Skip to content

[Security] Vulnerabilities In Dependency: fast-xml-parser - Requires Upgrade #523

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
RTurek opened this issue Jul 18, 2023 · 3 comments
Closed

Comments

@RTurek
Copy link

RTurek commented Jul 18, 2023

filestack-js (and thus filestack-react and any other libs that depend on filestack-js) has a security vulnerability due to a javascript dependency. The fast-xml-parser library needs to be upgraded.

Expected Behavior

No security alerts on GitHub or other vulnerability scanners should be triggered by filestack-js and filestack-react's dependency on fast-xml-parser

Current Behavior

Security alert shows up because of the vulnerability in the older version of fast-xml-parser

Possible Solution

Upgrade
"fast-xml-parser": "^3.16.0"
to
"fast-xml-parser": "^4.2.4"

Additional Screenshots & Documentation

Regex Issue
GHSA-6w63-h3fj-q4vw
https://security.snyk.io/vuln/SNYK-JS-FASTXMLPARSER-5668858
https://vulners.com/github/GHSA-6W63-H3FJ-Q4VW

Screenshot 2023-07-18 at 12 39 00 PM

Prototype Pollution issue
GHSA-x3cc-x39p-42qx

Screenshot 2023-07-18 at 12 42 14 PM

Context

All users of this library will be impacted by this.

Your Environment

All environments are impacted by this.

@RTurek RTurek changed the title [Security] Vulnerability In Dependency: fast-xml-parser - Requires Upgrade [Security] Vulnerabilities In Dependency: fast-xml-parser - Requires Upgrade Jul 18, 2023
@bsaphier
Copy link

Need this fixed asap. Can't use this package in production environments that need to pass security reviews (like for getting an application approved for google integration)

@NUO97
Copy link

NUO97 commented Jul 31, 2023

The issue has been around for over a month, plz prioritize this

@RTurek
Copy link
Author

RTurek commented Aug 15, 2023

@RTurek RTurek closed this as completed Aug 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants