Skip to content

Update archiver to 7.0.0 to avoid CVE-772 in inflight @ 1.0.6 #2715

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
AlisherAmonulloev opened this issue Mar 1, 2024 · 6 comments
Open

Update archiver to 7.0.0 to avoid CVE-772 in inflight @ 1.0.6 #2715

AlisherAmonulloev opened this issue Mar 1, 2024 · 6 comments

Comments

@AlisherAmonulloev
Copy link

🚀 Feature Proposal

Current version of exceljs references archiver of v5.3.2. In the references, you can find the inflight package that is affected by CVE-772 ( https://security.snyk.io/vuln/SNYK-JS-INFLIGHT-6095116 )

exceljs @ 4.4.0 -> archiver @ 5.3.2 -> archiver-utils @ 2.1.0 -> glob @ 7.2.3 -> inflight @ 1.0.6

The archiver and archiver-utils packages were already updated and published on npm.

Please update the archiver package reference in exceljs to 7.0.0 to avoid the vulnerability

Note that this may result in a breaking change as support of Node 12 has been dropped: archiverjs/node-archiver#735
@LukasTy LukasTy mentioned this issue Apr 24, 2024
Closed
@jsyvino
Copy link

jsyvino commented May 16, 2024

I am also running into this issue, hopefully it gets fixed soon!

@markmssd
Copy link

Gentle bump 🙃

@khangahs
Copy link

khangahs commented Oct 2, 2024

Any fix?

@rbonestell
Copy link

The vulnerable references to inflight are not constrained to archiver, unfortunately:

  1. exceljs@4.4.0 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
  2. exceljs@4.4.0 › tmp@0.2.1 › rimraf@3.0.2 › glob@7.2.3 › inflight@1.0.6
  3. exceljs@4.4.0 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6
  4. exceljs@4.4.0 › unzipper@0.10.14 › fstream@1.0.12 › rimraf@2.7.1 › glob@7.2.3 › inflight@1.0.6

@henryfung3a27
Copy link

Try #2829 (comment)

@tiennguyen1293
Copy link

Following this topic 👀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@rbonestell @markmssd @henryfung3a27 @AlisherAmonulloev @tiennguyen1293 @jsyvino @khangahs