WS-2018-0215 (Medium) detected in cached-path-relative-1.0.1.tgz

[mend-bolt-for-github]

WS-2018-0215 - Medium Severity Vulnerability

Vulnerable Library - cached-path-relative-1.0.1.tgz

Memoize the results of the path.relative function

Library home page: https://registry.npmjs.org/cached-path-relative/-/cached-path-relative-1.0.1.tgz

Path to dependency file: angular/integration/cli-hello-world/yarn.lock

Path to vulnerable library: angular/integration/cli-hello-world/yarn.lock

Dependency Hierarchy:

• karma-2.0.0.tgz (Root Library)
  • browserify-14.5.0.tgz
    • module-deps-4.1.1.tgz
      • ❌ cached-path-relative-1.0.1.tgz (Vulnerable Library)

Found in HEAD commit: cf1f1c0344fa01406f61ff7437a72714be39b47e

Vulnerability Details

Version of cached-path-relative before 1.0.2 are vulnerable to prototype pollution.

Publish Date: 2018-11-07

URL: WS-2018-0215

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: ashaffer/cached-path-relative@a43cffe

Release Date: 2018-12-06

Fix Resolution: 1.0.2