React-Scripts dependencies with CVEs #8529

kevinfealey · 2020-02-20T22:40:13Z

Is your proposal related to a problem?

Snyk reports vulnerabilities in react-scripts dependency tree:

✗ Medium severity vulnerability found in dot-prop

Description: Prototype Pollution
Info: https://snyk.io/vuln/SNYK-JS-DOTPROP-543489

✗ Medium severity vulnerability found in @hapi/hoek

Description: Prototype Pollution
Info: https://snyk.io/vuln/SNYK-JS-HAPIHOEK-548452

Introduced through: [email protected]
From: [email protected] > [email protected] > [email protected] > @hapi/[email protected] > @hapi/[email protected]
From: [email protected] > [email protected] > [email protected] > @hapi/[email protected] > @hapi/[email protected] > @hapi/[email protected]
Fixed in: 8.5.1, 9.0.3

Please note that although the above references [email protected], v3.4.0 has not updated these dependencies and therefore has the same problem.

Describe the solution you'd like

Release a new version of react-scripts that updates to the latest versions of workbox-webpack-plugin and optimize-css-assets-webpack-plugin, which should resolve this issue.

Describe alternatives you've considered

None

Additional context

N/A

krisgerhard · 2020-04-30T07:06:52Z

I'll add some from [email protected] (latest)

Description: Prototype Pollution
Info: https://app.snyk.io/vuln/SNYK-JS-YARGSPARSER-560381**

Introduced through: [email protected] › [email protected] › [email protected] › [email protected]

shmily40686 · 2020-05-01T09:47:48Z

+1 for yargs-parser

MrMonsk · 2020-05-01T14:21:48Z

yargs-parser has had breaking changes in its releases since 16.1.0: https://github.com/yargs/yargs-parser/releases

In the meantime, forcing resolution to an pre-breaking change release of yargs-parser seems to work

thecaptain10 · 2020-05-06T20:18:02Z

any version of react-scripts package without this vulnerability?

vikramdadwal · 2020-05-07T19:22:00Z

any fix planned for yargs-parser ?

ianschmitz · 2020-05-08T04:17:41Z

Please file with webpack-dev-server about yargs-parser. There's nothing we can from our end to update their dependencies.

priegger · 2020-05-08T06:26:56Z

There is a webpack-dev-server issue: webpack/webpack-dev-server#2559

mhassan1 · 2020-05-08T15:53:37Z

FYI: webpack/webpack-dev-server#2581 has been merged and [email protected] has been released with the fix.

I've opened a PR here to upgrade yargs-parser: #8975

mhassan1 · 2020-05-11T23:10:44Z

When might we expect the next release of react-scripts?

dillu24 · 2020-05-15T12:08:31Z

When might we expect the next release of react-scripts?

Hope that this is soon because a new high priority vulnerability has been raised now:

Denial of Service in the web-pack dependency

matteofigus · 2020-05-18T11:48:27Z

@ianschmitz @iansu do you know when the next release will happen? I think it would be nice if we could get security related changes published as soon as possible after being reviewed and merged.

I would love to help if I can. If there are specific tasks needed or technical blockers, I would be happy to be involved and pick up some work?

sonikamah · 2020-05-19T04:42:26Z

I am also getting this error for react-scripts > webpack-dev-server > yargs > yargs-parser, Is there any solution to it ? My website build is getting failed because of this error.

                  === npm audit security report ===


                             Manual Review
         Some vulnerabilities require your attention to resolve

      Visit https://go.npm.me/audit-guide for additional guidance

Low Prototype Pollution

Package yargs-parser

Patched in >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2

Dependency of react-scripts [dev]

Path react-scripts > webpack-dev-server > yargs > yargs-parser

More info https://npmjs.com/advisories/1500

found 1 low severity vulnerability in 1690 scanned packages
1 vulnerability requires manual review. See the full report for details.

dillu24 · 2020-05-19T07:50:28Z

I am also getting this error for react-scripts > webpack-dev-server > yargs > yargs-parser, Is there any solution to it ? My website build is getting failed because of this error.
                  === npm audit security report ===


                             Manual Review
         Some vulnerabilities require your attention to resolve

      Visit https://go.npm.me/audit-guide for additional guidance
Low Prototype Pollution

Package yargs-parser

Patched in >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2

Dependency of react-scripts [dev]

Path react-scripts > webpack-dev-server > yargs > yargs-parser

More info https://npmjs.com/advisories/1500

found 1 low severity vulnerability in 1690 scanned packages
1 vulnerability requires manual review. See the full report for details.

