Question About 6 high severity vulnerabilities

[parmpreetnanrhe]

I am getting this as message in my terminal that the package contains 6 high severity vulnerabilities. Is it safe to go with this package these days.

I am new with this type of project. I am unable to understand all things mentioned about this topic on internet. Can anyone help to understand, Is it really be a problem which can lead to data loss or backend tracking.

[dave9123]

Try running npm i @svgr/webpack --save-dev

[jrjake]

See issue #11174, it is OK to ignore this warning.

[denezra]

@wfjake Hmm is there a way to fix this just to ignore it? Because this will cause to detect on my CSEC scan.

[dave9123]

Try running npm i @svgr/webpack --save-dev

Might help you :)

[denezra]

@dave9123 Still the same good sir

[dave9123]

Can I see which package? npm audit report

[denezra]

Hi @dave9123, here's the npm audit report

nth-check <2.0.1
Severity: high
Inefficient Regular Expression Complexity in nth-check - GHSA-rp65-9cf3-cjxr
fix available via npm audit fix --force
Will install react-scripts@2.1.3, which is a breaking change
node_modules/react-scripts/node_modules/nth-check
css-select <=3.1.0
Depends on vulnerable versions of nth-check
node_modules/react-scripts/node_modules/css-select
svgo 1.0.0 - 1.3.2
Depends on vulnerable versions of css-select
node_modules/react-scripts/node_modules/svgo
@svgr/plugin-svgo <=5.5.0
Depends on vulnerable versions of svgo
node_modules/react-scripts/node_modules/@svgr/plugin-svgo
@svgr/webpack 4.0.0 - 5.5.0
Depends on vulnerable versions of @svgr/plugin-svgo
node_modules/react-scripts/node_modules/@svgr/webpack
react-scripts >=2.1.4
Depends on vulnerable versions of @svgr/webpack
node_modules/react-scripts

If the Devs truly abandoned this project(Based on this discussion here) I might try to migrate to other framework like Vite, Next, or Svelte.

[dave9123]

I forgot that you need to modify your nth-check version,

"overrides": { "nth-check": "2.0.1" },

Should be something like this

[dave9123]

Here's me being confused, again