how to fix "glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex"

Viewed 37

enter image description hereI am trying to UIKitCatalog app for simulator.

  1. Downloaded zip file from : https://github.com/appium/ios-uicatalog
  2. Unzip the folder
  3. Open the terminal and navigate to the UIKitCatalog folder
  4. Build the app by command npm install

Problem: I am facing 11 vulnerabilities (2 moderate, 9 high). What did i try to resolve : i tried npm audit fix and npm audit fix --force commands but still unable to resolve them. Please guide me how to resolve it.

**********************************************************************************
# npm audit report

glob-parent  <5.1.2
Severity: high
glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex - https://github.com/advisories/GHSA-ww39-953v-wcq6
fix available via `npm audit fix --force`

Will install gulp@3.9.1, which is a breaking change
node_modules/chokidar/node_modules/glob-parent
node_modules/glob-stream/node_modules/glob-parent

  chokidar  1.0.0-rc1 - 2.1.8
  Depends on vulnerable versions of glob-parent
  node_modules/chokidar
    glob-watcher  >=3.0.0
    Depends on vulnerable versions of chokidar
    node_modules/glob-watcher
      gulp  >=4.0.0
      Depends on vulnerable versions of glob-watcher
      Depends on vulnerable versions of vinyl-fs
      node_modules/gulp
        appium-gulp-plugins  >=3.0.0
        Depends on vulnerable versions of gulp
        Depends on vulnerable versions of gulp-debug
        Depends on vulnerable versions of gulp-mocha
        Depends on vulnerable versions of mocha
        node_modules/appium-gulp-plugins
        gulp-debug  >=4.0.0
        Depends on vulnerable versions of gulp
        node_modules/gulp-debug
        gulp-mocha  >=7.0.0
        Depends on vulnerable versions of gulp
        Depends on vulnerable versions of mocha
        node_modules/gulp-mocha
  glob-stream  5.3.0 - 6.1.0
  Depends on vulnerable versions of glob-parent
  node_modules/glob-stream
    vinyl-fs  >=2.4.2
    Depends on vulnerable versions of glob-stream
    node_modules/vinyl-fs

nanoid  3.0.0 - 3.1.30
Severity: moderate
Exposure of Sensitive Information to an Unauthorized Actor in nanoid - https://github.com/advisories/GHSA-qrpm-p2h7-hrv2
fix available via `npm audit fix`
node_modules/nanoid
  mocha  8.2.0 - 9.1.4
  Depends on vulnerable versions of nanoid
  node_modules/mocha

11 vulnerabilities (2 moderate, 9 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force
0 Answers
Related