react-dev-utils uses a vulnerable version of immer as a dependency #10411

wclem4 · 2021-01-20T23:03:13Z

Describe the bug

react-dev-utils package uses a vulnerable version (7.0.9) of immer as a dependency.

Here is the GitHub CVE (High Severity) notification for the vulnerability, and here is the commit that has fixed it in the Immer 8.0.1 release earlier today.

react-dev-utils should be updated to use version 8.0.1 of Immer.

The text was updated successfully, but these errors were encountered:

Resolves facebook#10411 Bumps immer version to 8.0.1 to address the prototype pollution vulnerability with the current 7.0.9 version.

RDIL · 2021-01-21T02:42:38Z

Note: this will NOT make anybody's apps vulnerable.

~~This is a development-time only dependency.~~

Edit as of 2/3/2021 to clarify things for everyone: This is only used during the build phase of your app. It is not in the webpack bundle. Assuming your app doesn't directly use immer, e.g. you have manually put it in your dependencies, you are fine.

jhockett · 2021-01-23T20:00:30Z

Note: this will NOT make anybody's apps vulnerable. This is a development-time only dependency.

Is there a reason it's not a devDependency?

create-react-app/packages/react-dev-utils/package.json

Lines 54 to 83 in dfe2a09

    
           "dependencies": { 
        
             "@babel/code-frame": "7.10.4", 
        
             "address": "1.1.2", 
        
             "browserslist": "4.14.2", 
        
             "chalk": "2.4.2", 
        
             "cross-spawn": "7.0.3", 
        
             "detect-port-alt": "1.1.6", 
        
             "escape-string-regexp": "2.0.0", 
        
             "filesize": "6.1.0", 
        
             "find-up": "4.1.0", 
        
             "fork-ts-checker-webpack-plugin": "4.1.6", 
        
             "global-modules": "2.0.0", 
        
             "globby": "11.0.1", 
        
             "gzip-size": "5.1.1", 
        
             "immer": "8.0.1", 
        
             "is-root": "2.1.0", 
        
             "loader-utils": "2.0.0", 
        
             "open": "^7.0.2", 
        
             "pkg-up": "3.1.0", 
        
             "prompts": "2.4.0", 
        
             "react-error-overlay": "^6.0.8", 
        
             "recursive-readdir": "2.2.2", 
        
             "shell-quote": "1.7.2", 
        
             "strip-ansi": "6.0.0", 
        
             "text-table": "0.2.0" 
        
           }, 
        
           "devDependencies": { 
        
             "cross-env": "^7.0.2", 
        
             "jest": "26.6.0" 
        
           },

RDIL · 2021-01-23T20:03:33Z

Note: this will NOT make anybody's apps vulnerable. This is a development-time only dependency.

Is there a reason it's not a devDependency?

create-react-app/packages/react-dev-utils/package.json

Lines 54 to 83 in dfe2a09

"dependencies": {

"@babel/code-frame": "7.10.4",

"address": "1.1.2",

"browserslist": "4.14.2",

"chalk": "2.4.2",

"cross-spawn": "7.0.3",

"detect-port-alt": "1.1.6",

"escape-string-regexp": "2.0.0",

"filesize": "6.1.0",

"find-up": "4.1.0",

"fork-ts-checker-webpack-plugin": "4.1.6",

"global-modules": "2.0.0",

"globby": "11.0.1",

"gzip-size": "5.1.1",

"immer": "8.0.1",

"is-root": "2.1.0",

"loader-utils": "2.0.0",

"open": "^7.0.2",

"pkg-up": "3.1.0",

"prompts": "2.4.0",

"react-error-overlay": "^6.0.8",

"recursive-readdir": "2.2.2",

"shell-quote": "1.7.2",

"strip-ansi": "6.0.0",

"text-table": "0.2.0"

},

"devDependencies": {

"cross-env": "^7.0.2",

"jest": "26.6.0"

},

What I meant is that it is essentially its only used during the build phase of your app, not at runtime. Sorry for phrasing it wrong.

TianyuHou · 2021-01-28T00:06:39Z

when can we expect to have a new release for this fix? this is a high security issue within our project

repartay · 2021-01-29T17:07:06Z

Bumping this request, we also have this as a high security vuln in our project and since immer has released the patch, would really appreciate a timely bump in your dependencies. Thank you!

yec · 2021-02-02T02:52:51Z

instead of making demands why don't you submit a patch

when can we expect to have a new release for this fix? this is a high security issue within our project

Bumping this request, we also have this as a high security vuln in our project and since immer has released the patch, would really appreciate a timely bump in your dependencies. Thank you!

trivikr · 2021-02-02T04:01:02Z

instead of making demands why don't you submit a patch

There's an open PR posted on the day this issue was created at #10412

mrwensveen · 2021-02-03T12:30:04Z

Thanks for looking at this, I really appreciate the hard work you people are doing!

Note: this will NOT make anybody's apps vulnerable. This is a development-time only dependency.

Is there a reason it's not a devDependency?

What I meant is that it is essentially its only used during the build phase of your app, not at runtime. Sorry for phrasing it wrong.

But doesn't that mean it should be a devDependency?

IMHO there is something seriously wrong with the security audit notifications. I've seen it dozens of times:

npm warns about a vulnerability.
developers want to be good citizens and submit a bug.
package maintainers tell them there's nothing to worry about and leave the end users with alarms going off for weeks.

I think telling users to ignore security warnings is harmful. So either npm shouldn't warn about irrelevant vulnerabilities, or package maintainers should prioritize security vulnerabilities even if they are irrelevant.

RDIL · 2021-02-03T15:16:21Z

But doesn't that mean it should be a devDependency?

If it WAS a devDependency for react-scripts, it wouldn't get installed during npm install or yarn install. It also can't be a dev dependency for every app, since the philosophy is having only one top-level dependency for the entire build process. Either way, this does not work as a dev dependency.

adesnmi · 2021-02-03T19:28:05Z

IMHO there is something seriously wrong with the security audit notifications. I've seen it dozens of times:

Yup, at this point I’m inclined to turn it off which defeats the point of what should be a very useful feature. It’s annoying having the main repo page shout at me with nothing I can do about it.

mrwensveen · 2021-02-04T00:23:47Z

But doesn't that mean it should be a devDependency?

If it WAS a devDependency for react-scripts, it wouldn't get installed during npm install or yarn install. It also can't be a dev dependency for every app, since the philosophy is having only one top-level dependency for the entire build process. Either way, this does not work as a dev dependency.

I understand that react-scripts can't be a devDependency itself because of some issues (discussion). My best suggestion would be to split up the package into something like react-scripts and react-scripts-dev, with the latter as devDependency and depending on things like immer and other stuff that needs to be pulled in development/design time, but can be left out in production. This is akin to some Linux distributions, that have things like header files needed for developing with a library in a libXXX-dev package.

An other, more outlandish idea I had, but very much out of scope for this discussion, is to have the ability for packages to specify 'transient devDependencies', meaning that when you devDepend on a package specifying a transient devDependency, that dependency should be treated as a devDependency for your application or package as well.

avbdev · 2021-02-09T18:47:40Z

Even if it's dev dependency why do we have to stick with the oldest version of immer(1.10.0). Can we not bump up the version?

RDIL · 2021-02-09T18:49:12Z

Even if it's dev dependency why do we have to stick with the oldest version of immer(1.10.0). Can we not bump up the version?

What version of react-dev-utils are you using @avbhardwaj?

avbdev · 2021-02-09T19:01:48Z

@RDIL : Currently I'm using v10.2.1

RDIL · 2021-02-09T19:04:50Z

@RDIL : Currently I'm using v10.2.1

Are you sure? It appears that react-dev-utils is using a way newer build of immer than 1.10.0: https://github.com/facebook/create-react-app/blob/master/packages/react-dev-utils/package.json

avbdev · 2021-02-09T19:09:07Z

@RDIL : Thanks for the update 👍 , it seems like it has been bumped up in the v11.0.2 of react-dev-utils.

juffel · 2021-02-10T08:36:27Z

Also the newer version of [email protected] still depends on a vulnerable version of "immer": "7.0.9" 🤔
according to the CVE the vulnerability is patched in immer versions >8.0.1

votemike · 2021-02-16T08:47:11Z

Forgive my ignorance.
While immer might not be a problem in this package. The fixed dependency still stops immer being upgraded in other packages used in a project. No?

