Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gethue uses babel/traverse version with critical security vulnerability #4000

Open
1 task done
HiggsWRX opened this issue Feb 13, 2025 · 1 comment
Open
1 task done
Labels
BUG Issue type for reporting failure due to bug in functionality

Comments

@HiggsWRX
Copy link

Is there an existing issue for this?

  • I have searched the existing issues

Description

gethue package uses babel/traverse dependency that has critical security issue. Please update your babel/traverse dependency to a version that has at least the fixed critical vulnerability

Steps To Reproduce

  1. install gethue npm package
  2. run npm/pnpm/yarn audit
  3. You will see gethue at the top of critical vulnerabilities due to babel/traverse

Logs

Paths
│ . > [email protected] > [email protected] > │
│ │ [email protected] > │
│ │ [email protected] > [email protected]
│ │ │
│ │ . > [email protected] > [email protected] > │
│ │ [email protected] > │
│ │ [email protected] > │
│ │ [email protected] > [email protected]
│ │ │
│ │ . > [email protected] > [email protected] > │
│ │ [email protected] > │
│ │ [email protected] > │
│ │ [email protected]

there's 34 more paths that use babel/traverse in gethue but you get the idea

Hue version

6.0.1

@HiggsWRX HiggsWRX added the BUG Issue type for reporting failure due to bug in functionality label Feb 13, 2025
@HiggsWRX
Copy link
Author

I forgot to add the link for the critical severity report: GHSA-67hx-6x53-jw92

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
BUG Issue type for reporting failure due to bug in functionality
Projects
None yet
Development

No branches or pull requests

1 participant