Skip to content

[Security] Vulnerabilities In Dependency: fast-xml-parser - Requires Upgrade #523

@RTurek

Description

@RTurek

filestack-js (and thus filestack-react and any other libs that depend on filestack-js) has a security vulnerability due to a javascript dependency. The fast-xml-parser library needs to be upgraded.

Expected Behavior

No security alerts on GitHub or other vulnerability scanners should be triggered by filestack-js and filestack-react's dependency on fast-xml-parser

Current Behavior

Security alert shows up because of the vulnerability in the older version of fast-xml-parser

Possible Solution

Upgrade
"fast-xml-parser": "^3.16.0"
to
"fast-xml-parser": "^4.2.4"

Additional Screenshots & Documentation

Regex Issue
GHSA-6w63-h3fj-q4vw
https://security.snyk.io/vuln/SNYK-JS-FASTXMLPARSER-5668858
https://vulners.com/github/GHSA-6W63-H3FJ-Q4VW

Screenshot 2023-07-18 at 12 39 00 PM

Prototype Pollution issue
GHSA-x3cc-x39p-42qx

Screenshot 2023-07-18 at 12 42 14 PM

Context

All users of this library will be impacted by this.

Your Environment

All environments are impacted by this.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions