Moderate vulnerabilities when running npx create-react-app

[christopherlim98]

I get 20 moderate vulnerabilities when running npx create-react-app. Running npm audit fix does not fix it. Was wondering if this has been reported?

# npm audit report

hosted-git-info  <3.0.8

Severity: moderate
Regular Expression Deinal of Service - https://npmjs.com/advisories/1677
fix available via `npm audit fix --force`
Will install react-scripts@1.0.10, which is a breaking change
node_modules/hosted-git-info
  normalize-package-data  2.0.0 - 2.5.0
  Depends on vulnerable versions of hosted-git-info
  node_modules/normalize-package-data
    read-pkg  <=5.2.0
    Depends on vulnerable versions of normalize-package-data
    node_modules/@jest/core/node_modules/read-pkg
    node_modules/@jest/reporters/node_modules/read-pkg
    node_modules/jest-config/node_modules/read-pkg
    node_modules/jest-resolve/node_modules/read-pkg
    node_modules/jest-runner/node_modules/read-pkg
    node_modules/jest-runtime/node_modules/read-pkg
    node_modules/jest-snapshot/node_modules/read-pkg
    node_modules/read-pkg
      read-pkg-up  <=7.0.1
      Depends on vulnerable versions of read-pkg
      node_modules/@jest/core/node_modules/read-pkg-up
      node_modules/@jest/reporters/node_modules/read-pkg-up
      node_modules/jest-config/node_modules/read-pkg-up
      node_modules/jest-resolve/node_modules/read-pkg-up
      node_modules/jest-runner/node_modules/read-pkg-up
      node_modules/jest-runtime/node_modules/read-pkg-up
      node_modules/jest-snapshot/node_modules/read-pkg-up
      node_modules/read-pkg-up
        eslint-plugin-import  >=2.3.0
        Depends on vulnerable versions of read-pkg-up
        node_modules/eslint-plugin-import
          eslint-config-react-app  2.0.0 - 3.0.0-next.fb6e6f70 || >=6.0.0-next.64
          Depends on vulnerable versions of eslint-plugin-import
          node_modules/eslint-config-react-app
            react-scripts  >=1.0.11
            Depends on vulnerable versions of eslint-config-react-app
            Depends on vulnerable versions of eslint-plugin-import
            Depends on vulnerable versions of jest-resolve
            node_modules/react-scripts
        jest-resolve  25.4.0 - 26.4.0 || 26.5.2 - 26.6.2
        Depends on vulnerable versions of read-pkg-up
        node_modules/@jest/core/node_modules/jest-resolve
        node_modules/@jest/reporters/node_modules/jest-resolve
        node_modules/jest-config/node_modules/jest-resolve
        node_modules/jest-resolve
        node_modules/jest-runner/node_modules/jest-resolve
        node_modules/jest-runtime/node_modules/jest-resolve
        node_modules/jest-snapshot/node_modules/jest-resolve
          @jest/core  25.4.0 - 25.5.4 || 26.5.2 - 26.6.3
          Depends on vulnerable versions of jest-resolve
          node_modules/@jest/core
            jest  25.4.0 - 25.5.4 || 26.5.2 - 26.6.3
            Depends on vulnerable versions of @jest/core
            node_modules/jest
            jest-cli  25.4.0 - 25.5.4 || 26.5.2 - 26.6.3
            Depends on vulnerable versions of @jest/core
            node_modules/jest-cli
          @jest/reporters  25.4.0 - 25.5.1 || 26.5.2 - 26.6.2
          Depends on vulnerable versions of jest-resolve
          node_modules/@jest/reporters
          jest-config  25.4.0 - 25.5.4 || 26.5.2 - 26.6.3
          Depends on vulnerable versions of jest-resolve
          node_modules/jest-config
          jest-runner  25.4.0 - 25.5.4 || 26.5.2 - 26.6.3
          Depends on vulnerable versions of jest-resolve
          node_modules/jest-runner
            jest-circus  25.4.0 - 25.5.4 || 26.5.2 - 26.6.3
            Depends on vulnerable versions of jest-runner
            Depends on vulnerable versions of jest-runtime
            node_modules/jest-circus
          jest-runtime  25.4.0 - 25.5.4 || 26.5.2 - 26.6.3
          Depends on vulnerable versions of jest-resolve
          node_modules/jest-runtime
            @jest/test-sequencer  25.4.0 - 25.5.4 || 26.5.2 - 26.6.3
            Depends on vulnerable versions of jest-runtime
            node_modules/@jest/test-sequencer
            jest-jasmine2  25.4.0 - 25.5.4 || 26.5.2 - 26.6.3
            Depends on vulnerable versions of jest-runtime
            node_modules/jest-jasmine2
          jest-snapshot  25.4.0 - 25.5.1 || 26.5.2 - 26.6.2
          Depends on vulnerable versions of jest-resolve
          node_modules/jest-snapshot
            jest-resolve-dependencies  25.4.0 - 25.5.4 || 26.5.2 - 26.6.3
            Depends on vulnerable versions of jest-snapshot
            node_modules/jest-resolve-dependencies

20 moderate severity vulnerabilities

[aleleba]

I get same vulnerability report, I confirm it is true.

[jdmann]

When we run yarn audit, we get similar warnings about hosted-git-info, which needs to be upgraded to 3.0.8. This relates to an issue reported just today (May 6th, 2021).

https://www.npmjs.com/advisories/1677

react-scripts uses hosted-git-info as a dependency, so it will need to upgraded to the patched version.

[RubenFern]

That happens to me too. The same vulnerabilities

[stelladraco27]

Can confirm the same, not sure if I should wait to create the app or just go ahead and ignore the vulnerabilities. Will an update fixing those issues break my app?

[bsubba]

I have the same warning: hosted-git-info

[klaytoncavalcante]

I can confirm.
I see other packages with the same info in my project, but react-scripts is the one with most mentions in npm audit:
There are two mentions of node-sass, 86 mentions of react-scripts and one of eslint-plugin-import in my project audit result.
All of them related to the issue with hosted-git-info: https://www.npmjs.com/advisories/1677

The advisory says it's fixed on version 3.0.8 of hosted-git-info.

[benayat]

same here, and I got 80

[aleleba]

Another Vulnerability:
Moderate │ Regular Expression Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ postcss │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=8.2.10 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ react-scripts > resolve-url-loader > postcss │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1693

[kpotter-m2]

Another Vulnerability:
Moderate │ Regular Expression Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ postcss │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=8.2.10 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ react-scripts > resolve-url-loader > postcss │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1693

see #10945 for that exact issue

[jarnohenneman]

Is there already a solution for this? - getting annoyed with the number of emails from security teams complaining about it.

[FHomes]

Same but I'm not getting "found 79 moderate severity vulnerabilities"

[KarahanGuner]

I am also getting 79 moderate severity vulnerabilities. Npm audit fix did not work.

[Black996]

I am also getting 87 vulnerabilities (81 moderate, 6 high) when using npx create-react-app
it was previously 80 vulnerabilities but now they're 87
is there any solution for this?