RDIL · 2021-02-16T13:45:39Z

If your project uses a different major version of immer, your package manager should move this version directly into node_modules/react-dev-utils/node_modules/immer.

KannugoPrithvi · 2021-02-18T09:38:44Z

We are still getting this issue ever after upgrading to 11.0.2 in our project. Immer dependency is still at 7.0.9. Request the author to please upgrade the immer dependency.

gaearon · 2021-02-22T14:06:52Z

So there's nothing wrong with my packages?

No, there’s nothing wrong. npm audit, when applied to build tools, is often useless, but unfortunately vulnerability advisories offer no way to tag whether a library’s usage in a build tool can lead to issues or not. In this case, it doesn’t.

For all who said this is not an important Bug: This a constraining bug which prevent me from see my code warnings on console.

The false positive report in this thread has no relation to the bug you are seeing. File a new issue with a reproducing project please.

RadixSeven · 2021-02-22T17:13:35Z

To get things moving using npm rather than yarn, you can use the StackOverflow answer here https://stackoverflow.com/a/48524488 to move it out of "requires" and into "dependencies" - where you can set the version. This will get overwritten whenever you use npm to add a new package, but you can add it back.

Resolves #10411 Bumps immer version to 8.0.1 to address the prototype pollution vulnerability with the current 7.0.9 version.

chaim1221 · 2021-02-28T01:14:35Z

  "dependencies": {
#
    "react-dev-utils": "^11.0.2",
# snip
  },
  "resolutions": {
    "immer": "^8.0.1"
  },

Poof, you're unblocked.

# snip
success Saved lockfile.
Done in 8.39s.
celiyah@ce-y720-dev:~/Code/machete/react-ui$ yarn audit
yarn audit v1.22.5
0 vulnerabilities found - Packages audited: 1819
Done in 1.12s.

* Fix noFallthroughCasesInSwitch/jsx object is not extensible (facebook#9921) Co-authored-by: Konstantin Simeonov <[email protected]> * Add logo license to README * Remove trailing space in reportWebVitals.ts (facebook#10040) * docs: add React Testing Library as a library requiring jsdom (facebook#10052) Co-authored-by: Ian Schmitz <[email protected]> * Increase Workbox's maximumFileSizeToCacheInBytes (facebook#10048) * Create FUNDING.yml * replace inquirer with prompts (facebook#10083) - remove `react-dev-utils/inquirer` public import * Prepare 4.0.1 release * Prepare 4.0.1 release * Publish - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] * chore: bump web-vital dependency version (facebook#10143) * chore: bump typescript version (facebook#10141) Co-authored-by: Ian Schmitz <[email protected]> * Add TypeScript 4.x as peerDependency to react-scripts(facebook#9964) * remove chalk from formatWebpackMessages (facebook#10198) * Upgrade @svgr/webpack to fix build error (facebook#10213) Co-authored-by: Ian Schmitz <[email protected]> * Improve vendor chunk names in development (facebook#9569) * Update postcss packages (facebook#10003) Co-authored-by: Ian Schmitz <[email protected]> * Recovered some integration tests (facebook#10091) * Upgrade sass-loader (facebook#9988) * Move ESLint cache file into node_modules (facebook#9977) Co-authored-by: Ian Schmitz <[email protected]> * Revert "Update postcss packages" (facebook#10216) This reverts commit 580ed5d. * Remove references to Node 8 (facebook#10214) * fix(react-scripts): add missing peer dependency react and update react-refresh-webpack-plugin (facebook#9872) * Update using-the-public-folder.md (facebook#10314) Some library --> Some libraries * docs: add missing override options for Jest config (facebook#9473) * Fix CI tests (facebook#10217) * appTsConfig immutability handling by immer (facebook#10027) Co-authored-by: mad-jose <[email protected]> * Add support for new BUILD_PATH advanced configuration variable (facebook#8986) * Add opt-out for eslint-webpack-plugin (facebook#10170) * Prepare 4.0.2 release * Publish - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] * tests: update test case to match the description (facebook#10384) * Bump webpack-dev-server 3.11.0 -> 3.11.1 (facebook#10312) Resolves facebook#10084 security vulnerability in websocket-driver library version 0.5.6, imported transitively by sockjs * Upgrade eslint-webpack-plugin to fix opt-out flag (facebook#10590) * update immer to 8.0.1 to address vulnerability (facebook#10412) Resolves facebook#10411 Bumps immer version to 8.0.1 to address the prototype pollution vulnerability with the current 7.0.9 version. * Prepare 4.0.3 release * Update CHANGELOG * Publish - [email protected] - [email protected] - [email protected] Co-authored-by: Ryota Murakami <[email protected]> Co-authored-by: Konstantin Simeonov <[email protected]> Co-authored-by: Ian Sutherland <[email protected]> Co-authored-by: sho90 <[email protected]> Co-authored-by: Anyul Rivas <[email protected]> Co-authored-by: Ian Schmitz <[email protected]> Co-authored-by: Jeffrey Posnick <[email protected]> Co-authored-by: Evan Bacon <[email protected]> Co-authored-by: Sahil Purav <[email protected]> Co-authored-by: Hakjoon Sim <[email protected]> Co-authored-by: Chris Shepherd <[email protected]> Co-authored-by: Jason Williams <[email protected]> Co-authored-by: Jabran Rafique⚡️ <[email protected]> Co-authored-by: John Ruble <[email protected]> Co-authored-by: Morten N.O. Nørgaard Henriksen <[email protected]> Co-authored-by: Sergey Makarov <[email protected]> Co-authored-by: EhsanKhaki <[email protected]> Co-authored-by: Kristoffer K <[email protected]> Co-authored-by: Aviv Hadar <[email protected]> Co-authored-by: Tobias Büschel <[email protected]> Co-authored-by: mad-jose <[email protected]> Co-authored-by: mad-jose <[email protected]> Co-authored-by: Andrew Hyndman <[email protected]> Co-authored-by: Brody McKee <[email protected]> Co-authored-by: James George <[email protected]> Co-authored-by: Dion Woolley <[email protected]> Co-authored-by: Walker Clem <[email protected]>

Resolves facebook#10411 Bumps immer version to 8.0.1 to address the prototype pollution vulnerability with the current 7.0.9 version.

This is following up on a vulnerability reported here: https://github.com/glints-dev/glints-aries/security/dependabot/yarn.lock/immer/open See the related discussion here: facebook/create-react-app#10411 From what I found online, this issue is quite irrelevant: facebook/create-react-app#10411 (comment)

cmacdonnacha · 2021-10-05T14:57:26Z

  "dependencies": {
#
    "react-dev-utils": "^11.0.2",
# snip
  },
  "resolutions": {
    "immer": "^8.0.1"
  },

Poof, you're unblocked.

# snip
success Saved lockfile.
Done in 8.39s.
celiyah@ce-y720-dev:~/Code/machete/react-ui$ yarn audit
yarn audit v1.22.5
0 vulnerabilities found - Packages audited: 1819
Done in 1.12s.

Is there any way to do this with NPM?

GHSA-33f9-j839-rf8h facebook/create-react-app#10411 (comment)

gian-luca-weston · 2021-10-21T13:03:08Z

Is there any way to do this with NPM?

Using the npm-force-resolution package , you can change the version of the sub-dependency within npm
https://www.npmjs.com/package/npm-force-resolutions

cmacdonnacha · 2021-10-21T13:09:23Z

Yep, I'm doing that now with all 5 vulbernable packages:

  "resolutions": {
    "ansi-regex": "5.0.1",
    "nth-check": "2.0.1",
    "set-value": "4.0.1",
    "immer": "9.0.6",
    "ansi-html": "https://registry.npmjs.org/ansi-html-community/-/ansi-html-community-0.0.8.tgz"
  },

jacraven · 2021-12-10T05:06:24Z

Thanks for the help! I just went through the same issue & this was quite helpful.

