Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

CVE-2021-28092

See original GitHub issue

Laravel Mix Version: v6.0.13
Node Version (node -v): v14.16.0
NPM Version (npm -v): v6.14.11
OS: Ubuntu 20.04

laravel-mix@6.0.5 requires is-svg@^3.0.0 via a transitive dependency on postcss-svgo@4.0.2

https://github.com/advisories/GHSA-7r28-3m3f-r2pr

Issue Analytics

State:
Created 2 years ago
Comments:5 (1 by maintainers)

Top GitHub Comments

3reactions

thecrypticacecommented, Mar 23, 2021

This is due to our dependency of cssnano. I believe the only resolution right now is to use yarn + yarn resolutions to fix this. They have not released (and appears will not release) a fix in a non-major version.

0reactions

driesvintscommented, Apr 21, 2021

I sent in a PR for this one: https://github.com/JeffreyWay/laravel-mix/pull/2944

Top Results From Across the Web

CVE-2021-28092 Detail - NVD

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS).

CVE-2021-28092

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If...

CVE-2021-28092 - Red Hat Customer Portal

A flaw was found in is-svg package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service (ReDoS)....

CVE-2021-28092 Node.js Vulnerability in NetApp Products

Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Vulnerability Scoring Details. CVE, Score, Vector. CVE-2021 ...

Security Bulletin: Vulnerability in Node.js IS-SVG affects IBM ...

Security Bulletin: Vulnerability in Node.js IS-SVG affects IBM Process Mining (CVE-2021-29059, CVE-2021-28092) · Security Bulletin: The Apache ...