Missing Origin Validation in [email protected]

[tanx]

Any chance the security fix will get backported to [email protected]? We're still on [email protected] yet which relies on this version range. Here is the respective issue in webpack-dev-server. Thanks for your consideration.

=== npm audit security report ===                        
                                                                                
# Run  npm install [email protected]  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Missing Origin Validation                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ webpack-dev-server                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-scripts > webpack-dev-server                           │
├───────────────┼─���────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/725                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

[iansu]

It sounds like they are not going to backport the fix. I'm closing this as I don't think there's anything we can do about it.

[Timer]

"Steal a developer's source code" -- the source code is public anyways during deployment, this should really be a low/medium security report.

[ealexhaywood]

I am getting the same error using the latest version of CRA 2.1.2. My npm audit says the vulnerability is patched in [email protected] and react-scripts uses 3.1.9.

[armingjazi]

guys an update on this is appreciated! webpack-dev-server is not backporting the fix, one possible resolution is to update react to depend on newer version.