Vulnerability in react-scripts > @svgr/webpack > @svgr/plugin-svgo > svgo > css-select > nth-check & css-what #12132

im-deepakk · 2022-03-04T17:28:24Z

Describe the bug

Upgrade react-scripts to have the @@svgr/webpack@6.* as the dependency. As the current @svgr/[email protected] has following vulnerable versions as dependency.

nth-check - https://security.snyk.io/vuln/SNYK-JS-NTHCHECK-1586032
css-what - https://security.snyk.io/vuln/SNYK-JS-CSSWHAT-1298035

Below is the dependency tree:

+-- [email protected]
├─┬ @svgr/[email protected]
│ └─┬ @svgr/[email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected]
└──[email protected]

Environment

Environment Info:
current version of create-react-app: 5.0.0
System:
OS: Windows 7 6.1.7601
CPU: (8) x64 Intel(R) Xeon(R) CPU E3-1585L v5 @ 3.00GHz
Binaries:
Node: 14.17.6 - ...\tools\nodejs14-win7\latest\node.EXE
Yarn: Not Found
npm: 8.2.0 - ...\data\npm14\npm.CMD
Browsers:
Chrome: 97.0.4692.71
Internet Explorer: 11.0.9600.20139

Steps to reproduce

npx create-react-app

Expected behavior

The react-scripts should not be having any dependency on vulnerable components.

Actual behavior

The dependent package @svgr/webpack 5.5.0 refers to vulnerable components, as per the author the v6 has the fix for the same.

Vishal-Mayal · 2022-03-06T09:43:28Z

Hi, any updates on when the package will be updated?
Thank you.

PraveenkumarD2004 · 2022-03-07T11:27:44Z

Hi, I am also facing the same issue. When I upgrading react-scripts to 5.0.0 version. While npm audit I am getting the same Vulnerability Error.

Error:
Will install [email protected], which is a breaking change
node_modules/svgo/node_modules/nth-check
css-select <=3.1.0
Depends on vulnerable versions of nth-check
node_modules/svgo/node_modules/css-select
svgo 1.0.0 - 1.3.2
Depends on vulnerable versions of css-select
node_modules/svgo
@svgr/plugin-svgo <=5.5.0
Depends on vulnerable versions of svgo
node_modules/@svgr/plugin-svgo
@svgr/webpack 4.0.0 - 5.5.0
Depends on vulnerable versions of @svgr/plugin-svgo
node_modules/@svgr/webpack
react-scripts >=2.1.4
Depends on vulnerable versions of @svgr/webpack
node_modules/react-scripts

FYI, Upgrade react-scripts to have the @@svgr/webpack@6. as the dependency. As the current @svgr/[email protected] has following vulnerable versions as dependency.

Thanks & Regards,
Praveen Kumar D.

palminha · 2022-03-08T09:57:39Z

same here...

% npm audit
# npm audit report

nth-check  <2.0.1
Severity: moderate
Inefficient Regular Expression Complexity in nth-check - https://github.com/advisories/GHSA-rp65-9cf3-cjxr
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/svgo/node_modules/nth-check
  css-select  <=3.1.0
  Depends on vulnerable versions of nth-check
  node_modules/svgo/node_modules/css-select
    svgo  1.0.0 - 1.3.2
    Depends on vulnerable versions of css-select
    node_modules/svgo
      @svgr/plugin-svgo  <=5.5.0
      Depends on vulnerable versions of svgo
      node_modules/@svgr/plugin-svgo
        @svgr/webpack  4.0.0 - 5.5.0
        Depends on vulnerable versions of @svgr/plugin-svgo
        node_modules/@svgr/webpack
          react-scripts  >=2.1.4
          Depends on vulnerable versions of @svgr/webpack
          node_modules/react-scripts

6 moderate severity vulnerabilities

I'm using react-scripts 5.0.0

% npm list react-scripts
[email protected] /Users/palmito/Development/risk-util-tool/webapp
└── [email protected]

palminha · 2022-03-08T10:14:55Z

the vulnerable dependency is dependent of [email protected]

