Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Issue with Minimatch (Update Minimatch) #83

Open
mfish911 opened this issue Mar 11, 2022 · 4 comments
Open

Security Issue with Minimatch (Update Minimatch) #83

mfish911 opened this issue Mar 11, 2022 · 4 comments

Comments

@mfish911
Copy link

Description
recursive-readdir depends on minimatch which includes a security vulnerability described here

Steps to Reproduce
N/A

Expected behavior:
Passes security scans (Prisma Cloud)

Actual behavior:
Fails security scans

Reproduces how often: [What percentage of the time does it reproduce?]
100%

Versions
All

Additional Information
https://huntr.dev/bounties/e4e1393c-d590-4492-9f43-8be3f3321629/
isaacs/minimatch#146

@mfish911 mfish911 reopened this Mar 11, 2022
@dyihoon90
Copy link

would be great if the team can help to apply this patch. Our team tested with minimatch 3.0.5 and it works with recursive-readdir.

@bhaginath-tvpt
Copy link

In our react project, react-dev-utils has a transitive dependency on recursive-readdir which uses minimatch 3.0.4 vulnerable version. Maintainer, could you please upgrade minimatch to the latest version?
It's a critical vulnerability in our application.
image

@jspraul
Copy link

jspraul commented Oct 20, 2022

See #85 (comment) re: npm overrides example workaround

@imki123
Copy link

imki123 commented Oct 26, 2022

Resolved #85

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants