Repository navigation
Remarkable Dependency Vulnerability #156
Description
The dependency Remarkable has been updated to use autolinker v3.0.0+ as there was a DOS vulnerability in autolinker v0.28.1 (https://snyk.io/vuln/SNYK-JS-AUTOLINKER-73494).
Updating Remarkable to v2.0.0+ will resolve the issue.
Old - https://github.com/jonschlinkert/remarkable/blob/v1.7.4/package.json#L66
New - https://github.com/jonschlinkert/remarkable/blob/v2.0.0/package.json#L81
Currently unable to install markdown-toc due to older version of autolinker being quarantined on corporate npm registry.
Activity
ramonpetgrave64 commentedon Jun 28, 2024
For those still affected, I've been able to get around this by adding an override to my package.json. deps.dev was a huge help to figuring out the dependency chain and that versions higher than autolinker>=0.2.1 is not vulnerable, but v4.0.0 seems to work fine for me. I even cloned the markdown-toc repo, added this fix, and ran its test. They pass!
I have a pending fix here #195. @KarinBlanford , @jonschlinkert , @doowb
chore: fix vuln: override autolinker ^4.0.0 (#785)