Aspnetcore: React SPA template security issue - update serialize-javascript package

[yahorsi]

Current React SPA template has security issue.
In order to keep things secured by default serialize-javascript needs to be updated.

See https://github.com/advisories/GHSA-h9rv-jmmf-4pgx

[javiercn]

@yahorsi thanks for contacting us.

We'll look into this. We believe that this is part of the current template, so it is very likely you can do npm audit fix to fix it.

[yahorsi]

The idea of that issue is that IMHO template must be as secure as possible and so if there is security issue it is good idea to update the template and fix it

[blowdart]

The vulnerability here doesn't affect how we use the package as we're not using untrusted input, but rather to compile up known entities, but we will update it as a matter of course.

Please note for future security issues a github issue is not the best place to report them. Please consider using our coordinated disclosure route, as highlighted when you created issues. Security issues reported through [email protected] are eligible for our bug bounty program. Github issues are not eligible.

[yahorsi]

Sorry and thank you for pointing out the right way )

[blowdart]

Not a problem at all, I just enjoy paying out bounty money and it's a shame when I can't!

[yahorsi]

Damn, now I feel even worse :)

[mkArtakMSFT]

@javiercn is already working on updating the packages, so this will be covered too

[mkArtakMSFT]

@javiercn I believe this has been resolved already. Can you please confirm?