vue-renderer

[webdawe]

Version

v2.10.2

Reproduction link

https://nodesecurity.io/advisories/1426

Steps to reproduce

npm audit

What is expected ?

0 vulnerability

What is actually happening?

found 1 moderate severity vulnerability in 13460 scanned packages
1 vulnerability requires manual review. See the full report for details.
Moderate Cross-Site Scripting

Package serialize-javascript

Patched in >=2.1.1

Dependency of nuxt

Path nuxt > @nuxt/core > @nuxt/vue-renderer > vue-server-renderer
> serialize-javascript

More info https://nodesecurity.io/advisories/1426

Additional comments?

please advise how we can fix it

[FreekVR]

+1, looks like a version bump in the yarn.lock would be in order as there is an updated version of the package available to mitigate the issue (2.1.1). Doesn't look like there are any breaking changes in the update.

Also, it looks like this would only affect users who install nuxt using yarn at the moment, as there is no package-lock.json for npm users, so for NPM consumers npm update should suffice to mitigate the issue.

Yarn users can work around the issue for now using a custom module resolution in your package.json:
https://yarnpkg.com/lang/en/docs/selective-version-resolutions/

[webdawe]

Hey Mate,
NPM got package-lock.json, and this vulnerability inside the package-lock.json
@nuxt/core > @nuxt/vue-renderer > vue-server-renderer> serialize-javascript
So how can we update just serialize-javascript.
Thanks
Anil

[FreekVR]

Hey @webdawe ,

If simply running npm update doesn't work due to a locked dependency in the tree somewhere, as a workaround, you could look into npm-shrinkwrap. Though I have no personal experience with it, as we've been working with yarn for a while now:

https://nodejs.org/en/blog/npm/managing-node-js-dependencies-with-shrinkwrap/

[webdawe]

Thanks @FreekVR .

[ThomasR]

Issue will be fixed in Vue with vuejs/vue#10904 or vuejs/vue#10914

[posva]

This has been released as a patch for Vue.

[aldarund]

nuxt 2.11 require vue 2.6.11 so this is fixed