[GHSA-5xrq-8626-4rwp] When Vitest UI server is listening, arbitrary file can be read and executed#7883
Conversation
|
Hi there @hi-ogawa! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates a GitHub-reviewed security advisory by extending the affected version ranges for the vitest npm package.
Changes:
- Bumped the advisory
modifiedtimestamp. - Added two new
affectedentries fornpm:vitestwith differentfixedversions.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| }, | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "vitest" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" | ||
| }, | ||
| { | ||
| "fixed": "4.1.0" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "vitest" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" | ||
| }, | ||
| { | ||
| "fixed": "3.2.5" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| } |
There was a problem hiding this comment.
Yes, we should have this:
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "vitest"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.5"
}
]
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "vitest"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.0"
}
]
}
]
}
],
github-actions
Bot
changed the base branch from
main
to
joevin-slq-docto/advisory-improvement-7883
| "introduced": "0" | ||
| }, | ||
| { | ||
| "fixed": "4.1.0" |
There was a problem hiding this comment.
| "fixed": "3.2.5" |
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "vitest" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" | ||
| }, | ||
| { | ||
| "fixed": "4.1.0" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| }, |
There was a problem hiding this comment.
| { | |
| "package": { | |
| "ecosystem": "npm", | |
| "name": "vitest" | |
| }, | |
| "ranges": [ | |
| { | |
| "type": "ECOSYSTEM", | |
| "events": [ | |
| { | |
| "introduced": "0" | |
| }, | |
| { | |
| "fixed": "4.1.0" | |
| } | |
| ] | |
| } | |
| ] | |
| }, |
| "introduced": "0" | ||
| }, | ||
| { | ||
| "fixed": "3.2.5" |
There was a problem hiding this comment.
| "introduced": "0" | |
| }, | |
| { | |
| "fixed": "3.2.5" | |
| "introduced": "4.0.0" | |
| }, | |
| { | |
| "fixed": "4.1.0" |
There was a problem hiding this comment.
Is 4.1.0 accurate? Other tools report 4.1.6 for the fixed version: https://security.snyk.io/package/npm/vitest/versions?page=1
|
It's very similar with #7881 |
Updates
Comments
GHSA-5xrq-8626-4rwp should be updated with GHSA-5xrq-8626-4rwp data. The fix has also been backported to 3.2.5.