% npm list nth-check
create-react-app@ /Users/palmito/Development/create-react-app
├─┬ cra-docs@ -> ./docusaurus/website
│ └─┬ @docusaurus/[email protected]
│   └─┬ @slorber/[email protected]
│     └─┬ [email protected]
│       └─┬ [email protected]
│         └── [email protected]
├─┬ [email protected] -> ./packages/react-scripts
│ └─┬ [email protected]
│   └─┬ [email protected]
│     └─┬ [email protected]
│       └─┬ [email protected]
│         └── [email protected]
└─┬ [email protected]
  └─┬ [email protected]
    └─┬ [email protected]
      └── [email protected]

palminha · 2022-03-08T10:34:45Z

The vulnerable dependency is caused by svg-term-cli
project seems to be abandoned for a couple of years (a lot of dependabot pull-requests getting rotten...)

palminha · 2022-03-08T10:39:37Z

@marionebl any feedback on svg-term-cli ?

slowWriting · 2022-03-08T15:56:25Z

Have you guys read this stickied issue?
#11174

palminha · 2022-03-08T16:44:08Z

moving the dependency to dev makes the vulnerability only dependent of svgr/webpack

% npm list nth-check
[email protected] /Users/palmito/Development/risk-util-tool/webapp
└─┬ [email protected]
  ├─┬ @svgr/[email protected]
  │ └─┬ @svgr/[email protected]
  │   └─┬ [email protected]
  │     └─┬ [email protected]
  │       └── [email protected]
  └─┬ [email protected]
    └─┬ [email protected]
      └─┬ [email protected]
        └─┬ [email protected]
          └── [email protected]

followed-up here #12146

PraveenkumarD2004 · 2022-03-11T08:30:36Z

Hi, any updates on when the package will be updated?
Thanks & Regards,
Praveen Kumar D.

Stunext · 2022-03-15T21:51:50Z

Read this: #11174 ...then wait, there are more important things than fixing false positives. It will be fixed at the next scheduled update or when a critical bug appears.

Githubbubber · 2022-03-22T18:11:34Z

Read this: #11174 ...then wait, there are more important things than fixing false positives. It will be fixed at the next scheduled update or when a critical bug appears.

Fair enough

JY1148 · 2022-04-01T06:07:51Z

same issue.

npm run build, failed to compile.
npm audit fix, got this:

vishal-bypt · 2022-04-27T14:18:03Z

Is there any ETA for nth-check & css-what vulnerabilities?

Move react-scripts into dev-dependencies. see facebook/create-react-app#12132.

thomazcapra · 2022-05-18T16:46:12Z

While this issue is not fixed, I did a workaround to solve it.

The problem seems to be starting with the lib @svgr/webpack 4.0.0 - 5.0.0.

If you are using node >= 16, you can install @svgr/webpack by yourself, in my case I installed the version: "^6.2.1" as devDependency.

After that, you should create a overrides (or resolutions if you are using yarn) section in your package.json and include the line: @svgr/webpack": "$@svgr/webpack. (in my case, I already had the react and react-dom).

And last, you must remove your node_modules folder and your package-lock.json, and execute npm install.

This worked for me :)

…eact-app#12132

irangar · 2022-05-31T00:05:27Z

And last, you must remove your node_modules folder and your package-lock.json, and execute npm install.

thanks, bro

miotegui · 2022-05-31T04:14:46Z

And last, you must remove your node_modules folder and your package-lock.json, and execute npm install.

i was getting mad, thanks bro! it worked perfect.

if there's a newbie like me there, you can install the dependency with this line:

npm install @svgr/webpack --save-dev

facebook/create-react-app#12132 (comment)

GlennVialli · 2022-06-05T18:08:14Z

While this issue is not fixed, I did a workaround to solve it.

The problem seems to be starting with the lib @svgr/webpack 4.0.0 - 5.0.0.

If you are using node >= 16, you can install @svgr/webpack by yourself, in my case I installed the version: "^6.2.1" as devDependency.

After that, you should create a overrides (or resolutions if you are using yarn) section in your package.json and include the line: @svgr/webpack": "$@svgr/webpack. (in my case, I already had the react and react-dom).

And last, you must remove your node_modules folder and your package-lock.json, and execute npm install.

