Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

3.0.4 contains two vulnerabilities that cannot be fixed automatically #209

Open
enriquedelpino opened this issue Jan 15, 2025 · 0 comments

Comments

@enriquedelpino
Copy link

Library version [e.g. 1.1.2]
3.0.4

Node.js version [e.g. 8.16.0]
18.3.0

Describe the bug

I’ve noticed that the graphdb.js package has dependency vulnerabilities due to outdated versions of axios and ip. These issues were identified during an npm audit. Below are the details:

Axios Vulnerability

Issue: Cross-Site Request Forgery (CSRF).
Affected Versions: 0.8.1 - 0.27.2.
Reference: GHSA-wf5p-g6vw-rhxx.
Impact: Moderate.

Issue: Server-Side Request Forgery (SSRF) in isPublic.
Affected Versions: All.
Reference: GHSA-2p57-rm9w-gvfp.
Impact: High.

To Reproduce
Install the latest version of graphdb.js (3.0.4).
Run npm audit or npm install.
Observe the reported vulnerabilities related to axios and ip.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant