{"action":"closed","issue":{"url":"https://api.github.com/repos/bigmlcom/bigml-node/issues/133","repository_url":"https://api.github.com/repos/bigmlcom/bigml-node","labels_url":"https://api.github.com/repos/bigmlcom/bigml-node/issues/133/labels{/name}","comments_url":"https://api.github.com/repos/bigmlcom/bigml-node/issues/133/comments","events_url":"https://api.github.com/repos/bigmlcom/bigml-node/issues/133/events","html_url":"https://github.com/bigmlcom/bigml-node/issues/133","id":370110546,"node_id":"MDU6SXNzdWUzNzAxMTA1NDY=","number":133,"title":"Security warnings about `static-eval`","user":{"login":"emk","id":36963,"node_id":"MDQ6VXNlcjM2OTYz","avatar_url":"https://avatars2.githubusercontent.com/u/36963?v=4","gravatar_id":"","url":"https://api.github.com/users/emk","html_url":"https://github.com/emk","followers_url":"https://api.github.com/users/emk/followers","following_url":"https://api.github.com/users/emk/following{/other_user}","gists_url":"https://api.github.com/users/emk/gists{/gist_id}","starred_url":"https://api.github.com/users/emk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/emk/subscriptions","organizations_url":"https://api.github.com/users/emk/orgs","repos_url":"https://api.github.com/users/emk/repos","events_url":"https://api.github.com/users/emk/events{/privacy}","received_events_url":"https://api.github.com/users/emk/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-10-15T11:03:58Z","updated_at":"2018-11-27T20:04:37Z","closed_at":"2018-11-27T20:04:37Z","author_association":"NONE","body":"Both GitHub and NPM are reporting a security problem with the `bigml` package for Node.JS:\r\n\r\n```\r\n┌───────────────┬──────────────────────────────────────────────────────────────┐\r\n│ Moderate      │ Sandbox Breakout / Arbitrary Code Execution                  │\r\n├───────────────┼──────────────────────────────────────────────────────────────┤\r\n│ Package       │ static-eval                                                  │\r\n├───────────────┼──────────────────────────────────────────────────────────────┤\r\n│ Patched in    │ >=2.0.0                                                      │\r\n├───────────────┼──────────────────────────────────────────────────────────────┤\r\n│ Dependency of │ bigml                                                        │\r\n├───────────────┼──────────────────────────────────────────────────────────────┤\r\n│ Path          │ bigml > numjs > cwise > static-module > static-eval          │\r\n├───────────────┼──────────────────────────────────────────────────────────────┤\r\n│ More info     │ https://nodesecurity.io/advisories/548                       │\r\n└───────────────┴──────────────────────────────────────────────────────────────┘\r\n┌───────────────┬──────────────────────────────────────────────────────────────┐\r\n│ Moderate      │ Sandbox Breakout / Arbitrary Code Execution                  │\r\n├───────────────┼──────────────────────────────────────────────────────────────┤\r\n│ Package       │ static-eval                                                  │\r\n├───────────────┼──────────────────────────────────────────────────────────────┤\r\n│ Patched in    │ >=2.0.0                                                      │\r\n├───────────────┼──────────────────────────────────────────────────────────────┤\r\n│ Dependency of │ bigml                                                        │\r\n├───────────────┼──────────────────────────────────────────────────────────────┤\r\n│ Path          │ bigml > numjs > ndarray-fft > cwise > static-module >        │\r\n│               │ static-eval                                                  │\r\n├───────────────┼──────────────────────────────────────────────────────────────┤\r\n│ More info     │ https://nodesecurity.io/advisories/548                       │\r\n└───────────────┴──────────────────────────────────────────────────────────────┘\r\n```\r\nI have no reason to believe that this is exploitable, but I haven't looked at it in detail. In any case, it would be nice to fix this so that GitHub and NPM stop publishing security warnings about code using `bigml`.\r\n\r\nYou _might_ be able to fix this by upgrading to `numjs` 0.16.0. Thank you for looking into this!"}}
{"actor":{"display_login":"mmerce"}}