Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix security vulnerability by upgrading json-schema npm package #2

Open
jdulin-datto opened this issue Apr 12, 2022 · 0 comments
Open

Comments

@jdulin-datto
Copy link

Describe the bug
The json-schema npm dependency in package.json is outdated and vulnerable to attacks. Updating to version >=0.4.0 should fix the problem.

To Reproduce
Steps to reproduce the behavior:

  1. Run npm audit
  2. Find the following:
json-schema  <0.4.0
Severity: moderate
json-schema is vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-896r-f27r-55mw
No fix available
node_modules/@xops.net/json-schema-to-react-tree/node_modules/json-schema
  @xops.net/json-schema-to-react-tree  *
  Depends on vulnerable versions of json-schema
  node_modules/@xops.net/json-schema-to-react-tree

Expected behavior
Running npm audit should not include any warnings about the json-schema package

Additional context
See GHSA-896r-f27r-55mw to read about the vuln.
This should be as easy as running npm install [email protected] to fix.
This will also fix the same vulnerability that exists in https://github.com/open-rpc/docs-react due to this package being a dependency.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant