Facing vulnerability security issue for dot-prop when updating to latest npm package

Question

I am trying to update npm version to latest 6.14.7 in package.json.

After updating npm to the latest, I ran npm audit and got two vulnerabilities for the dot-prop package dependency which is showing under npm path.

So, I tried updating the latest dot-prop ^5.1.1. But still getting the same error.

Please help me with this how can I manually review and fix.

Audit Report:

[root@redhatdev client]# npm audit

                      === npm audit security report ===

                                Manual Review
            Some vulnerabilities require your attention to resolve

         Visit https://go.npm.me/audit-guide for additional guidance


High              Prototype Pollution

Package           dot-prop

Patched in        >=5.1.1

Dependency of     npm [dev]

Path              npm   libnpx   update-notofoer   configstore   dot-prop

More info         https://npmjs.com/advisories/1213


High              Prototype Pollution

Package           dot-prop

Patched in        >=5.1.1

Dependency of     npm [dev]

Path              npm    update-notofoer   configstore   dot-prop

More info         https://npmjs.com/advisories/1213


found 2 high severity vulnerabilities in 1674 scanned packages
 2 vulnerabilities require manual review. See the full report for details.
[root@redhatdev client]#

Full Audit report: npm audit --json

{
  "actions": [
    {
      "action": "review",
      "module": "dot-prop",
      "resolves": [
        {
          "id": 1213,
          "path": "npm>libnpx>update-notifier>configstore>dot-prop",
          "dev": true,
          "optional": false,
          "bundled": true
        },
        {
          "id": 1213,
          "path": "npm>update-notifier>configstore>dot-prop",
          "dev": true,
          "optional": false,
          "bundled": true
        }
      ]
    }
  ],
  "advisories": {
    "1213": {
      "findings": [
        {
          "version": "4.2.0",
          "paths": [
            "npm>libnpx>update-notifier>configstore>dot-prop",
            "npm>update-notifier>configstore>dot-prop"
          ]
        }
      ],
      "id": 1213,
      "created": "2019-10-14T17:43:55.291Z",
      "updated": "2020-07-29T20:58:02.206Z",
      "deleted": null,
      "title": "Prototype Pollution",
      "found_by": {
        "link": "",
        "name": "Unknown",
        "email": ""
      },
      "reported_by": {
        "link": "",
        "name": "Unknown",
        "email": ""
      },
      "module_name": "dot-prop",
      "cves": [
        "CVE-2020-8116"
      ],
      "vulnerable_versions": "<5.1.1",
      "patched_versions": ">=5.1.1",
      "overview": "Versions of `dot-prop` before 5.1.1 are vulnerable to prototype pollution. The function `set` does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.\n\n",
      "recommendation": "Upgrade to version 5.1.1 or later.",
      "references": "- [GitHub advisory](https://github.com/advisories/GHSA-ff7x-qrg7-qggm)\n- [CVE](https://nvd.nist.gov/vuln/detail/CVE-2020-8116)",
      "access": "public",
      "severity": "high",
      "cwe": "CWE-471",
      "metadata": {
        "module_type": "",
        "exploitability": 4,
        "affected_components": ""
      },
      "url": "https://npmjs.com/advisories/1213"
    }
  },
  "muted": [],
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 0,
      "high": 2,
      "critical": 0
    },
    "dependencies": 61,
    "devDependencies": 1612,
    "optionalDependencies": 31,
    "totalDependencies": 1674
  },
  "runId": "9b99170c-35c0-44b1-a0e6-8b714069a255"
}

Answer 1

Edit 2:

Now I found the Problem.

You updated npm locally. (it's in your package.json)

So please run:

npm uninstall npm --save (uninstall locally)

then:

npm i npm -g (that updates npm globally and not locally)

That fixes the problem.

Rest of this answer is obsolete and doesn't add to the solution.

EDIT: It seems to be a npm problem to me.

Here is what I did:

I had npm version 6.14.6.

I installed dot-prop.

No Problem.

I updated my npm to6.14.7.

2 vulnerabilities.

I ran npm audit fix which results in fixed 0 of 2 vulnerabilities.

I ran npm -v which results in 6.14.6.

So I think it's a problem with npm 6.14.7 (and/or a combination with this special package)

Original Message:

did you also try npm audit fix ?

Also it says https://go.npm.me/audit-guide for additional guidance

Did you try that as well?