Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Depends on vulnerable versions of jQuery and Chart.js #444

Open
Joegardner20 opened this issue Oct 26, 2024 · 0 comments
Open

Depends on vulnerable versions of jQuery and Chart.js #444

Joegardner20 opened this issue Oct 26, 2024 · 0 comments

Comments

@Joegardner20
Copy link

Description:
The spark-script.js file in this project includes dependencies on two JS libraries with known security vulnerabilities: jQuery and Chart.js.

1. jQuery Dependency:
The project currently includes jQuery 3.2.1 vulnerable to CVE-2020-23064.
Affected Versions: jQuery versions >= 1.0.3 and < 3.5.0
Resolution: Update the jQuery version in jquery.js to 3.5.0 or a later secure version to mitigate this issue.

2. Chart.js Dependency:
The project uses Chart.js version 2.7.2, which is vulnerable to CVE-2020-7746.
Affected Versions: Chart.js < 2.9.4
Resolution: Update Chart.js to 2.9.4 or a later secure version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant