WhiteSource warning - jQuery Vulnerability CVE-2020-11022 about es6-shim HOT 3 CLOSED

The file is certainly there, but the library isn't npm-installed, and parsing HTML for script tags seems like a very strange choice for things inside node_modules.

If a later version of jQuery works in IE 6-9, then I'm happy to update it ¯\_(ツ)_/¯

from es6-shim.

I'm not sure why the warning would appear at all for anyone but the developers of es6-shim (mainly me), given that jquery is a dev dependency, so consumers would never have it installed?

Additionally, like many CVEs in the JS world, this CVE is not actually a vulnerability unless it's used improperly (at which case it's a vulnerability in the thing using jQuery, not jQuery itself). In other words, this CVE should never have been filed on jQuery directly in the first place. Our use of jQuery doesn't involve unsanitized user input, so it's a false positive.

from es6-shim.

Well, I'm not really sure what whitesource has going on under the hood.

To be fair, when I did a fresh install (yarn), the file was still there.

It picked up jquery from this:

And for futher context, there's a number of in-between dependencies (Although I don't believe they'd impact what's in your node_modules folder.)

└─┬ @storybook/[email protected]
  └─┬ @storybook/[email protected]
    └─┬ [email protected]
      └── [email protected]

That being said, I very much agree with you that it's not a real vulnerability.

from es6-shim.