Prototype Pollution #781

[nullivex]

│ Moderate      │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ node.extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=1.1.7 <2.0.0 || >= 2.0.1                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ rmdir-promise                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ rmdir-promise > rmdir > node.flow > node.extend              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/781   

[nullivex]

My mistake, this is part of the node.flow package using an outdated node.extend. I submitted a PR against that.

[ljharb]

Note the "patched in"? This is already fixed in both the v1 and v2 lines.

[ljharb]

This also means that as long as any dependent is using semver, they'll get the fix automatically with no change needed.

[nullivex]

@ljharb I understand, the problem is that node.flow explicitly calls an old version of node.extend where the issue is present.

This is the real source of the current complaint: dreamerslab/node.flow#4