react-native-codegen 0.0.7 transitive package unset-value/1.0.0 have known vulnerability security issue

[NarahariTagili-Eaton]

Description

react-native-codegen 0.0.7 transitive package unset-value/1.0.0.0 have known vulnerability security issues.
We are using unset-value/1.0.0 transitive package under react-native-codegen 0.0.7 library, unset-value/1.0.0 transitive package having security issue ie.. unset-value is vulnerable to a prototype pollution attack. A remote attacker may be able to execute arbitrary code or cause a denial-of-service (DoS) by tricking the library into modifying or adding properties of Object.prototype. and CVE: BDSA-2021-4507
RCE

We would expect to fix BDSA-2021-4507
RCE) for unset-value/1.0.0 transitive package, upgrading react-native-codegen 0.0.7 latest version

Version

react-native-codegen 0.0.7

Output of npx react-native info

npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated uglify-es@3.3.9: support for ECMAScript is superseded by uglify-js as of v3.13.0

Steps to reproduce

Run the SCA using Blackduck found transitive package unset-value/1.0.0.0 vulnerable and CVE: BDSA-2021-4507
RCE

Snack, code example, screenshot, or link to a repository

NA

[cortinico]

That's a valid report, but we'll have to bump jscodeshift to 0.14.0 inside react-native-codegen.

[Nyazuki]

+1 on this vulnerability issue.

Report:

• Veracode: https://sca.analysiscenter.veracode.com/vulnerability-database/security/sca/vulnerability/sid-37811/summary
• snyk: https://security.snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660

According to: https://github.com/facebook/jscodeshift/blob/main/CHANGELOG.md, it should have no unexpected breaking changes to upgrade from current ^0.13.1 to ^0.14.0.

@cortinico It looks like an easy version pump, any thoughts/updates?

[Nyazuki]

looks like the version is now upgraded: #35356

[cortinico]

Indeed so we can close this