GOT dependency vulnerability

[ottoville]

The SWA-CLI have dependency of GOT 9.6.0 package as seen in following diagram:

└─┬ @azure/[email protected] └─┬ [email protected] └─┬ [email protected] └─┬ [email protected] └── [email protected]

The GOT package version before 12.1.0 have vulnerability CVE-2022-33987 https://nvd.nist.gov/vuln/detail/CVE-2022-33987

[fgoulet]

I'd like to see this vulnerability addressed sometime also.

[dylan-smith]

this is annoying, it's giving my project that uses the CLI package a security alert in github because of this, with no apparent way to address it short of getting rid of my reliance on the SWA CLI.

[nkelly75]

This is still an issue with @azure/[email protected]

[FlippingBinary]

Kind of disappointing that there has been no official response to this. However, I think this tool is supposed to be installed globally rather than as a project dependency.

Maybe the way this tool uses got would not present an opportunity for exploitation of the unix sockets (or would only present the opportunity to the dev who is using the tool), but the easy way to get rid of the security warnings is to simply remove it as a dependency and install it globally, as described in the Quick Start section of the readme.