Vulnerable Dependency found #1138

New Issue

Open

opened 2023-09-16 14:08:15 +00:00 by CSDUMMI · 1 comment

CSDUMMI commented

2023-09-16 14:08:15 +00:00

Hi,
I have run the symfony check:security program today on the most recent develop branch and it found the following vulnerable dependency used by kbin:

Symfony Security Check Report
=============================

1 package has known vulnerabilities.

symfony/ux-autocomplete (v2.10.0)
---------------------------------

 * [CVE-2023-41336][]: symfony/ux-autocomplete Prevent injection of invalid entity ids for "autocomplete" fields

[CVE-2023-41336]: https://github.com/symfony/ux-autocomplete/security/advisories/GHSA-4cpv-669c-r79x

Note that this checker can only detect vulnerabilities that are referenced in the security advisories database.
Execute this command regularly to check the newly discovered vulnerabilities.

We maybe able to fix this by upgrading this dependency to v2.11.2

Hi, I have run the `symfony check:security` program today on the most recent `develop` branch and it found the following vulnerable dependency used by kbin: ``` Symfony Security Check Report ============================= 1 package has known vulnerabilities. symfony/ux-autocomplete (v2.10.0) --------------------------------- * [CVE-2023-41336][]: symfony/ux-autocomplete Prevent injection of invalid entity ids for "autocomplete" fields [CVE-2023-41336]: https://github.com/symfony/ux-autocomplete/security/advisories/GHSA-4cpv-669c-r79x Note that this checker can only detect vulnerabilities that are referenced in the security advisories database. Execute this command regularly to check the newly discovered vulnerabilities. ``` We maybe able to fix this by upgrading this dependency to v2.11.2