openapi-generator-cli: [BUG] axios version lesser than 1.6.0 has Cross-Site Request Forgery vulnerability

⚠️ Important Notice

Please differentiate the bug

🐛 Bug Report:

Describe the bug

axios version lesser than 1.6.0 has Cross-Site Request Forgery vulnerability. This package currently has dependency on @nestjs/axios v0.1.0 which references axios v0.27.0.

Steps to Reproduce

Check axios vulnerability. https://github.com/advisories/GHSA-wf5p-g6vw-rhxx

Expected behavior

The vulnerability should be resolved by upgrading axios to version >1.6.0.

Screenshots

Operation System (please complete the following information):

OS: Windows
Version 10

Package System (please complete the following information):

Version 2.7.0 (latest)

Additional context

About this issue

Original URL
State: closed
Created 8 months ago
Reactions: 8
Comments: 20 (5 by maintainers)

Most upvoted comments

any updates please?

dutta-arnab1 on Jan 15, 2024

Any news here? Love to see it updated. Hope @wing328 can say something about this? Thank you so much for all your work @wing328!

elmarbeckmann on Jan 17, 2024

maybe this is missing: https://github.com/ndrsg/openapi-generator-cli/blob/feat/update-nestjs-axios/jest.config.js#L10

alexan on Dec 21, 2023

thanks for advice let me do this tonight

A quick and less impactful fix would be to upgrade the node version of both build and e2e environments in the build.yaml to node 18.

UR-deR on Dec 18, 2023

thanks for reviewing

agreed with updating the build to node 18

wing328 on Dec 18, 2023

Hi @wing328 , @axtx4869, I just had a look at the PR and it seems a node upgrade is required as well. A quick fix would be to update the node-version from 17.x to 18.x in the build.yaml file. However a more robust fix would be to fix all the node version inconsistencies across the project.

I can see the project now have a mixture of different node versions.

Node 12 - through nrwl/nx
Node 16 - through @types/node and e2e environment in build.yaml
Node 17 - build environment in build.yaml

A quick and less impactful fix would be to upgrade the node version of both build and e2e environments in the build.yaml to node 18.

dutta-arnab1 on Dec 18, 2023

Do we have an ETA as to when this will be fixed?

sergecpelletier on Dec 5, 2023

@kay-schecker what is missing for this to be adressed?

alexan on Nov 28, 2023

AFAIK upgrading to 2.0.0 is not enough and we need nestjs/axios 3.0.1 to get the fix. I tried to make a PR, but can’t even run yarn install on Apple Sillicon running macOS 14.1. It fails trying to run node-gyp to compile fsevents. I do not have access to an intel machine.

wvanderdeijl on Nov 16, 2023