Is there a false positive in commons-discovery.js?

[t3xtm0d3]

We have found that the DependencyCheck reported that one of the packages contains a vulnerability with CVE-2022-0869. The CVE involves a python-based forum named 'Spirit' which is vulnerable to an Open Redirect vulnerability. By the way, the tool reported that the package commons-discovery.js was vulnerable to the stated CVE. I think the two packages are not related. Could you please help check the findings?

[aikebah]

While this is a false positive I would not recommend depending on the library. The library is in the dormant section of apache commons. https://commons.apache.org/dormant.html https://commons.apache.org/dormant/commons-discovery/index.html

On top of that your version is 3 minor revisions behind their latest release.