Create-react-app: yargs-parser are vulnerable to prototype pollution in version 3.4.1

[vikramdadwal]

Describe the bug

yargs-parser are vulnerable to prototype pollution in version 3.4.1

Expected behavior

should fix the security issue.

Actual behavior

yargs-parser are vulnerable to prototype pollution in version 3.4.1.

[ianschmitz]

[email protected] doesn't exist.

[navidjh]

@ianschmitz I believe this issue is referring to react-scripts version 3.4.1 not yargs-parser.

-- [email protected]
+-- [email protected]
| -- [email protected]
| -- -- [email protected]
| -- -- -- [email protected]
-- [email protected]
-- -- [email protected]
-- -- -- [email protected]

[pzelnip]

Why was this issue closed if the issue has not been fixed? react-scripts 3.4.1 is still vulnerable and will cause an npm audit to return non-zero:

Low Prototype Pollution 

Package yargs-parser 

Patched in >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2 

Dependency of react-scripts [dev] 

Path react-scripts > webpack-dev-server > yargs > yargs-parser 

More info https://npmjs.com/advisories/1500 

[mhassan1]

this has been resolved on master but not yet released: https://github.com/facebook/create-react-app/pull/8975

[pzelnip]

Any sense of when that release will be?