Critical Security Vulnerabilities while npm Audit

[priti-vyawahare]

When I npm audit using npm audit --audit-level=critical --registry=https://registry.npmjs.org

I get below critical vulnerabilities. I am not sure How I can get rid of it. I have an Angular mono repo.
Angular version 11
npm version 6.14.6
node: 12.18.3
Storybook versions
"@storybook/angular": "^6.4.0-beta.25",
"@storybook/addon-essentials": "^6.4.0-beta.25",
"@storybook/addon-links": "^6.4.0-beta.25",
"@storybook/addon-storysource": "^6.4.0-beta.25",
"@storybook/addons": "^6.4.0-beta.25",
"@storybook/builder-webpack5": "^6.4.0-beta.25",
"@storybook/manager-webpack5": "^6.4.0-beta.25",

A clear and concise description of what the bug is.

To Reproduce
npm audit --audit-level=critical --registry=https://registry.npmjs.org

│ More info │ GHSA-33f9-j839-rf8h │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical │ Prototype Pollution in immer │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ immer │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=9.0.6 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/angular [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @storybook/angular > @storybook/core > │
│ │ @storybook/core-server > @storybook/builder-webpack4 > │
│ │ react-dev-utils > immer │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ GHSA-33f9-j839-rf8h │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical │ Prototype Pollution in immer │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ immer │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=9.0.6 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-essentials [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @storybook/addon-essentials > @storybook/addon-docs > │
│ │ @storybook/core > @storybook/core-server > │
│ │ @storybook/builder-webpack4 > react-dev-utils > immer │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ GHSA-33f9-j839-rf8h │

System
Please paste the results of npx sb@next info here.

Environment Info:

System:
OS: Windows 10 10.0.18363
CPU: (8) x64 Intel(R) Core(TM) i7-6820HQ CPU @ 2.70GHz
Binaries:
Node: 12.18.3 - C:\Program Files\nodejs\node.EXE
npm: 6.14.6 - C:\Program Files\nodejs\npm.CMD
Browsers:
Edge: Spartan (44.18362.1593.0)
npmPackages:
@storybook/addon-essentials: ^6.4.0-beta.25 => 6.4.0-beta.25
@storybook/addon-links: ^6.4.0-beta.25 => 6.4.0-beta.25
@storybook/addon-storysource: ^6.4.0-beta.25 => 6.4.0-beta.25
@storybook/addons: ^6.4.0-beta.25 => 6.4.0-beta.25
@storybook/angular: ^6.4.0-beta.25 => 6.4.0-beta.25
@storybook/builder-webpack5: ^6.4.0-beta.25 => 6.4.0-beta.25
@storybook/manager-webpack5: ^6.4.0-beta.25 => 6.4.0-beta.25

C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\rimraf.js:321
throw er
^

Error: ENOTEMPTY: directory not empty, rmdir 'C:\Users\vv002e\AppData\Roaming\npm-cache_npx\8448\node_modules\sb\node_modules\shelljs'
at Object.rmdirSync (fs.js:850:3)
at rmkidsSync (C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\rimraf.js:364:25)
at rmdirSync (C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\rimraf.js:342:7)
at rimrafSync (C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\rimraf.js:312:9)
at C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\rimraf.js:350:5
at Array.forEach ()
at rmkidsSync (C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\rimraf.js:349:26)
at rmdirSync (C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\rimraf.js:342:7)
at rimrafSync (C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\rimraf.js:312:9)
at C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\rimraf.js:350:5
at Array.forEach ()
at rmkidsSync (C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\rimraf.js:349:26)
at rmdirSync (C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\rimraf.js:342:7)
at rimrafSync (C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\rimraf.js:312:9)
at C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\rimraf.js:350:5
at Array.forEach () {
errno: -4051,
syscall: 'rmdir',
code: 'ENOTEMPTY',
path: 'C:\Users\vv002e\AppData\Roaming\npm-cache\_npx\8448\node_modules\sb\node_modules\shelljs'

Additional context
Add any other context about the problem here.

[mittyesque]

The 2 effected packages are

1. builder-webpack4
2. core-common

[mittyesque]

https://github.com/feedmypixel/backstage/commit/8d1461cee3e36351bfc57afa742cadf231abd10b

[sarahannnicholson]

@mittyesque is that a fix? Could you make a PR?

+@shilman

[shilman]

@sarahannnicholson storybook 6.4 is on the latest stable version of react-dev-utils

npx sb upgrade

[sarahannnicholson]

I guess this issue should really be raised with react-dev-utils

> npm list immer

[my project dir]
└─┬ @storybook/[email protected]
  └─┬ [email protected]
    └── [email protected]

facebook/create-react-app#11641