Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add daily trial #373

Draft
wants to merge 20 commits into
base: master
Choose a base branch
from
Draft

Add daily trial #373

wants to merge 20 commits into from

Conversation

jordibosch20
Copy link

PR to update dependencies to use node18 runtime

Copy link

semgrep-app bot commented Feb 7, 2024

Semgrep found 1 ssc-45c7ee79-f517-41e2-b61a-45743d9df9c6 finding:

Risk: Affected version of handlebars is vulnerable to Improper Neutralization Of Special Elements In Output Used By A Downstream Component ('Injection') / Improperly Controlled Modification Of Object Prototype Attributes ('Prototype Pollution'). The vulnerability allows for Prototype Pollution, potentially leading to Remote Code Execution, as templates can modify an object's __proto__ and __defineGetter__ properties, enabling attackers to execute arbitrary code using specially crafted payloads.

Fix: Upgrade this library to at least version 4.3.0 at auth0-authorization-extension/package-lock.json:17973.

Reference(s): GHSA-w457-6q6x-cgp9, CVE-2019-19919

Ignore this finding from ssc-45c7ee79-f517-41e2-b61a-45743d9df9c6.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant