{"action":"created","issue":{"url":"https://api.github.com/repos/mixtur/webpack-spritesmith/issues/74","repository_url":"https://api.github.com/repos/mixtur/webpack-spritesmith","labels_url":"https://api.github.com/repos/mixtur/webpack-spritesmith/issues/74/labels{/name}","comments_url":"https://api.github.com/repos/mixtur/webpack-spritesmith/issues/74/comments","events_url":"https://api.github.com/repos/mixtur/webpack-spritesmith/issues/74/events","html_url":"https://github.com/mixtur/webpack-spritesmith/issues/74","id":371900786,"node_id":"MDU6SXNzdWUzNzE5MDA3ODY=","number":74,"title":"Moderate Vulnerability in used static-eval version","user":{"login":"ekelvin","id":6638327,"node_id":"MDQ6VXNlcjY2MzgzMjc=","avatar_url":"https://avatars1.githubusercontent.com/u/6638327?v=4","gravatar_id":"","url":"https://api.github.com/users/ekelvin","html_url":"https://github.com/ekelvin","followers_url":"https://api.github.com/users/ekelvin/followers","following_url":"https://api.github.com/users/ekelvin/following{/other_user}","gists_url":"https://api.github.com/users/ekelvin/gists{/gist_id}","starred_url":"https://api.github.com/users/ekelvin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekelvin/subscriptions","organizations_url":"https://api.github.com/users/ekelvin/orgs","repos_url":"https://api.github.com/users/ekelvin/repos","events_url":"https://api.github.com/users/ekelvin/events{/privacy}","received_events_url":"https://api.github.com/users/ekelvin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-10-19T10:33:59Z","updated_at":"2018-10-19T13:04:33Z","closed_at":null,"author_association":"NONE","body":"Can you please consider upgrading static-eval to version >= 2.0.0 where this vulnerability is patched ? \r\n\r\nModerate        Sandbox Breakout / Arbitrary Code Execution\r\n  Package         static-eval\r\n  Patched in      >=2.0.0\r\n  Dependency of   webpack-spritesmith [dev]\r\n  Path            webpack-spritesmith > spritesmith > pixelsmith >\r\n                  ndarray-fill > cwise > static-module > static-eval\r\n  More info       https://nodesecurity.io/advisories/548"},"comment":{"url":"https://api.github.com/repos/mixtur/webpack-spritesmith/issues/comments/431356140","html_url":"https://github.com/mixtur/webpack-spritesmith/issues/74#issuecomment-431356140","issue_url":"https://api.github.com/repos/mixtur/webpack-spritesmith/issues/74","id":431356140,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMTM1NjE0MA==","user":{"login":"mixtur","id":2968077,"node_id":"MDQ6VXNlcjI5NjgwNzc=","avatar_url":"https://avatars3.githubusercontent.com/u/2968077?v=4","gravatar_id":"","url":"https://api.github.com/users/mixtur","html_url":"https://github.com/mixtur","followers_url":"https://api.github.com/users/mixtur/followers","following_url":"https://api.github.com/users/mixtur/following{/other_user}","gists_url":"https://api.github.com/users/mixtur/gists{/gist_id}","starred_url":"https://api.github.com/users/mixtur/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mixtur/subscriptions","organizations_url":"https://api.github.com/users/mixtur/orgs","repos_url":"https://api.github.com/users/mixtur/repos","events_url":"https://api.github.com/users/mixtur/events{/privacy}","received_events_url":"https://api.github.com/users/mixtur/received_events","type":"User","site_admin":false},"created_at":"2018-10-19T13:04:33Z","updated_at":"2018-10-19T13:04:33Z","author_association":"OWNER","body":"I have no control over static-eval version.\r\nIt is burried in transitive dependencies. All I can do is update spritesmith, but it is already at most recent version.\r\nAction must be first taken there https://github.com/scijs/cwise and then in every package before in that dependency chain up until webpack-spritesmith.\r\n\r\nYet I am not sure how that is a vulnerability. Code in this repository will not likely be executed in environment that can compromise something serious... I hope so. I am not a security specialist though."}}
{"actor":{"display_login":"mixtur"}}