Conversation
| "node": ">=6.9.0" | ||
| } | ||
| }, | ||
| "node_modules/@babel/core/node_modules/@babel/traverse": { |
There was a problem hiding this comment.
Risk: Affected versions of @babel/traverse are vulnerable to Incomplete List Of Disallowed Inputs. An attacker can exploit a vulnerability in the internal Babel methods path.evaluate() or path.evaluateTruthy() by compiling specially crafted code, potentially resulting in arbitrary code execution during compilation.
Manual Review Advice: A vulnerability from this advisory is reachable if you use a 3rd party plugin that relies on the path.evaluate()or path.evaluateTruthy() internal Babel methods, or one of the known affected plugins (@babel/plugin-transform-runtime, Any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider, or @babel/preset-env when using its useBuiltIns option)
Fix: Upgrade this library to at least version 7.23.2 at snipsync/package-lock.json:127.
Reference(s): GHSA-67hx-6x53-jw92, CVE-2023-45133
Ignore this finding from ssc-aff5e8de-c638-4356-8a93-120597e35ce9.
npm install yauzl@latest