Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix XSS vulnerability by bumping prismjs version #461

Closed
iamludal opened this issue Feb 26, 2022 · 8 comments
Closed

Fix XSS vulnerability by bumping prismjs version #461

iamludal opened this issue Feb 26, 2022 · 8 comments

Comments

@iamludal
Copy link

Describe the bug
Dependabot alerted today that the prismjs library (version >= 1.14.0, < 1.27.0) has an XSS vulnerability. React Syntax Highlighter uses prismjs 1.25.0, that could be upgraded to 1.27.0 in order to fix this vulnerability. See screenshot below.

Expected behavior
The prismjs version should be upgraded to 1.27.0.

Screenshots
image

Desktop (please complete the following information):
N/A

Smartphone (please complete the following information):
N/A

@icyJoseph
Copy link

Last release was on 2020, I wonder if there's any chance this we'll be released?

@homotechsual
Copy link

homotechsual commented Feb 28, 2022

@conorhastings is this maintained / active still?

@icyJoseph
Copy link

Just to be clear, at least for my part, I can try to help with maintenance of the package, but ultimately, it is up to the owners to release any update.

@iamludal
Copy link
Author

iamludal commented Mar 2, 2022

@icyJoseph Actually the last release was on November 2021 (it does not appear in the release section, but in the tags page), so it seams like the project is still maintained.

https://github.com/react-syntax-highlighter/react-syntax-highlighter/tags

@stof
Copy link

stof commented Mar 2, 2022

refractor has backported the prismjs update to their 3.x branch, so you can run yarn upgrade and get a patched between thanks to the caret requirement in react-syntax-highlighter.

@bennycode
Copy link

@conorhastings, @simmerer & @marcodejongh can you please upgrade the "prismjs" dependency? See #459

@simmerer
Copy link
Collaborator

Hey folks, sorry for being away from this for so long. I'll work on getting another release out this weekend.

@simmerer
Copy link
Collaborator

15.5.0 is out: https://github.com/react-syntax-highlighter/react-syntax-highlighter/releases/tag/15.5.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

6 participants