Same here. I am tracking this issue here https://github.com/zw627/react-router-github-pages/issues/11

shahrukhsiddiqui · 2020-05-22T09:34:10Z

Getting this audit report is their any update on this ?
`
=== npm audit security report ===

                                           Manual Review

Some vulnerabilities require your attention to resolve

Visit https://go.npm.me/audit-guide for additional guidance

Low Prototype Pollution

Package yargs-parser

Patched in >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2

Dependency of react-scripts

Path react-scripts > webpack-dev-server > yargs > yargs-parse

More info https://npmjs.com/advisories/1500

found 1 low severity vulnerability in 1620 scanned packages
1 vulnerability requires manual review. See the full report for details.`

AbhaysinghBhosale · 2020-06-15T05:33:45Z

Getting the same issue mentioned above, is there any new version of react-script which will fix this issue.

Low             Prototype Pollution                                                                                                                   
Package         yargs-parser                                                                                                                        
Patched in      >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2                                                                                           
Dependency of   react-scripts [dev]                                                                                                                            
Path            react-scripts > webpack-dev-server > yargs > yargs-parser                                                                                   
More info       https://nodesecurity.io/advisories/1500

lausellduane · 2020-06-16T17:43:52Z

I am having the same issue, any updates on this?

shridharbhandiwad · 2020-07-03T06:11:03Z

Same issue here.

Getting nearly 5000 low severity vulnerabilities with react-scripts 3.4.1.

found 4982 low severity vulnerabilities in 1641 scanned packages
4982 vulnerabilities require manual review. See the full report for details.

Attached is the vulnerability report.
vulnerability-report.txt

EoghanBonass · 2020-07-03T06:30:37Z

Same issue here.

Getting nearly 5000 low severity vulnerabilities with react-scripts 3.4.1.

found 4982 low severity vulnerabilities in 1641 scanned packages 4982 vulnerabilities require manual review. See the full report for details.

Most of these are not related to yargs-parser - they're from a new vulnerability raised by npm for lodash. This PR https://github.com/lodash/lodash/pull/4759 has already been merged to fix the issue, so npm will probably release a patch based on the PR.

jacobwicks · 2020-07-03T21:20:41Z

Same issue here.
Getting nearly 5000 low severity vulnerabilities with react-scripts 3.4.1.
found 4982 low severity vulnerabilities in 1641 scanned packages 4982 vulnerabilities require manual review. See the full report for details.

Most of these are not related to yargs-parser - they're from a new vulnerability raised by npm for lodash. This PR https://github.com/lodash/lodash/pull/4759 has already been merged to fix the issue, so npm will probably release a patch based on the PR.

Good to know, I just spent a while trying unsuccessfully to fix this.

shridharbhandiwad · 2020-07-04T03:04:37Z

Same issue here.
Getting nearly 5000 low severity vulnerabilities with react-scripts 3.4.1.
found 4982 low severity vulnerabilities in 1641 scanned packages 4982 vulnerabilities require manual review. See the full report for details.

Most of these are not related to yargs-parser - they're from a new vulnerability raised by npm for lodash. This PR https://github.com/lodash/lodash/pull/4759 has already been merged to fix the issue, so npm will probably release a patch based on the PR.

Thanks a lot for the update @EoghanBonass

EoghanBonass · 2020-07-06T09:05:55Z

No problem @shridharbhandiwad and @jacobwicks 🙂

The lodash PR was merged into what I assume is a release branch (lodash:4.17.15-post), so this needs to be fully released and then whitelisted by npm for the lodash vulnerability to be resolved.

dimaqq · 2020-07-14T07:00:14Z

re: workbox, would it makes sense to make it optional?
I feel that there was a time when Google pushed PWA and I think that was perhaps the impetus of adding it in, right?
But today, is it all that common to use web workers?

iamjatinchauhan · 2020-07-27T18:53:33Z

when other dependencies are updated the yargs-parser get rollback to its previous older versions.

on updating outdated packages, yargs-parser needs manual audit to update its new patch again.

jimmyandrade · 2020-08-07T15:44:54Z

cc @vigomesbr

schontz · 2020-09-08T23:06:33Z

When will this be fixed?
Does it actually matter? In other words, does any of the broken lodash or yargs code end up in the final build?

gaearon · 2020-10-07T09:29:36Z

There are no and have been no vulnerabilities here that would affect Create React App projects. These are all false positives because none of this code ends up in a build.

