Package impacting the security issue because of requirejs use

[vtulse]

requirejs/r.js#1015
Medium severity
requirejs Prototype Pollution
VULNERABILITY
CWE-1321OPEN THIS LINK IN A NEW TAB
CVSS 6.5OPEN THIS LINK IN A NEW TAB MEDIUM
SNYK-JS-REQUIREJS-5416713OPEN THIS LINK IN A NEW TAB
SCORE
432
Introduced through
[email protected]
Exploit maturity
PROOF OF CONCEPT
Show less detail
Detailed paths
Introduced through: [email protected] › [email protected] › [email protected] › [email protected] › [email protected] › [email protected]
Fix: No remediation path available.

[epreston]

This is the dependency chain causing the issue.

[email protected]
└─┬ [email protected]
  └─┬ [email protected]
    └─┬ [email protected]
      └── [email protected]

Short story: [email protected] is the latest version from Aug 27, 2018. Not possible to do a quick fix by using an override in the ' package.json' until that project updates or something higher in the chain drops it. Example:

  "overrides": {
    "module-lookup-amd": {
      "requirejs": "some later version here"
    }
  },