[DevAudit] [audit] audit on 3/19/2017 11:51 PM

[allisterb]

Package Source Audit Results

1 total vulnerability found in Bower package source audit.

[1/3] angular [VULNERABLE] 21 known vulnerabilities, 1 affecting installed package version(s): [^1.5.0]
--[1/1] Cross Site Scripting (XSS) when loaded from an extension
--Description: > Extension URIs (resource://...) bypass Content-Security-Policy in Chrome and Firefox and can always be loaded. Now if a site already has a XSS bug, and uses CSP to protect itself, but the user has an extension installed that uses Angular, an attacke[r] can load Angular from the extension, and Angular's auto-bootstrapping can be used to bypass the victim site's CSP protection.

-- github.com
--Affected versions: >=1.5.0 <1.5.9

[2/3] node-uuid 2 known vulnerabilities, 0 affecting installed package version(s).
[3/3] react 3 known vulnerabilities, 0 affecting installed package version(s).