Laravel-mix: Vulnerability found in Laravel Mix 2.0

[rap2hpoutre]

• Laravel Mix Version: 2.0.0 (npm list --depth=0)
• Node Version (node -v): v8.1.2
• NPM Version (npm -v): 5.6.0
• OS: MacOS

Description:

Running nsp check gives this result:

(+) 1 vulnerability found
┌────────────┬────────────────────────────────────────────────────────────────────┐
│            │ Prototype pollution attack                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Name       │ hoek                                                               │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ CVSS       │ 4 (Medium)                                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Installed  │ 2.16.3                                                             │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Vulnerable │ <= 4.2.0 || >= 5.0.0 < 5.0.3                                       │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Patched    │ > 4.2.0 < 5.0.0 || >= 5.0.3                                        │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Path       │ xxxxxx@undefined > [email protected] > [email protected] >        │
│            │ [email protected] > [email protected] > [email protected] > [email protected]    │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ More Info  │ https://nodesecurity.io/advisories/566                             │
└────────────┴────────────────────────────────────────────────────────────────────┘

I just ran this because Github said:

We found potential security vulnerabilities in your dependencies.

Steps To Reproduce:

Install https://nodesecurity.io/opensource then run nsp check

[tpraxl]

Do I interpret this right? [email protected] is vulnerable? So it's essentially [email protected], then [email protected], then [email protected] (which won't be installed on linux systems), then [email protected] that is vulnerable and this is why mix is vulnerable?

Thanks for announcing this. Seriously. But shouldn't we report this to any of the involved libraries in the dependency chain in the first place?

[rap2hpoutre]

@tpraxl I think it's related to Mix because Mix requires chokidar to version 1.7.0 (see: https://github.com/JeffreyWay/laravel-mix/blob/master/package.json#L39) and chokidar is now in version 2.0.

So I think we could update to version 2.0 to fix the problem, but I don't know if there are breaking changes. I asked here: https://github.com/paulmillr/chokidar/issues/683 and if there is no breaking change I will submit a PR.

In other words, Mix is not vulnerable itself but it seems it relies on a vulnerable version of _something_.

_Still, I'm not sure about anything, I am sometimes lost in dependency hell._

[tpraxl]

@rap2hpoutre Thanks for the info and your engagement!