Critical Vulnerability in webpack-dev-server

[Luketep]

Prerequisites

Please answer the following questions for yourself before submitting an issue.

• I am running the latest version
• I checked the documentation and found no answer
• I checked to make sure that this issue has not already been filed
• I'm reporting the issue to the correct repository (for multi-repository projects)

Expected Behavior

Do not have any critical vulnerabilities in public used repositories.

Current Behavior

After a fresh install, NPM detects a critical vulnerability in webpack-dev-server dependency of react-scripts version 2.0.4

Steps to Reproduce

1. Clone the repo in version 1.0.0
2. run npm install

Context

Please provide any relevant information about your setup. This is important in case the issue is not reproducible except for under certain conditions.

• Device: Asus Zenbook 3
• Operating System: Ubuntu 18.10
• Browser and Version: Chrome 72.0.3626.81 (Official Build) (64-bit)
• Node version 11.9.0
• NPM version 6.5.0

Failure Logs

# Run  npm install react-scripts@2.1.3  to resolve 1 vulnerability
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Missing Origin Validation                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ webpack-dev-server                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-scripts > webpack-dev-server                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/725                       │
└───────────────┴──────────────────────────────────────────────────────────────┘


found 1 high severity vulnerability in 33303 scanned packages

[Luketep]

I have a feature branch ready to push for the fix by using npm audit fix but I can't push my feature branch. If you add me to you contributor list I will upload it as soon as possible.