Prototype Pollution - npm vulnerability can't be fixed?

Question

I am starting a new react project, and I just installed the very basic package (npx create-react-app) without anything else. When I run the audit, I get the following low vulnerability:

                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-scripts > webpack-dev-server > yargs > yargs-parser    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1500                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 low severity vulnerability in 1896 scanned packages
  1 vulnerability requires manual review. See the full report for details.

I tried google and looked anywhere for a way to fix this, I reinstalled the yargs-parser package without success, and tried reinstall the project several times.

Any help would be highly appreciated.

Answer 1

Right now there isn't an immediate fix. yargs-parser has breaking changes in the versions that have been released since the one pinned in react-scripts. We are waiting on the react-scripts to be updated in order to address this warning.

It is worth noting that this isn't a "serious" vulnerability and should only affect dev environments. It is fixed in the latest yargs-parser but I wouldn't lose sleep over a low risk vulnerability. They happen from time to time and the community is usually quite good at patching them out.

You can watch the progress of this issue or (depending on your skill level) contribute to the fix here: https://github.com/facebook/create-react-app/issues/8529

Answer 2

We need to add this too:

"scripts": { "preinstall": "npx npm-force-resolutions" }

Then on your package.json add:

"resolutions": { "yargs-parser": "^13.1.2" }

Finally run below commond on your terminal:

rm -r node_modules

npm install