Browser-sync: Security issue in xmlhttprequest-ssl via a transitive dependency on engine.io-client

[obalunenko]

Issue details

High vulnerability with xmlhttprequest-ssl via a transitive dependency on engine.io-client
https://github.com/advisories/GHSA-h4j5-c7cj-74xg

Steps to reproduce/test case

https://github.com/advisories/GHSA-h4j5-c7cj-74xg
Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.

Please specify which version of Browsersync, node and npm you're running

• Browsersync [ ]
• Node [ ]
• Npm [ ]

Affected platforms

• [ x] linux
• [ x] windows
• [ x] OS X
• [ x] freebsd
• [ x] solaris
• [ ] other _(please specify which)_

Browsersync use-case

• [ ] API
• [ ] Gulp
• [ ] Grunt
• [ ] CLI

If CLI, please paste the entire command below

{cli command here}

for all other use-cases, (gulp, grunt etc), please show us exactly how you're using Browsersync

{Browsersync init code here}

[obalunenko]

@shakyShane Could you please fix this issue?

[ffflorian]

The dependency in question is socket.io. Latest version is 4.0.1 while browser-sync uses 2.4.0.

[hiphopappotamus]

running npm update engine.io-client --depth 4 from the command line resolved my issue with this

[Leif-W]

running npm update engine.io-client --depth 4 from the command line resolved my issue with this

This yielded a warning for me:

npm WARN update The --depth option no longer has any effect. See RFC0019.
npm WARN update https://github.com/npm/rfcs/blob/latest/implemented/0019-remove-update-depth-option.md