Repository navigation
Missing Origin Validation in react-scripts@1.x.x #5777
Description
Any chance the security fix will get backported to webpack-dev-server@2.x.x? We're still on react-scripts@1.x.x yet which relies on this version range. Here is the respective issue in webpack-dev-server. Thanks for your consideration.
=== npm audit security report ===
# Run npm install react-scripts@2.1.1 to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Missing Origin Validation │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ webpack-dev-server │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ react-scripts > webpack-dev-server │
├───────────────┼─���────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/725 │
└───────────────┴──────────────────────────────────────────────────────────────┘
Activity
iansu commentedon Nov 14, 2018
It sounds like they are not going to backport the fix. I'm closing this as I don't think there's anything we can do about it.
Timer commentedon Nov 15, 2018
"Steal a developer's source code" -- the source code is public anyways during deployment, this should really be a low/medium security report.
ealexhaywood commentedon Dec 31, 2018
I am getting the same error using the latest version of CRA
2.1.2. My npm audit says the vulnerability is patched inwebpack-dev-server@3.1.11andreact-scriptsuses3.1.9.armingjazi commentedon Jan 1, 2019
guys an update on this is appreciated! webpack-dev-server is not backporting the fix, one possible resolution is to update react to depend on newer version.