# Security vulnerabilities in child dependencies

**URL:** <https://discourse.nodered.org/t/security-vulnerabilities-in-child-dependencies/46876>\
**Category:** Core Development\
**Created:** [8 June 2021 21:14 UTC](https://discourse.nodered.org/t/security-vulnerabilities-in-child-dependencies/46876 "2021-06-08T21:14:01Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmholzinger](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/jmholzinger/32/43085_2.png) [@jmholzinger](https://discourse.nodered.org/u/jmholzinger)\
**Post date:** [8 June 2021 21:14 UTC](https://discourse.nodered.org/t/security-vulnerabilities-in-child-dependencies/46876/1 "2021-06-08T21:14:02Z")

</div>

How can I report and track vulnerabilities related to dependencies of the Node-RED project? My organization uses [OWASP Dependency-Check](https://owasp.org/www-project-dependency-check/) to scan our projects for vulnerabilities. This is flagging the `css-what` dependency, which is a grandchild dependency of `node-red`.

```auto
+-- node-red@1.3.4
| +-- @node-red/nodes@1.3.4
| | +-- cheerio@0.22.0
| | | +-- css-select@1.2.0
| | | | +-- css-what@2.1.3

```

> **[npm](https://www.npmjs.com/advisories/1754)**

On Github there is documentation for reporting security vulnerabilities, but I figure that is for reporting security vulnerabilities in the Node-RED source code, rather than a dependency. Since I cannot override the version of `css-what` that gets resolved in the dependency tree it would be useful to know if/when Node-RED will upgrade the necessary dependencies to non-vulnerable versions.

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [8 June 2021 21:30 UTC](https://discourse.nodered.org/t/security-vulnerabilities-in-child-dependencies/46876/2 "2021-06-08T21:30:07Z")

</div>

Fix in dev branch - [Update to latest cheerio module · node-red/node-red@dbbdd3f · GitHub](https://github.com/node-red/node-red/commit/dbbdd3f799da64c03e0ace54e162a42c396a0aef)

---

<div class="post-metadata">

**Author:** ![jmholzinger](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/jmholzinger/32/43085_2.png) [@jmholzinger](https://discourse.nodered.org/u/jmholzinger)\
**Post date:** [8 June 2021 21:39 UTC](https://discourse.nodered.org/t/security-vulnerabilities-in-child-dependencies/46876/3 "2021-06-08T21:39:20Z")

</div>

Great! Is this expected to land in the next release? At a glance it looks like it is slated for 2.0

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [8 June 2021 21:51 UTC](https://discourse.nodered.org/t/security-vulnerabilities-in-child-dependencies/46876/4 "2021-06-08T21:51:34Z")

</div>

The vulnerable package is three levels deep so it partly depends on what the intermediate modules choose to do about it.

The update to the `cheerio` module is a major version change. As it stands, it is slated for the imminent 2.0 release.

We may be able to back port the fix to the 1.x branch - it depends on whether we've successfully coded around the api changes in the cheerio module. Given we only found out about the issue earlier today, it's too early to say.

---

<div class="post-metadata">

**Author:** ![jmholzinger](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/jmholzinger/32/43085_2.png) [@jmholzinger](https://discourse.nodered.org/u/jmholzinger)\
**Post date:** [8 June 2021 21:58 UTC](https://discourse.nodered.org/t/security-vulnerabilities-in-child-dependencies/46876/5 "2021-06-08T21:58:48Z")

</div>

I see, at this point I'm just gathering information to bring back to the product stakeholders at my organization so that we can document and justify the existence of this vulnerability in the product we ship. There is no expectation for the fix to be available immediately. I will check back periodically to see when the "cheerio" upgrade lands. Thank you!

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [8 June 2021 22:46 UTC](https://discourse.nodered.org/t/security-vulnerabilities-in-child-dependencies/46876/6 "2021-06-08T22:46:50Z")

</div>

For more context, the cheerio module is only used in the HTML node. So the vulnerability is only possibly relevant if you are using that node. Even then, it will depend on the very specific scenario of the vulnerability to know if it's even possible to exercise from within Node-RED. Again, all too early to say. Given the limited resources we have, I'm not sure how much more we will be able to say given it'll be resolved in 2.0.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [7 August 2021 22:47 UTC](https://discourse.nodered.org/t/security-vulnerabilities-in-child-dependencies/46876/7 "2021-08-07T22:47:19Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.