Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrectly closed Issue #192 - Prototype Pollution in mout #241

Open
Dezzymei opened this issue Dec 19, 2022 · 1 comment
Open

Incorrectly closed Issue #192 - Prototype Pollution in mout #241

Dezzymei opened this issue Dec 19, 2022 · 1 comment

Comments

@Dezzymei
Copy link

Dezzymei commented Dec 19, 2022

It appears that issue #192 was incorrectly closed as there is still currently an issue with said dependency.

Please can this be resolved to remove this vulnerability?

Which SDK version are you using?

15.0.0

What's the issue?

npm audit shows a security vulnerability

Steps/Sample code to reproduce the issue

npm install facebook-nodejs-business-sdk
npm audit

Observed Results:

# npm audit report

mout  <=1.2.3
Severity: high
Prototype Pollution in mout - https://github.com/advisories/GHSA-pc58-wgmc-hfjr
Prototype Pollution in mout - https://github.com/advisories/GHSA-vvv8-xw5f-3f88
fix available via `npm audit fix --force`
Will install facebook-nodejs-business-sdk@6.0.0, which is a breaking change
node_modules/mout
  iso-3166-1-alpha-2  *
  Depends on vulnerable versions of mout
  node_modules/iso-3166-1-alpha-2
    facebook-nodejs-business-sdk  >=6.0.1
    Depends on vulnerable versions of iso-3166-1-alpha-2
    node_modules/facebook-nodejs-business-sdk

3 high severity vulnerabilities

Expected Results:

No Prototype Pollution in mout

@Dezzymei
Copy link
Author

Or perhaps a new version needs to be released as this reference to alpha should no longer exist in the code so perhaps it has not been released!?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant