Security vulnerabilities in http-proxy and markdown-to-jsx

Current behavior

The dependencies

• vue-styleguidist>react-styleguidist>webpack-dev-server>http-proxy-middleware>http-proxy
• vue-styleguidist>webpack-dev-server>http-proxy-middleware>http-proxy
• vue-styleguidist>react-styleguidist>markdown-to-jsx

are reported with high vulnerabilities.

More information:

https://www.npmjs.com/advisories/1219 https://www.npmjs.com/advisories/1486

Our project audit-ci output:

audit-ci version: 2.5.1
NPM audit report results:
{
  "advisories": {
    "1219": {
      "findings": [
        {
          "version": "6.11.1",
          "paths": [
            "vue-styleguidist>react-styleguidist>markdown-to-jsx"
          ]
        }
      ],
      "id": 1219,
      "created": "2019-10-17T19:30:12.675Z",
      "updated": "2020-05-20T01:58:17.837Z",
      "deleted": null,
      "title": "Cross-Site Scripting",
      "found_by": {
        "link": "",
        "name": "Bob \"Wombat\" Hogg",
        "email": ""
      },
      "reported_by": {
        "link": "",
        "name": "Bob \"Wombat\" Hogg",
        "email": ""
      },
      "module_name": "markdown-to-jsx",
      "cves": [],
      "vulnerable_versions": ">=0.0.0",
      "patched_versions": "<0.0.0",
      "overview": "All versions of `simple-markdown` are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing `data` or VBScript URIs and a base64-encoded payload.",
      "recommendation": "No fix is currently available. Consider using an alternative package until a fix is made available.",
      "references": "",
      "access": "public",
      "severity": "high",
      "cwe": "CWE-79",
      "metadata": {
        "module_type": "",
        "exploitability": 4,
        "affected_components": ""
      },
      "url": "https://npmjs.com/advisories/1219"
    },
    "1486": {
      "findings": [
        {
          "version": "1.17.0",
          "paths": [
            "@vue/cli-service>webpack-dev-server>http-proxy-middleware>http-proxy",
            "vue-styleguidist>react-styleguidist>webpack-dev-server>http-proxy-middleware>http-proxy",
            "vue-styleguidist>webpack-dev-server>http-proxy-middleware>http-proxy"
          ]
        }
      ],
      "id": 1486,
      "created": "2020-02-21T14:16:24.023Z",
      "updated": "2020-05-18T14:50:08.944Z",
      "deleted": null,
      "title": "Denial of Service",
      "found_by": {
        "link": "https://twitter.com/_awry",
        "name": "Grant Murphy",
        "email": ""
      },
      "reported_by": {
        "link": "https://twitter.com/_awry",
        "name": "Grant Murphy",
        "email": ""
      },
      "module_name": "http-proxy",
      "cves": [],
      "vulnerable_versions": "<1.18.1",
      "patched_versions": ">=1.18.1",
      "overview": "Versions of `http-proxy` prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an `ERR_HTTP_HEADERS_SENT` unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the `proxyReq.setHeader` function.   \n\nFor a proxy server running on `http://localhost:3000`, the following curl request triggers the unhandled exception:  \n```curl -XPOST http://localhost:3000 -d \"$(python -c 'print(\"x\"*1025)')\"```",
      "recommendation": "Upgrade to version 1.18.1 or later",
      "references": "- [Patch PR](https://github.com/http-party/node-http-proxy/pull/1447/files)",
      "access": "public",
      "severity": "high",
      "cwe": "CWE-400",
      "metadata": {
        "module_type": "",
        "exploitability": 4,
        "affected_components": ""
      },
      "url": "https://npmjs.com/advisories/1486"
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 47850,
      "moderate": 26,
      "high": 4,
      "critical": 0
    },
    "dependencies": 63,
    "devDependencies": 3449,
    "optionalDependencies": 87,
    "totalDependencies": 3512
  }
}

To reproduce

npm install --save-dev audit-ci
audit-ci --high

Audit fails.

Expected behavior

No vulnerabilities in dependencies. Audit passes.

[elevatebart]

@solidevolution Would you please check if it is fixed?

If it is not, please re-open this issue.

Thank you

[solidevolution]

It’s fixed, thanks!