This worked for me :)

In my case,
my overrides in package.json should be

"overrides": {
"@svgr/webpack": "^6.2.1"
},

thomazcapra · 2022-06-05T19:37:11Z

In my case, my overrides in package.json should be

"overrides": { "@svgr/webpack": "^6.2.1" },

"To make this limitation easier to deal with, overrides may also be defined as a reference to a spec for a direct dependency by prefixing the name of the package you wish the version to match with a $"

https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides

FernandoPerezLara · 2022-06-08T11:19:45Z

Best solution:

"overrides": {
  "nth-check": "2.0.1"
},

orsharab-yy · 2022-06-14T11:15:34Z

Is there any ETA for this?

struginskij · 2022-07-05T08:20:00Z

Any update?

chandrajitsatapathy · 2022-07-07T14:08:33Z

And last, you must remove your node_modules folder and your package-lock.json, and execute npm install.

i was getting mad, thanks bro! it worked perfect.

if there's a newbie like me there, you can install the dependency with this line:

npm install @svgr/webpack --save-dev

npm install --save-dev webpack@ edit the version to the required one.

taimoorimran · 2022-07-16T02:55:38Z

Any update?

- per this issue facebook/create-react-app#12132

callain · 2022-07-26T13:38:43Z

If you move react-scripts in "devDependencies", npm audit --production do not display any vulnerabilities.

The best explanation of why everything is in "dependencies" is here.
https://stackoverflow.com/questions/44868453/create-react-app-install-devdepencies-in-dependencies-section/44872787#44872787

But in fact, it matters when running npm audit --production because devDependencies are ignored.

- should get a rid of a high severity security issue with a dev dependency. nth-check is vulnerable to Inefficient Regular Expression Complexity. - see facebook/create-react-app#12132 for more info

…reate-react-app#12132 (comment) but still seeing `warning Resolution field "$@svgr/webpack" has an invalid version entry and may be ignored` during `yarn install`

…cebook/create-react-app#12132 (comment) but still seeing `warning Resolution field "$@svgr/webpack" has an invalid version entry and may be ignored` during `yarn install`" This reverts commit 9ab4261.

gaearon · 2022-09-12T14:55:17Z

#11647 (comment)

im-deepakk added issue: bug report needs triage labels Mar 4, 2022

palminha mentioned this issue Mar 8, 2022

Dependency of vulnerable css-select is causing dependabot issues in other projects marionebl/svg-term-cli#85

Open

palminha mentioned this issue Mar 8, 2022

Bump svgr/webpack to 6.x #12146

Open

Julien-JME added a commit to Delmonicos/user-frontend that referenced this issue May 4, 2022

Update package.json

6cd501b

Move react-scripts into dev-dependencies. see facebook/create-react-app#12132.

thomazcapra mentioned this issue May 24, 2022

Help, npm audit says I have a vulnerability in react-scripts! #11174

Open

clukhei added a commit to GovTechSG/sgds-govtech-react that referenced this issue May 26, 2022

fix: vulnerable react-scripts by overriding its dep facebook/create-r…

f67259e

…eact-app#12132

urfolomeus added a commit to tablexi/a11y-testing-sandbox that referenced this issue Jun 2, 2022

Fix for security warning

0fee3ff

facebook/create-react-app#12132 (comment)

JoVictorNunes mentioned this issue Jun 8, 2022

chore: fix/update Learning A. Dashboard npm dependencies bigbluebutton/bigbluebutton#15145

Merged

2 tasks

tomerb mentioned this issue Jun 20, 2022

[BUG] npm audit fix --force alternates between downgrading and upgrading packages npm/cli#5046

Closed

2 tasks

johnclary mentioned this issue Jul 6, 2022

Dependabot update: nth-check cityofaustin/atd-data-tech#8294

Closed

Pochetes added a commit to Facebook-University-Projects/Swimster that referenced this issue Jul 19, 2022

solved react-scripts vulnerability

dc7ce04

- per this issue facebook/create-react-app#12132

kentwelcome mentioned this issue Jul 22, 2022

[Fix] sc-27574 Fix github report security alert InfuseAI/piperider#297

Merged

2 tasks

Pochetes added a commit to Facebook-University-Projects/Swimster that referenced this issue Jul 23, 2022

solved react-scripts vulnerability

d614cee

- per this issue facebook/create-react-app#12132

Lsnsh mentioned this issue Aug 22, 2022

Bumps @svgr/webpack dependency to version 6.2.1 #12172

Open

toikarin-vincit mentioned this issue Aug 30, 2022

various minor improvements + dependency updates City-of-Helsinki/hitas#51

Merged

ryancwalsh mentioned this issue Aug 31, 2022

trying this workaround using yarn resolutions according to https://gi… NEARFoundation/trulioo-app#47

