Security Vulnerability: Prototype polution

[peppertech]

Are there any chances of getting a security fix that addresses this recently filed issue? https://security.snyk.io/vuln/SNYK-JS-REQUIREJS-5416713

There isn't a CVE posted for this yet, as it was just published last week. It is already showing up on multiple security scans however.

[jrburke]

No plans to address that report, this project is not under active development.

[d-haber]

There is now a high severity CVE posted:
https://nvd.nist.gov/vuln/detail/CVE-2024-38999
There is also now a high severity vulnerability published by github:
GHSA-x3m3-4wpv-5vgc

Please consider fixing this.
Thank you.

[jrburke]

@d-haber, @peppertech, anyone else: if #1856 looks like a fix, then I can spin out a 2.3.7 version hopefully before next Monday.

[peppertech]

Thank you very much @jrburke really appreciate this update.

[jrburke]

I updated npm and the web site with 2.3.7.

[d-haber]

Thank you @jrburke!

[AbhishekGarg]

Hello,
There was another high severity CVE posted on the same day:
https://nvd.nist.gov/vuln/detail/CVE-2024-38998

@jrburke Can this please be considered for fixing as well?
Thank you.

[jrburke]

That one sounds like rephrasing of the same issue that was fixed in 2.3.7. If not, it would be good to have more specifics on how 2.3.7 has the problem.

[AbhishekGarg]

Thanks for taking a look.
I am not sure why it was reported as a separate vulnerability, but it does get fixed with the same version (2.3.7), at least in the mend (whitesource) scan.