An updated list of resolutions to patch up current vulnerabilities as of December 2021 was as follows:

"resolutions": {
    "immer": "9.0.7",
    "ansi-html": "https://registry.yarnpkg.com/ansi-html-community/-/ansi-html-community-0.0.8.tgz",
    "ansi-regex": "5.0.1",
    "nth-check": "2.0.1",
    "glob-parent": "6.0.1",
    "browserslist": "4.18.1"
  }

veller · 2022-01-12T23:41:08Z

I tried using both resolutions and overrides (from npm) but none worked. My application uses Nexus as a private npm registry so that caused an error when using npm-force-resolutions.

Just to make sure I'm doing it correctly, @cmacdonnacha and @jacraven, you guys are just adding the resolutions' object to package.json and running npm i afterwards?

RDIL · 2022-01-12T23:46:44Z

@veller please update your react scripts version if possible, but also keep in mind this isn't going to harm your project, and can safely be ignored.

Resolves facebook#10411 Bumps immer version to 8.0.1 to address the prototype pollution vulnerability with the current 7.0.9 version.

wclem4 added issue: bug report needs triage labels Jan 20, 2021

wclem4 added a commit to wclem4/create-react-app that referenced this issue Jan 20, 2021

update immer to 8.0.1 to address vulnerability

e468b00

Resolves facebook#10411 Bumps immer version to 8.0.1 to address the prototype pollution vulnerability with the current 7.0.9 version.

wclem4 added a commit to wclem4/create-react-app that referenced this issue Jan 20, 2021

update immer to 8.0.1 to address vulnerability

dfe2a09

Resolves facebook#10411 Bumps immer version to 8.0.1 to address the prototype pollution vulnerability with the current 7.0.9 version.

wclem4 mentioned this issue Jan 20, 2021

update immer to 8.0.1 to address vulnerability #10412

Merged

This was referenced Jan 21, 2021

About security issue related to Immer sharetribe/ftw-daily#1401

Closed

About security issue related to Immer sharetribe/ftw-hourly#133

Closed

bidoubiwa mentioned this issue Jan 21, 2021

Fix vulnerability caused by react-scripts meilisearch/meilisearch-js-plugins#226

Closed

trietlu mentioned this issue Jan 22, 2021

GTT-907: Immer upgrade to fix vulnerability aws-solutions/performance-dashboard-on-aws#246

Closed

macfarlandian mentioned this issue Jan 26, 2021

Resolve immer security alert Recidiviz/public-dashboard#315

Closed

iansu closed this as completed in #10412 Feb 22, 2021

iansu pushed a commit that referenced this issue Feb 22, 2021

update immer to 8.0.1 to address vulnerability (#10412)

6947896

Resolves #10411 Bumps immer version to 8.0.1 to address the prototype pollution vulnerability with the current 7.0.9 version.

gaearon mentioned this issue Feb 22, 2021

react-dev-utils: Security vulnerability with immer 7.0.9 #10578

Closed

chaim1221 mentioned this issue Feb 28, 2021

fix vulnerable dependency of react-dev-scripts SavageLearning/machete-react-ui#2

Merged

mswertz mentioned this issue Mar 1, 2021

npm audit reports vulnerability - immer in react-dev-utils vue-styleguidist/vue-styleguidist#1062

Closed

imnotteixeira mentioned this issue Mar 6, 2021

Fix vulnerable packages + Transient errors in tests NIAEFEUP/nijobs-fe#81

Merged

gaearon mentioned this issue Mar 9, 2021

Security Fix for Command Injection - huntr.dev #10644

Merged

DanEastBentley mentioned this issue Mar 11, 2021

bump to @bentley/[email protected], eslint@^7.11.0 iTwin/itwinjs-core#942

Merged

gleekzorp mentioned this issue Mar 18, 2021

Bump react-scripts from 4.0.2 to 4.0.3 code-experiment/code-experiment-website#69

Closed

didoesdigital added a commit to didoesdigital/typey-type that referenced this issue Oct 17, 2021

Update immer resolutions

0d2d212

GHSA-33f9-j839-rf8h facebook/create-react-app#10411 (comment)

literalpie mentioned this issue Nov 19, 2021

Deps: upgrade react-dev-utils to get newer immer storybookjs/storybook#14015

Merged

eweitz mentioned this issue Nov 22, 2021

Update react-scripts to address immer alert (SCP-3893) broadinstitute/single_cell_portal_core#1273

