-
-
Notifications
You must be signed in to change notification settings - Fork 27.1k
Closed
Description
Describe the bug
The react-dev-utils
package uses a vulnerable version (v8.0.4
) of Immer.
The fix, commit fa671e5, is part of the v9.0.6
release.
The react-dev-utils
package should use this specific version of Immer.
GitHub CVE
- Prototype Pollution in immer (critical severity): CVE-2021-3757.
- Prototype Pollution in immer (high severity): CVE-2021-23436.
bpod, GintV, jessieweiyi, PatrickShaw, sverdlovka and 21 morebpod, jessieweiyi, oneumyvakin, RappC and ConnorDY