Create-react-app: Missing Origin Validation in [email protected]

[tanx]

Any chance the security fix will get backported to [email protected]? We're still on [email protected] yet which relies on this version range. Here is the respective issue in webpack-dev-server. Thanks for your consideration.

````
=== npm audit security report ===

Run npm install [email protected] to resolve 1 vulnerability

SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Missing Origin Validation │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ webpack-dev-server │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ react-scripts > webpack-dev-server │
├───────────────┼─���────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/725 │
└───────────────┴──────────────────────────────────────────────────────────────┘
````

[iansu]

It sounds like they are not going to backport the fix. I'm closing this as I don't think there's anything we can do about it.

[Timer]

"Steal a developer's source code" -- the source code is public anyways during deployment, this should really be a low/medium security report.

[ealexhaywood]

I am getting the same error using the latest version of CRA 2.1.2. My npm audit says the vulnerability is patched in [email protected] and react-scripts uses 3.1.9.

[tetrohed]

guys an update on this is appreciated! webpack-dev-server is not backporting the fix, one possible resolution is to update react to depend on newer version.