I recently install node 18.12.0, and Electron 21.0.1. At the completion of the install of electron I was given a warning about 3 moderate vulnerabilities. I ran the suggested npm audit fix --force; but that resulted in a high vulnerability. I re-ran the npm audi fix --force command and the original 3 vulnerabilities returned. Round and round I go. My thinking is that 3 moderate vulnerabilities is better than one high, but is there a way I can resolve all of them?
# npm audit report
got <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix --force`
Will install electron@6.1.12, which is a breaking change
node_modules/got
@electron/get <=1.14.1
Depends on vulnerable versions of got
node_modules/@electron/get
electron 7.0.0-beta.1 - 21.2.0
Depends on vulnerable versions of @electron/get
node_modules/electron
3 moderate severity vulnerabilities
To address all issues (including breaking changes), run:
npm audit fix --force
# npm audit report
electron <=15.5.4
Severity: high
Renderers can obtain access to random bluetooth device without permission in Electron - https://github.com/advisories/GHSA-3p22-ghq8-v749
Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled - https://github.com/advisories/GHSA-mq8j-3h7h-p8g7
AutoUpdater module fails to validate certain nested components of the bundle - https://github.com/advisories/GHSA-77xc-hjv8-ww97
Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API - https://github.com/advisories/GHSA-mpjm-v997-c4h4
IPC messages delivered to the wrong frame in Electron - https://github.com/advisories/GHSA-hvf8-h2qh-37m9
Context isolation bypass via leaked cross-context objects in Electron - https://github.com/advisories/GHSA-m93v-9qjc-3g79
Context isolation bypass via contextBridge in Electron - https://github.com/advisories/GHSA-h9jc-284h-533g
Arbitrary file read via window-open IPC in Electron - https://github.com/advisories/GHSA-f9mq-jph6-9mhm
fix available via `npm audit fix --force`
Will install electron@21.2.0, which is a breaking change
node_modules/electron
1 high severity vulnerability
To address all issues (including breaking changes), run:
npm audit fix --force
