Skip to content
This repository was archived by the owner on Feb 12, 2025. It is now read-only.
This repository was archived by the owner on Feb 12, 2025. It is now read-only.

Arbitrary Code Execution in underscore #37

@gabrielmscampos

Description

@gabrielmscampos

This security issue should be easily fixable by updating underscore version according to dependabot, but underscore is a dependency of react-bootstrap-table-next and this package is not maintained for more than 4 years.

This package has pinned the version of underscore to 1.9.1 as you can see here, so we can´t just update underscore's version in the dependency tree. Our options to fix this issue are:

  • Wait for react-bootstrap-table-next to updated (at least have this PR merged).
  • Locally install react-bootstrap-table-next with the underscore bump.
  • Refactor the code to get rid of react-bootstrap-table-next and use another library for rendering the tables.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions