[Security] Vulnerability of medium severity disclosed in transitive dependencies

Bug or support request summary

On December 10th 2019, a Cross-site Scripting vulnerability was disclosed in the Serialize-javascript package in versions below 2.1.1.

Storybook transitively depends on vulnerable versions of this package through the following paths:

@storybook/react > @storybook/core > corejs-upgrade-webpack-plugin > webpack > terser-webpack-plugin > serialize-javascript

@storybook/react > @storybook/core > webpack > terser-webpack-plugin > serialize-javascript

@storybook/react > webpack > terser-webpack-plugin > serialize-javascript

@storybook/react > @storybook/core > terser-webpack-plugin > serialize-javascript

Please specify which version of Storybook and optionally any affected addons that you’re running

• “@storybook/react”: “^5.1.9”

However, this was last updated to 5.2.6. I’ve confirmed that as of 9e66d9f26c49fee2a2c527775be5e638ff011b5d these vulnerabilities are still present in Storybook according to yarn audit.

Affected platforms

• If UI related, please indicate browser, OS, and version
• If dependency related, please include relevant version numbers
• If developer tooling related, please include the platform information

Screenshots / Screencast / Code Snippets (Optional)

// code here

End bug report support request - delete the rest below

[shilman]

thanks @mattmoreira !

[mattmoreira]

@shilman, as this was solved by #10071, can we close it?