High severity vulnerability reported due to dependency on decompress

[jimmyandrade]

It's a security vulnerability problem.

- What is the current behavior?
Given you installed netlify-cli as a dependency
When you run npm audit
Then you find the following:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Arbitrary File Write                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ decompress                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ netlify-cli                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ netlify-cli > gh-release-fetch > download > decompress       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1217                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

- What is the expected behavior?
No severity vulnerabilities should be found.

- If the current behavior is a bug, please provide the steps to reproduce.

1. Create a directory and run npm init;
2. Install netlify-cli with npm install --save-dev netlify-cli;
3. Run npm audit.

- Local Environment Information

netlify-cli/2.11.23 darwin-x64 node-v12.16.0

PS.: I checked if there were not have any duplicates already open.

[erquhart]

@jimmyandrade can you update to the latest cli and check again? Latest release is 2.36.0.

_{Sent with GitHawk}

[RaeesBhatti]

I can confirm this issue with the latest version. The root issue is being discussed here: kevva/decompress#71
Maybe we can make some changes in gh-release-fetch in the meantime.

[erezrokah]

Verified with v2.59.1 and this is no longer an issue.
Please comment if you find it otherwise.

[jimmyandrade]

@erquhart and @erezrokah thank you all 😄