Exposure of Sensitive Information in eventsource

[KieraDOG]

Exposure of Sensitive Information in eventsource

The latest possible version of eventsource that can be installed is 1.1.1. The earliest fixed version is 2.0.2.

  "optionalDependencies": {
    "eventsource": "^1.0.7"
  },

GHSA-6h5x-7c5m-7cr7

[DaleGardner]

This needs #678 to resolve

[chillaq]

Thanks @KieraDOG , checking with the team.

[EmilianoSanchez]

Hi @KieraDOG. We are releasing the fix next week

[NicoZelaya]

Hi @KieraDOG !

Would you mind trying with installing the latest version of the SDK and re-validating if the vulnerability keeps appearing?
This problem is also fixed in eventsource version 1.1.1, already used by the SDK, as you can see in this link from the advisory on Github: GHSA-6h5x-7c5m-7cr7

If you still get it reported would you mind sharing more with us? We'll release this breaking change eventually, but since it has no value for this fix, it might not be worth waiting for it.

Apologies for the inconveniences,
Nicolas Zelaya.

[KieraDOG]

Hi @NicoZelaya eventsource@1.1.1 fixed the problem

[NicoZelaya]

@KieraDOG thank you for confirming!

I'll close the issue then, since that is the version you'll get with the latest version of the SDK. Feel free to reopen otherwise.

Best regards,
Nico.