Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

项目引用了glob-parent等238个开源组件,存在7个漏洞,建议升级 #27

Open
ghost opened this issue Mar 4, 2022 · 1 comment

Comments

@ghost
Copy link

ghost commented Mar 4, 2022

大佬,你好,我是@abbykimi,我IDE运行您这个项目的时候,提示有几个漏洞,项目调用了glob-parent等238个开源组件,存在7个安全漏洞,建议你升级下。

漏洞标题:nodejs 资源管理错误漏洞
漏洞编号:CVE-2020-28469
漏洞描述:
nodejs是是一个基于ChromeV8引擎的JavaScript运行环境通过对Chromev8引擎进行了封装以及使用事件驱动和非阻塞IO的应用让Javascript开发高性能的后台应用成为了可能。
nodejs-glob-parent 存在安全漏洞,该漏洞源于正则表达式拒绝服务。
影响范围:(∞, 5.1.2)
最小修复版本:5.1.2
引入路径:
jothon-net@0.0.1->template@git+ssh://git@github.com/zbryikt/template.git#7681a62f45ffa1530e744aceb407bd39d71bf07b->chokidar@3.4.0->glob-parent@5.1.1

另外6个漏洞,如需查看详细报告、复测或持续监测您的项目,戳这里https://www.mfsec.cn/jr?p=mb5052

如果你对这个issues有任何疑问可以回复我哈( @abbykimi ),我会及时回复你的。

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants
and others