Vulnerable version of tough-cookie in use (2.5.0) CVE-2023-26136

[ffengGP]

Summary

The version of tough-cookie package in use is 2.5.0, which is old version and is vulnerable to CVE-2023-26136

This should be updated to 4.1.3 (or higher). The main cypress release should then also be updated to include this new release of request.

https://www.cve.org/CVERecord?id=CVE-2023-26136

Package:
https://github.com/cypress-io/request/blob/master/package.json

Simplest Example to Reproduce

https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873

Possible Solution

https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873

[alfaproject]

Just got our pipelines stalled by this as well ):

[MikeMcC399]

Apparently issues here do not get triaged.

• The same issue has been reported in Vulnerability Issue reported for tough-cookie, latest version of @cypress/request is dependent of [email protected] cypress#27261 which is assigned to @cacieprins

[dstapleton92]

This is holding up our pipelines as well. Just a heads up that the module in question is tough-cookie, not touch-cookie.

[jeffsays]

bump - any chance this gets fixed soon @tgriesser?

[cypress-app-bot]

🎉 This issue has been resolved in version 2.88.12 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