reactjsdependenciesauditreact-loading-skeleton

react-skeleton-loader-pulse dependent on prismjs which is vulnerable

I want to audit fix my dependencies, I have following vulnerability.

prismjs <=1.26.0 Severity: high Cross-Site Scripting in Prism - https://github.com/advisories/GHSA-wvhm-4hhf-97x9 prismjs Regular Expression Denial of Service vulnerability - https://github.com/advisories/GHSA-hqhp-5p83-hx96 Regular Expression Denial of Service (ReDoS) in Prism - https://github.com/advisories/GHSA-gj77-59wh-66hg Denial of service in prismjs - https://github.com/advisories/GHSA-h4hr-7fg3-h35w Cross-site Scripting in Prism - https://github.com/advisories/GHSA-3949-f494-cm99 No fix available node_modules/refractor/node_modules/prismjs refractor <=3.4.0 || 4.0.0 - 4.1.1 Depends on vulnerable versions of prismjs node_modules/refractor

I tried updating react-skeleton-loader-pulse but it is already on latest 1.2.0.

Solution

  • change the package with react-loading-skeleton and remove react-skeleton-loader-pulse.