npm audit fix fails with severity high because of dependency markdown-to-jsx

[wschaef]

Describe the bug
Result of npm audit

  High            Cross-Site Scripting                                          

  Package         markdown-to-jsx                                               

  Patched in      No patch available                                            

  Dependency of   @storybook/html [dev]                                         

  Path            @storybook/html > @storybook/core > @storybook/ui >           
                  markdown-to-jsx                                               

  More info       https://npmjs.com/advisories/1219      

To Reproduce
Steps to reproduce the behavior:

1. npm install @storybook/html --save-dev
2. npm audit fix
3. See error

Additional context
Even if it is a static content deployment at the end, it is still relevant if any other systems are available by the same domain.
Currently this issue is a show stopper for all public facing installations

[shilman]

Yowza!! I just released https://github.com/storybookjs/storybook/releases/tag/v6.0.0-beta.13 containing PR #10873 that references this issue. Upgrade today to try it out!

You can find this prerelease on the @next NPM tag.

Closing this issue. Please re-open if you think there's still more to do.

[shilman]

Yippee!! I just released https://github.com/storybookjs/storybook/releases/tag/v5.3.19 containing PR #10873 that references this issue. Upgrade today to try it out!

[merlinstardust]

I'm still seeing this as an issue in 5.3.19 even after uninstalling and reinstalling @storybook/react. Both @storybook/ui and @storybook/components depends on this and it's still causing a vulnerability.

And looking at the link provided by npm audit, it says there is no fix available and that this still affects 6.11.4. It seems that the only way to fix it would be to downgrade the version of markdown-to-jsx

[shilman]

Looks like markdown-to-jsx is on it: quantizor/markdown-to-jsx#306

Will upgrade when ready

[msvivianso]

Looks like the fix in v6.11.4 from markdown-to-jx has been whitelisted from the vulnerability advisory.

[shilman]

@msvivianso thanks so much for letting me know. 🙏 closing!