Do not open a PR. We appreciate the enthusiasm but the fix is more complicated than it appears. We're considering our options.
See https://www.npmjs.com/advisories/803
Versions of node-tar prior to 4.4.2 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.
Caused by node-gyp. I guess this depends on nodejs/node-gyp#1714 being fixed first. As far as I can tell, to fix this node-sass needs to to upgrade to node-gyp@4.x.x once they've resolved the issue on their part.
Output from yarn audit:
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high │ Arbitrary File Overwrite │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tar │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=4.4.2 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-sass │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ node-sass > node-gyp > tar │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/803 │
└───────────────┴──────────────────────────────────────────────────────────────┘
1 vulnerabilities found - Packages audited: 16503
Severity: 1 High
Do not open a PR. We appreciate the enthusiasm but the fix is more complicated than it appears. We're considering our options.
See https://www.npmjs.com/advisories/803
Caused by
node-gyp. I guess this depends on nodejs/node-gyp#1714 being fixed first. As far as I can tell, to fix thisnode-sassneeds to to upgrade tonode-gyp@4.x.xonce they've resolved the issue on their part.Output from
yarn audit: