René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Security issues","articleBody":"## Issue\r\nHi :)\r\n\r\nI have the below added security issues with nativescript-dev-webpack.\r\n\r\n## Environment\r\n\r\n  \"dependencies\": {\r\n    \"nativescript-dev-webpack\": \"1.5.1\"\r\n }\r\n\r\n\r\n## npm audit security report\r\n\r\nRun  npm update terser-webpack-plugin --depth 3  to resolve 2 vulnerabilities\r\n\r\n  Moderate        Cross-Site Scripting                                          \r\n\r\n  Package         serialize-javascript                                          \r\n\r\n  Dependency of   nativescript-dev-webpack [dev]                                \r\n\r\n  Path            nativescript-dev-webpack \u003e webpack \u003e terser-webpack-plugin \u003e  \r\n                  serialize-javascript                                          \r\n*\r\n  More info       https://npmjs.com/advisories/1426                             \r\n\r\n\r\n  High            Remote Code Execution                                         \r\n\r\n  Package         serialize-javascript                                          \r\n\r\n  Dependency of   nativescript-dev-webpack [dev]                                \r\n\r\n  Path            nativescript-dev-webpack \u003e webpack \u003e terser-webpack-plugin \u003e  \r\n                  serialize-javascript                                          \r\n\r\n  More info       https://npmjs.com/advisories/1548                             \r\n\r\n\r\n                                 Manual Review                                  \r\n             Some vulnerabilities require your attention to resolve             \r\n                                                                                \r\n          Visit https://go.npm.me/audit-guide for additional guidance           \r\n\r\n\r\n  Moderate        Out-of-bounds Read                                            \r\n\r\n  Package         atob                                                          \r\n\r\n  Patched in      \u003e=2.1.0                                                       \r\n\r\n  Dependency of   nativescript-dev-webpack [dev]                                \r\n\r\n  Path            nativescript-dev-webpack \u003e css \u003e source-map-resolve \u003e atob    \r\n\r\n  More info       https://npmjs.com/advisories/646                              \r\n\r\n\r\n  Moderate        Cross-Site Scripting                                          \r\n\r\n  Package         serialize-javascript                                          \r\n\r\n  Patched in      \u003e=2.1.1                                                       \r\n\r\n  Dependency of   nativescript-dev-webpack [dev]                                \r\n\r\n  Path            nativescript-dev-webpack \u003e copy-webpack-plugin \u003e              \r\n                  serialize-javascript                                          \r\n\r\n  More info       https://npmjs.com/advisories/1426                             \r\n\r\n\r\n  Moderate        Cross-Site Scripting                                          \r\n\r\n  Package         serialize-javascript                                          \r\n\r\n  Patched in      \u003e=2.1.1                                                       \r\n\r\n  Dependency of   nativescript-dev-webpack [dev]                                \r\n\r\n  Path            nativescript-dev-webpack \u003e terser-webpack-plugin \u003e            \r\n                  serialize-javascript                                          \r\n\r\n  More info       https://npmjs.com/advisories/1426                             \r\n\r\n\r\n  High            Remote Code Execution                                         \r\n\r\n  Package         serialize-javascript                                          \r\n\r\n  Patched in      \u003e=3.1.0                                                       \r\n\r\n  Dependency of   nativescript-dev-webpack [dev]                                \r\n\r\n  Path            nativescript-dev-webpack \u003e copy-webpack-plugin \u003e              \r\n                  serialize-javascript                                          \r\n\r\n  More info       https://npmjs.com/advisories/1548                             \r\n\r\n\r\n  High            Remote Code Execution                                         \r\n\r\n  Package         serialize-javascript                                          \r\n\r\n  Patched in      \u003e=3.1.0                                                       \r\n\r\n  Dependency of   nativescript-dev-webpack [dev]                                \r\n\r\n  Path            nativescript-dev-webpack \u003e terser-webpack-plugin \u003e            \r\n                  serialize-javascript                                          \r\n\r\n  More info       https://npmjs.com/advisories/1548                             \r\n\r\n\r\n  Low             Prototype Pollution                                           \r\n\r\n  Package         yargs-parser                                                  \r\n\r\n  Patched in      \u003e=13.1.2 \u003c14.0.0 || \u003e=15.0.1 \u003c16.0.0 || \u003e=18.1.2              \r\n\r\n  Dependency of   nativescript-dev-webpack [dev]                                \r\n\r\n  Path            nativescript-dev-webpack \u003e webpack-cli \u003e yargs \u003e              \r\n                  yargs-parser                                                  \r\n\r\n  More info       https://npmjs.com/advisories/1500                             \r\n\r\n\r\n  High            Prototype Pollution                                           \r\n\r\n  Package         object-path                                                   \r\n\r\n  Patched in      \u003e=0.11.5                                                      \r\n\r\n  Dependency of   nativescript-dev-webpack [dev]                                \r\n\r\n  Path            nativescript-dev-webpack \u003e resolve-url-loader \u003e\r\n                  adjust-sourcemap-loader \u003e object-path\r\n\r\n  More info       https://npmjs.com/advisories/1573**\r\n","author":{"url":"https://github.com/senner007","@type":"Person","name":"senner007"},"datePublished":"2020-12-07T09:41:49.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/1150/nativescript-dev-webpack/issues/1150"}