OWASP/cve-lite-cli v1.41.4

v1.41.4 - Option-shaped package names no longer reach fix commands

on GitHub

Upgrade note. This release contains one security fix and nothing else.

Security

• A package name that looks like a command-line option, such as an npm alias named --registry=https://... or --ignore-scripts=false, is no longer put into a printed fix command or run by --fix. Since 1.41.0 such an alias is scanned under the real package it points at, so it could produce a finding whose fix command the package manager read as a setting, for example pointing npm install at another registry. The finding is now listed as skipped with the reason (GHSA-5583-5qpr-q69x).

Validation

• npm test
• npm run build

Contributors

• @S3DFX-CYBER (reported and fixed)