Command injection vulnerability in that package's deps. Is it possible to fork ant-design and remove the CSS that loads the fonts from the PRC CDN ?

root@baae98a82d3e:/antd-init# npm install
npm WARN deprecated jade@0.26.3: Jade has been renamed to pug, please install the latest version of pug instead of jade
npm WARN deprecated to-iso-string@0.0.2: to-iso-string has been deprecated, use @segment/to-iso-string instead.
npm WARN deprecated minimatch@0.3.0: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue

> spawn-sync@1.0.15 postinstall /antd-init/node_modules/spawn-sync
> node postinstall

npm notice created a lockfile as package-lock.json. You should commit this file.
added 165 packages from 381 contributors and audited 319 packages in 7.314s
found 4 vulnerabilities (2 low, 1 high, 1 critical)
  run `npm audit fix` to fix them, or `npm audit` for details
root@baae98a82d3e:/antd-init# npm audit  
                                                                                
                       === npm audit security report ===                        
                                                                                
# Run  npm install --save-dev mocha@6.1.4  to resolve 3 vulnerabilities
SEMVER WARNING: Recommended action is a potentially breaking change
                                                                                
  High            Regular Expression Denial of Service                          
                                                                                
  Package         minimatch                                                     
                                                                                
  Dependency of   mocha [dev]                                                   
                                                                                
  Path            mocha > glob > minimatch                                      
                                                                                
  More info       https://npmjs.com/advisories/118                              
                                                                                


                                                                                
  Low             Regular Expression Denial of Service                          
                                                                                
  Package         debug                                                         
                                                                                
  Dependency of   mocha [dev]                                                   
                                                                                
  Path            mocha > debug                                                 
                                                                                
  More info       https://npmjs.com/advisories/534                              
                                                                                


                                                                                
  Critical        Command Injection                                             
                                                                                
  Package         growl                                                         
                                                                                
  Dependency of   mocha [dev]                                                   
                                                                                
  Path            mocha > growl                                                 
                                                                                
  More info       https://npmjs.com/advisories/146                              
                                                                                


# Run  npm install vinyl-fs@3.0.3  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
                                                                                
  Low             Regular Expression Denial of Service                          
                                                                                
  Package         braces                                                        
                                                                                
  Dependency of   vinyl-fs                                                      
                                                                                
  Path            vinyl-fs > glob-stream > micromatch > braces                  
                                                                                
  More info       https://npmjs.com/advisories/786                              
                                                                                


found 4 vulnerabilities (2 low, 1 high, 1 critical) in 319 scanned packages
  4 vulnerabilities require semver-major dependency updates.

https://www.npmjs.com/advisories/146

Overview

Affected versions of growl do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution.
Remediation

Update to version 1.10.2 or later.
Resources

tj/node-growl#60
tj/node-growl#61

Remove the dependency on alicdn.com #187

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Remove the dependency on `alicdn.com` #187