WS-2015-0024 (High) detected in uglify-js-1.2.6.tgz

[mend-for-github-com]

WS-2015-0024 - High Severity Vulnerability

Vulnerable Library - uglify-js-1.2.6.tgz

JavaScript parser and compressor/beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-1.2.6.tgz

Path to dependency file: /tmp/ws-scm/ksa/ksa-web-root/ksa-web/src/main/webapp/rs/bootstrap/package.json

Path to vulnerable library: /ksa/ksa-web-root/ksa-web/src/main/webapp/rs/bootstrap/node_modules/uglify-js/package.json

Dependency Hierarchy:

• ❌ uglify-js-1.2.6.tgz (Vulnerable Library)

Found in HEAD commit: 5a3799544bbdfbed38c2c8191a9866ba18bc9768

Vulnerability Details

UglifyJS versions 2.4.23 and earlier are affected by a vulnerability which allows a specially crafted Javascript file to have altered functionality after minification.

Publish Date: 2015-08-24

URL: WS-2015-0024

CVSS 2 Score Details (8.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: mishoo/UglifyJS@905b601

Release Date: 2017-01-31

Fix Resolution: v2.4.24

---

• Check this box to open an automated fix PR