[rush] CVE-2021-42581 (Critical) detected in ramda-0.25.0.tgz

[zumayusi]

$ npm install -g @microsoft/rush 

The previous command failed because our private npm registry blocked the download of ramda-0.27.2.tgz due to security policies triggered by CVE-2021-42581. Are there plans to upgrade the Ramda dependency to a version that resolves this vulnerability and ensures successful installation?

Vulnerability Details

Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "proto") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes

Publish Date: 2022-05-10

URL: CVE-2021-42581

[iclanton]

CVE-2021-42581 isn't resolving for me. An analysis of the current pnpm-lock in this repo using Claude:

Dependency chain

@microsoft/rush  (apps/rush)
└─ @microsoft/rush-lib  (libraries/rush-lib)
   └─ @pnpm/link-bins@5.3.25  (specifier: ~5.3.7)
        └─ ramda@0.27.2  (specifier: ^0.27.1)

A secondary path also exists via @rushstack/package-extractor (libraries/package-extractor), which has the same @pnpm/link-bins@5.3.25 dependency.

Why ramda gets installed

@pnpm/link-bins@5.3.25 declares "ramda": "^0.27.1" in its dependencies. The ^0.27.1 range means >=0.27.1 <0.28.0, so it permits 0.27.1 and 0.27.2.

Why v0.27.0 specifically would not be installed

The specifier ^0.27.1 excludes 0.27.0 — it requires at minimum 0.27.1. The lockfile resolves it to ramda@0.27.2 (the latest in the 0.27.x line). So v0.27.0 should not end up installed through this path.

If you're seeing ramda@0.27.0 somewhere, it would have to come from a different package declaring a range like ^0.27.0 or >=0.27.0. None of the current lockfile entries resolve to 0.27.0 — the two resolved versions are 0.27.2 (from @pnpm/link-bins) and 0.28.0 (from file-system-cache@1.1.0, a Storybook-related transitive dependency). Could you clarify where you're observing 0.27.0?

So, given the specifier in @pnpm/link-bins, a newer version should be installed. Is it not in a private feed you're using?

[zumayusi]

@iclanton Thank you for your reply. I checked my installation log again and confirmed that the final installed version is 0.27.2, but this version is still marked as insecure, so the private repository denied the download request. The security policy states that ramda should be updated to version 0.29.0 or higher.