extensions-api icon indicating copy to clipboard operation
extensions-api copied to clipboard

npm tableau/tabextsandbox has vulnerabilities

Open AO-91 opened this issue 3 years ago • 1 comments

When I follow https://tableau.github.io/extensions-api/docs/trex_getstarted.html and install I get vulnerabilitiy warnings:

# npm audit report

ejs  <3.1.7
Severity: critical
Template injection in ejs - https://github.com/advisories/GHSA-phwq-j96m-2c2q
No fix available
node_modules/ejs
  @tableau/tabextsandbox  *
  Depends on vulnerable versions of ejs
  Depends on vulnerable versions of optimist
  node_modules/@tableau/tabextsandbox

minimist  <=1.2.5
Severity: critical
Prototype Pollution in minimist - https://github.com/advisories/GHSA-xvch-5gv4-984h
Prototype Pollution in minimist - https://github.com/advisories/GHSA-vh95-rmgr-6w4m
fix available via `npm audit fix`
node_modules/@tableau/tabextsandbox/node_modules/minimist
  optimist  >=0.6.0
  Depends on vulnerable versions of minimist
  node_modules/@tableau/tabextsandbox/node_modules/optimist

4 vulnerabilities (1 moderate, 3 critical)

the fix using npm audit doesn't work. It seems like npm minimist is using version 0.0.1.

+-- @tableau/[email protected]
| `-- [email protected]
|   `-- [email protected]

Just wanted to bring it to your attention. If this is something that I can fix on my end then any advice is much appreciated!

AO-91 avatar Aug 15 '22 08:08 AO-91

Thank you for bringing this to our attention. We will get the dependencies updated. John

johnDance avatar Aug 15 '22 20:08 johnDance

Fixed in version 1.10.0 Thank you.

johnDance avatar Dec 29 '22 15:12 johnDance