javascript - Github高危js应用安全漏洞: GHSA-7fhm-mqm4-2wp7 with a Node.

Question

将 nodemon 添加到我的 node.js 应用程序上的 devDependencies 后，我在 GitHub 上收到安全警报:

moderate severity Vulnerable versions: < 1.2.2 Patched version: 1.2.2 There are high severity security vulnerabilities in two of ESLints dependencies: - acorn - minimist

The releases 1.8.3 and lower of svjsl (JSLib-npm) are vulnerable, but only if installed in a developer environment. A patch has been released (v1.8.4) which fixes these vulnerabilities.

Identifiers:

CVE-2020-7598 SNYK-JS-ACORN-559469 (doesn't have a CVE identifier)

我的package.json:

{
      "name": "web-server",
      "version": "1.0.0",
      "description": "",
      "main": "app.js",
      "scripts": {
        "start": "node src/app.js",
        "dev": "nodemon src/app.js -e js,hbs"
      },
      "keywords": [],
      "author": "",
      "license": "ISC",
      "dependencies": {
        "express": "^4.17.1",
        "hbs": "^4.1.0"
      },
      "devDependencies": {
        "nodemon": "^2.0.2"
      }
    }

我不知道我到底应该做什么，或者我应该提供有关我的应用程序的更多信息/代码。

Github 仓库:https://github.com/badrddinb/simple-weather-website

Answer 1

package-lock.json 中的

"minimist": {"version": "0.0.10",} 导致了 ^^ 问题。 https://nvd.nist.gov/vuln/detail/CVE-2020-7598

补救措施将 minimist 升级到 1.2.2 或更高版本。例如:

“依赖项”:{“极简主义”:">=1.2.2"}

或者...

“devDependency”:{“minimist”:">=1.2.2"}