Merged

isqua mentioned this issue Sep 12, 2022

nth-check vulnerability found in [email protected] #11647

Closed

gaearon closed this as completed Sep 12, 2022

facebook locked as resolved and limited conversation to collaborators Sep 12, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Vulnerability in react-scripts > @svgr/webpack > @svgr/plugin-svgo > svgo > css-select > nth-check & css-what #12132

Vulnerability in react-scripts > @svgr/webpack > @svgr/plugin-svgo > svgo > css-select > nth-check & css-what #12132

im-deepakk commented Mar 4, 2022

Vishal-Mayal commented Mar 6, 2022

PraveenkumarD2004 commented Mar 7, 2022

palminha commented Mar 8, 2022 •

edited

Loading

palminha commented Mar 8, 2022

palminha commented Mar 8, 2022

palminha commented Mar 8, 2022

slowWriting commented Mar 8, 2022

palminha commented Mar 8, 2022

PraveenkumarD2004 commented Mar 11, 2022

Stunext commented Mar 15, 2022

Githubbubber commented Mar 22, 2022

JY1148 commented Apr 1, 2022 •

edited

Loading

vishal-bypt commented Apr 27, 2022 •

edited

Loading

thomazcapra commented May 18, 2022 •

edited

Loading

irangar commented May 31, 2022

miotegui commented May 31, 2022 •

edited

Loading

GlennVialli commented Jun 5, 2022

thomazcapra commented Jun 5, 2022

FernandoPerezLara commented Jun 8, 2022 •

edited

Loading

orsharab-yy commented Jun 14, 2022

struginskij commented Jul 5, 2022

chandrajitsatapathy commented Jul 7, 2022

taimoorimran commented Jul 16, 2022

callain commented Jul 26, 2022

gaearon commented Sep 12, 2022

Vulnerability in react-scripts > @svgr/webpack > @svgr/plugin-svgo > svgo > css-select > nth-check & css-what #12132

Vulnerability in react-scripts > @svgr/webpack > @svgr/plugin-svgo > svgo > css-select > nth-check & css-what #12132

Comments

im-deepakk commented Mar 4, 2022

Describe the bug

Environment

Steps to reproduce

Expected behavior

Actual behavior

Vishal-Mayal commented Mar 6, 2022

PraveenkumarD2004 commented Mar 7, 2022

palminha commented Mar 8, 2022 • edited Loading

palminha commented Mar 8, 2022

palminha commented Mar 8, 2022

palminha commented Mar 8, 2022

slowWriting commented Mar 8, 2022

palminha commented Mar 8, 2022

PraveenkumarD2004 commented Mar 11, 2022

Stunext commented Mar 15, 2022

Githubbubber commented Mar 22, 2022

JY1148 commented Apr 1, 2022 • edited Loading

vishal-bypt commented Apr 27, 2022 • edited Loading

thomazcapra commented May 18, 2022 • edited Loading

irangar commented May 31, 2022

miotegui commented May 31, 2022 • edited Loading

GlennVialli commented Jun 5, 2022

thomazcapra commented Jun 5, 2022

FernandoPerezLara commented Jun 8, 2022 • edited Loading

orsharab-yy commented Jun 14, 2022

struginskij commented Jul 5, 2022

chandrajitsatapathy commented Jul 7, 2022

taimoorimran commented Jul 16, 2022

callain commented Jul 26, 2022

gaearon commented Sep 12, 2022

palminha commented Mar 8, 2022 •

edited

Loading

JY1148 commented Apr 1, 2022 •

edited

Loading

vishal-bypt commented Apr 27, 2022 •

edited

Loading

thomazcapra commented May 18, 2022 •

edited

Loading

miotegui commented May 31, 2022 •

edited

Loading

FernandoPerezLara commented Jun 8, 2022 •

edited

Loading