Create-react-app: 12969 High Vulnerabilities

[Hyjaz]

Describe the bug

Running npx create-react-app dummyapp --typescript generates 12969 high severity vulnerabilities.

Have you done all these steps and still see the issue?
yes

Npm version

6.4.1

Environment

npx create-react-app --info

npx: installed 91 in 13.567s                               

Environment Info:                                          

  System:                                                  
    OS: Windows 10                                         
    CPU: (8) x64 Intel(R) Xeon(R) CPU E5-1620 v4 @ 3.50GHz 
  Binaries:                                                
    Node: 10.15.0 - C:\Program Files\nodejs\node.EXE       
    Yarn: Not Found                                        
    npm: 6.4.1 - C:\Program Files\nodejs\npm.CMD           
  Browsers:                                                
    Edge: 41.16299.1004.0                                  
    Internet Explorer: 11.0.16299.371                      
  npmPackages:                                             
    react: ^16.8.6 => 16.8.6                               
    react-dom: ^16.8.6 => 16.8.6                           
    react-scripts: 3.0.1 => 3.0.1                          
  npmGlobalPackages:                                       
    create-react-app: Not Found                            

Steps to reproduce

1. npx create-react-app dummyapp --typescript

Expected behavior

no vulnerabilities

Actual behavior

Installing packages. This might take a couple of minutes.
Installing react, react-dom, and react-scripts...


> [email protected] postinstall C:\Users\hloudin\source\tests\dummyappv2\node_modules\babel-runtime\node_modules\core-js
> node scripts/postinstall || echo "ignore"


> [email protected] postinstall C:\Users\hloudin\source\tests\dummyappv2\node_modules\core-js-pure
> node scripts/postinstall || echo "ignore"

+ @types/[email protected]
+ @types/[email protected]
+ [email protected]
+ @types/[email protected]
+ [email protected]
+ [email protected]
+ @types/[email protected]
+ [email protected]
added 1418 packages from 765 contributors and audited 902148 packages in 101.201s
found 12969 high severity vulnerabilities
  run `npm audit fix` to fix them, or `npm audit` for details
We detected TypeScript in your project (src\App.test.tsx) and created a tsconfig.json file for you.

Your tsconfig.json has been populated with default values.


Initialized a git repository.

Success! Created dummyappv2 at C:\Users\hloudin\source\tests\dummyappv2
Inside that directory, you can run several commands:

  npm start
    Starts the development server.

  npm run build
    Bundles the app into static files for production.

  npm test
    Starts the test runner.

  npm run eject
    Removes this tool and copies build dependencies, configuration files
    and scripts into the app directory. If you do this, you can’t go back!

We suggest that you begin by typing:

  cd dummyappv2
  npm start

Happy hacking!

Reproducible demo

[heyimalex]

There's a "vulnerability" in set-value, and it's apparently used everywhere. Hopefully https://github.com/jonschlinkert/set-value/issues/16 gets attention and we don't need to worry about this. Maybe there are other things but I'm not sure.

[rudpot]

I have the same issue. Apparently the vulnerability in set-value is fixed in 3.0.1 but everything is pulling in 2.0.1.

[chaosZeroFive]

Same...

[chaosZeroFive]

I saw it when I installed lodash

[gaearon]

This is not a real “vulnerability” in the context of Create React App because it produces static bundles. So it can’t possibly affect you in any way.

The false positive warnings are unfortunate.

[rxgx]

Are these all related to the Prototype Pollution in lodash? https://www.npmjs.com/advisories/1012

[heyimalex]

I just got an email back from npm security for advisory 1012, they added 2.0.1 to remediated. I think we're still dealing with 1013/mixin-deep, but I'll check shortly.

Edit: Actually looks like we're all clear!

[chaosZeroFive]

I just ran audit and got 0 vulnerabilities...

[carpben]

I'm using react-scripts 2.1.5.
I Just ran "npm audit", which shows 285 high vulnerabilities. It seems they all come from "mixin deep" and "set value".

[heyimalex]

@carpben It's nothing to worry about, but if you recover your dependencies it should go away. You could try npm --depth 999 update set-value && npm --depth 999 update mixin-deep, or just rm -rf node_modules && rm -f yarn.lock && rm -f package-json.lock && npm install.

[carpben]

Thanks @heyimalex .
I deleted node modules and package-lock.json , and ran "npm i". It's much better now, but there are still 5 high vulnerabilities all from "tar" package.