Merged

rjwats mentioned this issue Nov 30, 2021

Question: using React Hooks for managing state? rjwats/esp8266-react#251

Closed

smile-eh mentioned this issue Dec 9, 2021

update to force new immer version csps-efpc/regkg-rcreg#5

Merged

davidradl mentioned this issue Jan 28, 2022

npm critical audit error odpi/egeria-react-ui#342

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

react-dev-utils uses a vulnerable version of immer as a dependency #10411

react-dev-utils uses a vulnerable version of immer as a dependency #10411

wclem4 commented Jan 20, 2021

RDIL commented Jan 21, 2021 •

edited

Loading

jhockett commented Jan 23, 2021

RDIL commented Jan 23, 2021

TianyuHou commented Jan 28, 2021

repartay commented Jan 29, 2021

yec commented Feb 2, 2021

trivikr commented Feb 2, 2021

mrwensveen commented Feb 3, 2021 •

edited

Loading

RDIL commented Feb 3, 2021 •

edited

Loading

adesnmi commented Feb 3, 2021 •

edited

Loading

mrwensveen commented Feb 4, 2021

avbdev commented Feb 9, 2021

RDIL commented Feb 9, 2021

avbdev commented Feb 9, 2021

RDIL commented Feb 9, 2021

avbdev commented Feb 9, 2021

juffel commented Feb 10, 2021

votemike commented Feb 16, 2021

RDIL commented Feb 16, 2021

KannugoPrithvi commented Feb 18, 2021

gaearon commented Feb 22, 2021

RadixSeven commented Feb 22, 2021

chaim1221 commented Feb 28, 2021

cmacdonnacha commented Oct 5, 2021

gian-luca-weston commented Oct 21, 2021

cmacdonnacha commented Oct 21, 2021 •

edited

Loading

jacraven commented Dec 10, 2021 •

edited

Loading

veller commented Jan 12, 2022 •

edited

Loading

RDIL commented Jan 12, 2022

react-dev-utils uses a vulnerable version of immer as a dependency #10411

react-dev-utils uses a vulnerable version of immer as a dependency #10411

Comments

wclem4 commented Jan 20, 2021

Describe the bug

RDIL commented Jan 21, 2021 • edited Loading

jhockett commented Jan 23, 2021

RDIL commented Jan 23, 2021

TianyuHou commented Jan 28, 2021

repartay commented Jan 29, 2021

yec commented Feb 2, 2021

trivikr commented Feb 2, 2021

mrwensveen commented Feb 3, 2021 • edited Loading

RDIL commented Feb 3, 2021 • edited Loading

adesnmi commented Feb 3, 2021 • edited Loading

mrwensveen commented Feb 4, 2021

avbdev commented Feb 9, 2021

RDIL commented Feb 9, 2021

avbdev commented Feb 9, 2021

RDIL commented Feb 9, 2021

avbdev commented Feb 9, 2021

juffel commented Feb 10, 2021

votemike commented Feb 16, 2021

RDIL commented Feb 16, 2021

KannugoPrithvi commented Feb 18, 2021

gaearon commented Feb 22, 2021

RadixSeven commented Feb 22, 2021

chaim1221 commented Feb 28, 2021

cmacdonnacha commented Oct 5, 2021

gian-luca-weston commented Oct 21, 2021

cmacdonnacha commented Oct 21, 2021 • edited Loading

jacraven commented Dec 10, 2021 • edited Loading

veller commented Jan 12, 2022 • edited Loading

RDIL commented Jan 12, 2022

RDIL commented Jan 21, 2021 •

edited

Loading

mrwensveen commented Feb 3, 2021 •

edited

Loading

RDIL commented Feb 3, 2021 •

edited

Loading

adesnmi commented Feb 3, 2021 •

edited

Loading

cmacdonnacha commented Oct 21, 2021 •

edited

Loading

jacraven commented Dec 10, 2021 •

edited

Loading

veller commented Jan 12, 2022 •

edited

Loading