question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Security issues Vulnerability

See original GitHub issue

Command npm audit returned the following list of errors with high severity:

  High            Arbitrary File Write                                          

  Package         decompress                                                    

  Patched in      No patch available                                            

  Dependency of   imagemin-pngquant [dev]                                       

  Path            imagemin-pngquant > pngquant-bin > bin-build > decompress     

  More info       https://npmjs.com/advisories/1217  



  High            Arbitrary File Write                                          

  Package         decompress                                                    

  Patched in      No patch available                                            

  Dependency of   imagemin-pngquant [dev]                                       

  Path            imagemin-pngquant > pngquant-bin > bin-build > download > decompress     

  More info       https://npmjs.com/advisories/1217  



  High            Arbitrary File Write                                          

  Package         decompress                                                    

  Patched in      No patch available                                            

  Dependency of   imagemin-pngquant [dev]                                       

  Path            imagemin-pngquant > pngquant-bin > bin-build > download >     
                  decompress                                                    

  More info       https://npmjs.com/advisories/1217 

High            Arbitrary File Write                                          

  Package         decompress                                                    

  Patched in      No patch available                                            

  Dependency of   imagemin-gifsicle [dev]                                                                

  Path            imagemin-gifsicle > gifsicle > bin-build > decompress      

  More info       https://npmjs.com/advisories/1217  


  High            Arbitrary File Write                                          

  Package         decompress                                                    

  Patched in      No patch available                                            

  Dependency of   imagemin-gifsicle [dev]                                     

  Path            imagemin-gifsicle > gifsicle > bin-build > download > decompress                                                    

  More info       https://npmjs.com/advisories/1217 


  High            Arbitrary File Write                                          

  Package         decompress                                                    

  Patched in      No patch available                                            

  Dependency of   imagemin-gifsicle [dev]                                     

  Path            imagemin-gifsicle > gifsicle > bin-wrapper > download > decompress                                                    

  More info       https://npmjs.com/advisories/1217 

High            Arbitrary File Write                                          

  Package         decompress                                                    

  Patched in      No patch available                                            

  Dependency of   imagemin-mozjpeg [dev]                                                                

  Path            imagemin-mozjpeg > mozjpeg > bin-build > decompress      

  More info       https://npmjs.com/advisories/1217  



  High            Arbitrary File Write                                          

  Package         decompress                                                    

  Patched in      No patch available                                            

  Dependency of   imagemin-mozjpeg [dev]                                                                

  Path            imagemin-mozjpeg > mozjpeg > bin-build > download > decompress      

  More info       https://npmjs.com/advisories/1217  


  High            Arbitrary File Write                                          

  Package         decompress                                                    

  Patched in      No patch available                                            

  Dependency of   imagemin-mozjpeg [dev]                                       

  Path            imagemin-mozjpeg > mozjpeg > bin-wrapper > download > decompress                                                    

  More info       https://npmjs.com/advisories/1217

Is there a chance to fix this problem?

Issue Analytics

  • State:open
  • Created 4 years ago
  • Reactions:36
  • Comments:6

github_iconTop GitHub Comments

8reactions
jimmyandradecommented, Mar 12, 2020

There’s a community effort to fix this issue, see https://github.com/kevva/decompress/pull/73. Now we are waiting for an answer from @kevva 😃

2reactions
abriginetscommented, Mar 1, 2020

Same here

                       === npm audit security report ===                        


                                 Manual Review                                  
             Some vulnerabilities require your attention to resolve             
                                                                                
          Visit https://go.npm.me/audit-guide for additional guidance           


  High            Arbitrary File Write                                          

  Package         decompress                                                    

  Patched in      No patch available                                            

  Dependency of   imagemin-webp-webpack-plugin [dev]                            

  Path            imagemin-webp-webpack-plugin > imagemin-webp > cwebp-bin >    
                  bin-build > decompress                                        

  More info       https://npmjs.com/advisories/1217                             


  High            Arbitrary File Write                                          

  Package         decompress                                                    

  Patched in      No patch available                                            

  Dependency of   imagemin-webp-webpack-plugin [dev]                            

  Path            imagemin-webp-webpack-plugin > imagemin-webp > cwebp-bin >    
                  bin-build > download > decompress                             

  More info       https://npmjs.com/advisories/1217                             


  High            Arbitrary File Write                                          

  Package         decompress                                                    

  Patched in      No patch available                                            

  Dependency of   imagemin-webp-webpack-plugin [dev]                            

  Path            imagemin-webp-webpack-plugin > imagemin-webp > cwebp-bin >    
                  bin-wrapper > download > decompress                           

  More info       https://npmjs.com/advisories/1217  
Read more comments on GitHub >

github_iconTop Results From Across the Web

What is a Security Vulnerability? | Types & Remediation - Snyk
A security vulnerability is a software code flaw or a system misconfiguration such as Log4Shell through which attackers can directly gain unauthorized access...
Read more >
10 Common Web Security Vulnerabilities - Toptal
Don't suffer through a security breach—take action before any problems arise. Master these 10 common web security vulnerabilities now.
Read more >
Known Exploited Vulnerabilities Catalog | CISA
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to...
Read more >
Latest cybersecurity vulnerability news | The Daily Swig
Read the latest cybersecurity vulnerability news from The Daily Swig. Keeping up with security vulnerabilities is now more crucial than ever.
Read more >
Security 101: Vulnerabilities, Threats & Risk Explained - Splunk
In short, we can see them as a spectrum: First, a vulnerability exposes your organization to threats. A threat is a malicious or...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found