Code injection security vulnerability at js-yaml

[em0ney]

Hi there,

Thanks for making cosmiconfig!

You have a dependency on js-yaml@3.13.0. Please see this report of a High severity vulnerability in this module.

https://www.npmjs.com/advisories/813

[olsonpm]

thanks for the report. I'll have time to take a look this weekend.

It's the second security issue we've had with that library within a short time frame though, I'll probably check out alternative libraries while I'm at it.

[em0ney]

I might open up a PR for this one if there is a chance you can get it merged this week

[olsonpm]

if your issue is time sensitive then you should fork the repo and depend on that in the meantime. I assume this issue will be addressed within the next couple weeks, but we can't promise anything.

[sudo-suhas]

Removing the lock file and a clean install would pull in the latest version of js-yaml. So for anybody who wishes to fix this issue immediately, there is no need to wait for a fix from this library(we'll do it though).

[olsonpm]

Alright, here's what I found.

js-yaml has three advisories raised on npm

• https://www.npmjs.com/advisories/16: published Jun 23rd, 2013
• https://www.npmjs.com/advisories/788: published Mar 21st, 2019
• https://www.npmjs.com/advisories/813: published Apr 15th, 2019

Two of them are irrelevant to cosmiconfig because the risk was
associated with load. Cosmiconfig uses safeLoad

However because of the existence of load vs safeLoad, and js-yaml providing the
functionality to parse js functions and regexes in load, I think it's safe to assume more
advisories will be raised which are irrelevant to Cosmiconfig.

I found two other yaml parsing libraries that seem reliable but neither support node v4

yaml requires v6+ (seems more actively maintained than yaml-js)
yaml-js requires v8+

Both libraries

• have no security advisories raised
• don't parse js functions or regexes and thus don't have a load vs safeLoad concept

Unfortunately I think we're stuck bumping js-yaml versions every time an advisory is raised for the
duration of cosmiconfig v5 which will always support node v4. We should probably switch to
yaml when we bump node versions.