You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
mend-for-github-combot
changed the title
CVE-2023-45311 (Critical) detected in fsevents-1.2.4.tgz
CVE-2023-45311 (Critical) detected in fsevents-1.2.4.tgz - autoclosed
May 4, 2024
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
mend-for-github-combot
changed the title
CVE-2023-45311 (Critical) detected in fsevents-1.2.4.tgz - autoclosed
CVE-2023-45311 (Critical) detected in fsevents-1.2.4.tgz
May 4, 2024
ℹ️ This issue was automatically closed by Mend because it is a duplicate of an existing issue: #464
mend-for-github-combot
changed the title
CVE-2023-45311 (Critical) detected in fsevents-1.2.4.tgz
CVE-2023-45311 (Critical) detected in fsevents-1.2.4.tgz - autoclosed
May 19, 2024
CVE-2023-45311 - Critical Severity Vulnerability
Vulnerable Library - fsevents-1.2.4.tgz
Native Access to Mac OS-X FSEvents
Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.2.4.tgz
Path to dependency file: /templates/react-website-template/app/package.json
Path to vulnerable library: /templates/react-website-template/app/package.json
Dependency Hierarchy:
Found in HEAD commit: 712665b267203375ee4b15e1f8d1ebe08abc1547
Found in base branch: develop
Vulnerability Details
fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.
Publish Date: 2023-10-06
URL: CVE-2023-45311
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-45311
Release Date: 2023-10-06
Fix Resolution (fsevents): 1.2.11
Direct dependency fix Resolution (react-scripts): 3.0.0
⛑️ Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: