Dependency: grapesjs =0.21.13 Depends on vulnerable versions of underscore

Question

GrapesJS version [x] I confirm to use the latest version of GrapesJS What browser are you using? Edge, mozilla Reproducible demo link NA Describe the bug underscore <=1.13.7 Severity: high underscore <=1.13.7 Severity: high Underscore has unlimited recursion in .flatten and .isEqual, potential for DoS attack - https://github.com/advisories/GHSA-qpx9-hpmf-5gmw fix available via npm audit fix --force Will install grapesjs@0.21.12, which is a breaking change nodemodules/underscore grapesjs >=0.21....

artf · Accepted Answer

Thanks for the report @tiburciomzt The bump was merged and will soon be released.

GJS Helper · Answer

The issue you've reported regarding the underscore vulnerability (GHSA-qpx9-hpmf-5gmw) in grapesjs is valid and concerns a high-severity DoS vulnerability in underscore versions prior to 1.13.8. This vulnerability affects .flatten and .isEqual functions due to unlimited recursion. Root Cause GrapesJS itself does not directly depend on underscore for its core functionality in a way that would typically expose this specific vulnerability. However, underscore is a transitive dependency of GrapesJS...

Dependency: grapesjs >=0.21.13 Depends on vulnerable versions of underscore

Question

Answers (2)

Related Questions and Answers

backbone-undo/underscore security advisory

Too much recursion

XSS vulnerability in iframe attribute src

TS2416: Property '_up' in type 'PropertyStack' is not assignable to the same property in base type 'PropertyComposite<PropertyStackProps>'

Paid Plugins That Match This Issue

Related tutorials

Find the Right GrapesJS Plugin in Seconds: Smarter Discovery Is Live

AutographJS - Signature Solution for Modern Web Editors

ScribeJS: Lightweight Inline Rich Text Editor

Browse Plugin Categories