Skip to content

SECURITY - Cucumber affected by Marak/colors.js#285 #1885

@jan-molak

Description

@jan-molak

Describe the bug
Malicious code introduced in colors version 1.4.1 and 1.4.2 causes Cucumber.js to fall into an infinite loop, printing gibberish to the terminal.

CC: @davidjgoss @aslakhellesoy @jbpros

To Reproduce

Use any feature that prints to the terminal, for example:

npx @cucumber/cucumber --version

Screenshots
If applicable, add screenshots to help explain your problem.
Screenshot 2022-01-10 at 01 22 02

Desktop (please complete the following information):

  • OS: any
  • Browser any
  • Version all (Serenity/JS runs tests against Cucumber 1.x to 8.x, the issue is present in all version of Cucumber because of the dependency on cli-table3 and/or colors)

TO FIX

Short term:

Long term:

  • Consider replacing colors with chalk

Additional context
Add any other context about the problem here.

Marak/colors.js#285

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions