Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Should upgrade the meow to latest version to fix the security issue CVE-2022-25883? #84

Open
leslieli opened this issue Jul 25, 2023 · 0 comments · Fixed by #86
Open

Should upgrade the meow to latest version to fix the security issue CVE-2022-25883? #84

leslieli opened this issue Jul 25, 2023 · 0 comments · Fixed by #86

Comments

@leslieli
Copy link

Looks MapBox polyline depends on meow which has dependency on normalize-package-data and semver.

But the latest MapBox polyline is referencing the semver@5.7.2 which has CVE-2022-25883 security issue.

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Could you please help to upgrade the meow to latest? Thanks.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Update meow to v9 and devDependencies mapbox/polyline
2 participants
@leslieli @dpdiliberto