`react-dev-utils`: Prototype Pollution in Immer
Created by: SalGnt-Dev
Describe the bug
The react-dev-utils
package uses a vulnerable version (v8.0.4
) of Immer.
The fix, commit fa671e5, is part of the v9.0.6
release.
The react-dev-utils
package should use this specific version of Immer.
GitHub CVE
- Prototype Pollution in immer (critical severity): CVE-2021-3757.
- Prototype Pollution in immer (high severity): CVE-2021-23436.