npm audit detects Cross-Site Scripting vulnerability

[lukaszmn]

Bug: yes
Version: 5.3.1

I installed the NPM package. npm audit detects a vulnerability in this package:

                                 Manual Review                                  
             Some vulnerabilities require your attention to resolve             
                                                                                
          Visit https://go.npm.me/audit-guide for additional guidance           
                                                                                
                                                                                
  Moderate        Cross-Site Scripting                                          
                                                                                
  Package         bootbox                                                       
                                                                                
  Patched in      No patch available                                            
                                                                                
  Dependency of   bootbox                                                       
                                                                                
  Path            bootbox                                                       
                                                                                
  More info       https://npmjs.com/advisories/882                              

Are you aware of it? Can anything done to fix it or mark as safe?

[tarlepp]

There is discussion about this on #661 - personally I always sanitize all user inputs on front- and backend sides so for me this isn't really issue.

And sure we could make some improvements to this (see that issue), but still we cannot ensure how your backend is using that input data.

If you have some time we're always open for PRs to improve this library.

[lukaszmn]

I'm sorry, I didn't search in the closed issues. I see not much can be done about this problem. I guess I'll just close the issue unresolved.