Vulnerable NPM Dependencies

Type: Weakness

Status: fixed

Reporting Date: 2023.04.04

Due to outdated packages in the frontend, the application is at risk of vulnerabilities in these dependencies.

Description

Compilation of the project shows outdated packages.

The output of npm audit shows:

# npm audit report

glob-parent  <5.1.2
Severity: high
glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex - https://github.com/advisories/GHSA-ww39-953v-wcq6
fix available via `npm audit fix --force`
Will install @storybook/react@7.0.2, which is a breaking change
node_modules/cpy/node_modules/glob-parent
node_modules/watchpack-chokidar2/node_modules/glob-parent
  chokidar  1.0.0-rc1 - 2.1.8
  Depends on vulnerable versions of glob-parent
  node_modules/watchpack-chokidar2/node_modules/chokidar
    watchpack-chokidar2  *
    Depends on vulnerable versions of chokidar
    node_modules/watchpack-chokidar2
      watchpack  1.7.2 - 1.7.5
      Depends on vulnerable versions of watchpack-chokidar2
      node_modules/@storybook/builder-webpack4/node_modules/watchpack
      node_modules/@storybook/core-common/node_modules/watchpack
      node_modules/@storybook/core-server/node_modules/webpack/node_modules/watchpack
      node_modules/@storybook/manager-webpack4/node_modules/watchpack
        webpack  4.44.0 - 4.46.0
        Depends on vulnerable versions of watchpack
        node_modules/@storybook/builder-webpack4/node_modules/webpack
        node_modules/@storybook/core-common/node_modules/webpack
        node_modules/@storybook/core-server/node_modules/webpack
        node_modules/@storybook/manager-webpack4/node_modules/webpack
  fast-glob  <=2.2.7
  Depends on vulnerable versions of glob-parent
  node_modules/cpy/node_modules/fast-glob
    globby  8.0.0 - 9.2.0
    Depends on vulnerable versions of fast-glob
    node_modules/cpy/node_modules/globby
      cpy  7.0.0 - 8.1.2
      Depends on vulnerable versions of globby
      node_modules/cpy
        @storybook/core-server  <=7.0.0-rc.11
        Depends on vulnerable versions of @storybook/csf-tools
        Depends on vulnerable versions of cpy
        node_modules/@storybook/core-server
          @storybook/core  >=6.2.0-alpha.0
          Depends on vulnerable versions of @storybook/core-server
          node_modules/@storybook/core
            @storybook/react  6.2.0-alpha.0 - 6.5.17-alpha.0
            Depends on vulnerable versions of @storybook/core
            node_modules/@storybook/react

highlight.js  9.0.0 - 10.4.0
Severity: moderate
ReDOS vulnerabities: multiple grammars - https://github.com/advisories/GHSA-7wwv-vh3v-89cq
fix available via `npm audit fix --force`
Will install @types/remarkable@1.7.5, which is a breaking change
node_modules/@types/remarkable/node_modules/highlight.js
  @types/remarkable  >=1.7.6
  Depends on vulnerable versions of highlight.js
  node_modules/@types/remarkable

trim  <0.0.3
Severity: high
Regular Expression Denial of Service in trim - https://github.com/advisories/GHSA-w5p7-h5w8-2hfq
fix available via `npm audit fix --force`
Will install @storybook/builder-vite@0.1.37, which is a breaking change
node_modules/trim
  remark-parse  <=8.0.3
  Depends on vulnerable versions of trim
  node_modules/remark-parse
    @mdx-js/mdx  <=1.6.22
    Depends on vulnerable versions of remark-mdx
    Depends on vulnerable versions of remark-parse
    node_modules/@mdx-js/mdx
      @storybook/mdx1-csf  *
      Depends on vulnerable versions of @mdx-js/mdx
      node_modules/@storybook/builder-vite/node_modules/@storybook/mdx1-csf
      node_modules/@storybook/mdx1-csf
        @storybook/addon-docs  >=6.5.0-alpha.1
        Depends on vulnerable versions of @storybook/mdx1-csf
        node_modules/@storybook/addon-docs
          @storybook/addon-essentials  >=6.5.0-alpha.1
          Depends on vulnerable versions of @storybook/addon-docs
          node_modules/@storybook/addon-essentials
        @storybook/builder-vite  >=0.1.38
        Depends on vulnerable versions of @storybook/mdx1-csf
        node_modules/@storybook/builder-vite
        @storybook/csf-tools  6.5.0-alpha.1 - 6.5.17-alpha.0
        Depends on vulnerable versions of @storybook/mdx1-csf
        node_modules/@storybook/csf-tools
    remark-mdx  <=1.6.22
    Depends on vulnerable versions of remark-parse
    node_modules/remark-mdx

trim-newlines  <3.0.1
Severity: high
Uncontrolled Resource Consumption in trim-newlines - https://github.com/advisories/GHSA-7p7h-4mm5-852v
fix available via `npm audit fix`
node_modules/trim-newlines
  meow  3.4.0 - 5.0.0
  Depends on vulnerable versions of trim-newlines
  node_modules/meow

24 vulnerabilities (2 moderate, 22 high)

Impact

24 vulnerabilities (2 moderate, 22 high) were found.

These issues are all related to Denial of Service vulnerabilities and the project does not seem to be directly impacted. The most impactful issue could theoretically lead to a non-responsive application when a malicous repository is opened. General impact is therefore low.

Recommendation

• Ensure updated packages
• Fix outdated vulnerable packages manually or with npm audit --fix