Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

项目引用了glob-parent等238个开源组件,存在7个漏洞,建议升级 #27

Open
ghost opened this issue Mar 4, 2022 · 1 comment

Comments

@ghost
Copy link

ghost commented Mar 4, 2022

大佬,你好,我是@abbykimi,我IDE运行您这个项目的时候,提示有几个漏洞,项目调用了glob-parent等238个开源组件,存在7个安全漏洞,建议你升级下。

漏洞标题:nodejs 资源管理错误漏洞
漏洞编号:CVE-2020-28469
漏洞描述:
nodejs是是一个基于ChromeV8引擎的JavaScript运行环境通过对Chromev8引擎进行了封装以及使用事件驱动和非阻塞IO的应用让Javascript开发高性能的后台应用成为了可能。
nodejs-glob-parent 存在安全漏洞,该漏洞源于正则表达式拒绝服务。
影响范围:(∞, 5.1.2)
最小修复版本:5.1.2
引入路径:
[email protected]>template@git+ssh://[email protected]/zbryikt/template.git#7681a62f45ffa1530e744aceb407bd39d71bf07b->[email protected]>[email protected]

另外6个漏洞,如需查看详细报告、复测或持续监测您的项目,戳这里https://www.mfsec.cn/jr?p=mb5052

如果你对这个issues有任何疑问可以回复我哈( @abbykimi ),我会及时回复你的。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants
and others