browserslist-ga icon indicating copy to clipboard operation
browserslist-ga copied to clipboard

Update package-lock.json file to automatically remove the high severity vulnerability introduced by package node-forge

Open paimon0715 opened this issue 3 years ago • 0 comments

Hi, @dmfrancisco, I have reported a vulnerability issue in package google-p12-pem.

As far as I am aware, vulnerability(high severity) CVE-2020-7720 detected in package node-forge(<0.10.0) is directly referenced by  [email protected], on which your package [email protected] transitively depends. As such, this vulnerability can also affect [email protected] via the following path: [email protected] âž” [email protected] âž” [email protected] âž” [email protected] âž” [email protected] âž” [email protected](vulnerable version)

Since google-p12-pem has released a new patched version [email protected] to resolve this issue ([email protected] âž” [email protected](fix version)), then this vulnerability patch can be automatically propagated into your project only if you update your package-lock.json file (delete package-lock.json and re-execute npm install command): [email protected] âž” [email protected] âž” [email protected] âž” [email protected] âž” [email protected] âž” [email protected](vulnerability fix version).

A warm tip.^_^ Best regards, Paimon

paimon0715 avatar Jul 30 '21 12:07 paimon0715