Symfony - npm update not fixing vulnerabilities

Question

I'm learning Symfony using the book on the site and when I type at cmd:

symfony deploy

Then it says


Symfony Security Check Report
1 package has known vulnerabilities.

symfony/http-kernel (v5.0.11)
[CVE-2020-15094][]: Prevent RCE when calling untrusted remote with CachingHttpClient
[CVE-2020-15094]: https://symfony.com/cve-2020-15094
Note that this checker can only detect vulnerabilities that are referenced in the security advisories database.
Execute this command regularly to check the newly discovered vulnerabilities.

How do I fix this?

user_9476349 · Answer

Simply update the package.

You can review the versions and which ones that has reportedly an vulnerability inside it here: https://packagist.org/packages/symfony/http-kernel

composer update symfony/http-kernel

Symfony - npm update not fixing vulnerabilities

1 Answers