GHSA-f7xj-rg7h-mc87: Stylelint has vulnerability in semver dependency

Summary

Our meow dependency (which we use for our CLI) depended on [email protected] . A vulnerability in this version of semver was recently identified and surfaced by npm audit:

Regular Expression Denial of Service - GHSA-c2qf-rxjj-qqgw

Details

Original post by the reporter:

"my npm audit show the report

semver <7.5.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - GHSA-c2qf-rxjj-qqgw
No fix available

And my dependencies tree for semver show your package

├─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected] deduped

I found that [email protected] contains normalize-package-data@5 and I can fix this vulnerability because it uses semver@7. But I can’t update meow to the new major version because your package doesn’t allow it."

Update your package to use the ‘meow’ version >=10"

PoC

N/A

Impact

We anticipate the impact to be low as Stylelint is a dev tool and meow is only used on the CLI pathway.

References

• GHSA-f7xj-rg7h-mc87
• stylelint/stylelint#7043
• GHSA-c2qf-rxjj-qqgw
• https://github.com/stylelint/stylelint/releases/tag/15.10.1