fmhc/datatrain-webapp

Dashboard for on-train data visualization in 3D - working PoC for Deutsche Bahn Hackathon 2017

datatrain-webapp's Issues

Security Issue [email protected] requires [email protected] // must be trim >= 0.0.3 to fix.

Dependabot cannot update trim to a non-vulnerable version
The latest possible version that can be installed is 0.0.1 because of the following conflicting dependency:

[email protected] requires [email protected] via [email protected]
The earliest fixed version is 0.0.3.

View logs or learn more about troubleshooting Dependabot errors.

1 trim vulnerability found in package-lock.json on 10 May
Remediation
Upgrade trim to version 0.0.3 or later. For example:

"dependencies": {
"trim": ">=0.0.3"
}
or…
"devDependencies": {
"trim": ">=0.0.3"
}
Always verify the validity and compatibility of suggestions with your codebase.

Details
CVE-2020-7753
high severity
Vulnerable versions: < 0.0.3
Patched version: 0.0.3
All versions of package trim lower than 0.0.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

proposed solution: copy xhr to local and upgrade trim, or fix xhr package