This is all, unfortunately, wasted effort.

gaearon · 2020-10-07T09:31:35Z

I’m going to close as there’s no real vulnerabilities and they’re all transitive. This means that if you are determined to spend time on false positives (for example, maybe your company adopted a policy that treats false positives from npm audit as real issues) then you need to file issues in the transitive dependencies. Once those are fixed you need to regenerate the lockfile. There is nothing actionable for Create React App here.

kevinfealey added issue: proposal needs triage labels Feb 20, 2020

mhassan1 mentioned this issue May 8, 2020

bump webpack-dev-server to 3.11.0 #8975

Merged

idormenco mentioned this issue May 23, 2020

Update yargs-parser version code4romania/covid-19-jurnal-medical#429

Open

damien-git mentioned this issue May 26, 2020

npm audit vulnerability : react-scripts > webpack-dev-server > yargs > yargs-parser #9033

Closed

j1mr10rd4n mentioned this issue Jul 27, 2020

"found 1 low severity vulnerability" warning while creating React App using "npx create-react-app" command. #9367

Closed

AmyShackles mentioned this issue Oct 3, 2020

[email protected] has higher dependency versions than [email protected]? #9747

Closed

gaearon closed this as completed Oct 7, 2020

facebook locked as resolved and limited conversation to collaborators Oct 7, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

React-Scripts dependencies with CVEs #8529

React-Scripts dependencies with CVEs #8529

kevinfealey commented Feb 20, 2020

krisgerhard commented Apr 30, 2020 •

edited

Loading

shmily40686 commented May 1, 2020

MrMonsk commented May 1, 2020

thecaptain10 commented May 6, 2020 •

edited

Loading

vikramdadwal commented May 7, 2020 •

edited

Loading

ianschmitz commented May 8, 2020

priegger commented May 8, 2020

mhassan1 commented May 8, 2020 •

edited

Loading

mhassan1 commented May 11, 2020

dillu24 commented May 15, 2020

matteofigus commented May 18, 2020 •

edited

Loading

sonikamah commented May 19, 2020

dillu24 commented May 19, 2020

shahrukhsiddiqui commented May 22, 2020 •

edited

Loading

AbhaysinghBhosale commented Jun 15, 2020 •

edited

Loading

lausellduane commented Jun 16, 2020

shridharbhandiwad commented Jul 3, 2020 •

edited

Loading

EoghanBonass commented Jul 3, 2020

jacobwicks commented Jul 3, 2020

shridharbhandiwad commented Jul 4, 2020

EoghanBonass commented Jul 6, 2020

dimaqq commented Jul 14, 2020

iamjatinchauhan commented Jul 27, 2020

jimmyandrade commented Aug 7, 2020

schontz commented Sep 8, 2020

gaearon commented Oct 7, 2020

gaearon commented Oct 7, 2020

React-Scripts dependencies with CVEs #8529

React-Scripts dependencies with CVEs #8529

Comments

kevinfealey commented Feb 20, 2020

Is your proposal related to a problem?

Describe the solution you'd like

Describe alternatives you've considered

Additional context

krisgerhard commented Apr 30, 2020 • edited Loading

shmily40686 commented May 1, 2020

MrMonsk commented May 1, 2020

thecaptain10 commented May 6, 2020 • edited Loading

vikramdadwal commented May 7, 2020 • edited Loading

ianschmitz commented May 8, 2020

priegger commented May 8, 2020

mhassan1 commented May 8, 2020 • edited Loading

mhassan1 commented May 11, 2020

dillu24 commented May 15, 2020

matteofigus commented May 18, 2020 • edited Loading

sonikamah commented May 19, 2020

dillu24 commented May 19, 2020

shahrukhsiddiqui commented May 22, 2020 • edited Loading

AbhaysinghBhosale commented Jun 15, 2020 • edited Loading

lausellduane commented Jun 16, 2020

shridharbhandiwad commented Jul 3, 2020 • edited Loading

EoghanBonass commented Jul 3, 2020

jacobwicks commented Jul 3, 2020

shridharbhandiwad commented Jul 4, 2020

EoghanBonass commented Jul 6, 2020

dimaqq commented Jul 14, 2020

iamjatinchauhan commented Jul 27, 2020

jimmyandrade commented Aug 7, 2020

schontz commented Sep 8, 2020

gaearon commented Oct 7, 2020

gaearon commented Oct 7, 2020

krisgerhard commented Apr 30, 2020 •

edited

Loading

thecaptain10 commented May 6, 2020 •

edited

Loading

vikramdadwal commented May 7, 2020 •

edited

Loading

mhassan1 commented May 8, 2020 •

edited

Loading

matteofigus commented May 18, 2020 •

edited

Loading

shahrukhsiddiqui commented May 22, 2020 •

edited

Loading

AbhaysinghBhosale commented Jun 15, 2020 •

edited

Loading

shridharbhandiwad commented Jul 3, 2020 •

edited

Loading