Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

cpy has transitive dependencies with a CVE vulnerability

See original GitHub issue

cpy depends on globby @ ^12.0.2. Following the dependency chain, this also pulls in globby @ 9.2.0. That version of globby depends on fast-glob which depends on glob-parent at a specific version with a vulnerability.

| +-- globby@9.2.0
| | +-- @types/glob@7.2.0
| | | +-- @types/minimatch@3.0.5
| | | `-- @types/node@16.11.9
| | +-- array-union@1.0.2
| | | `-- array-uniq@1.0.3
| | +-- dir-glob@2.2.2
| | | `-- path-type@3.0.0
| | |   `-- pify@3.0.0
| | +-- fast-glob@2.2.7
| | | +-- @mrmlnc/readdir-enhanced@2.2.1
| | | | +-- call-me-maybe@1.0.1
| | | | `-- glob-to-regexp@0.3.0
| | | +-- @nodelib/fs.stat@1.1.3
| | | +-- glob-parent@3.1.0 <---
| | | | +-- is-glob@3.1.0
| | | | | `-- is-extglob@2.1.1 deduped
| | | | `-- path-dirname@1.0.2

+-------------+------------------+----------+-------------------+---------------+---------------------------------------+
|   LIBRARY   | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+-------------+------------------+----------+-------------------+---------------+---------------------------------------+
| glob-parent | CVE-2020-28469   | HIGH     | 3.1.0             | 5.1.2         | nodejs-glob-parent: Regular           |
|             |                  |          |                   |               | expression denial of service          |
|             |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2020-28469 |
+-------------+------------------+----------+-------------------+---------------+---------------------------------------+

The latest version of globby has a dependency tree which does pull in a fixed version of glob-parent.

Issue Analytics

State:
Created 2 years ago
Reactions:7
Comments:7 (2 by maintainers)

Top GitHub Comments

3reactions

ryami333commented, Jan 31, 2022

@sindresorhus is it actually truly blocked by that PR - or does that PR just happen to address the issue, amongst other things? Wondering because that PR seems to have stalled, and this remains a “high severity” CVE alert, months on. It either needs a new champion, or for the transitive dependency aspects to be cherry-picked.

3reactions

sindresorhuscommented, Dec 3, 2021

It’s blocked by https://github.com/sindresorhus/cpy/pull/92