation help?