npm/shakapacker: high 7.5
Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles
Action: Upgrade shakapacker to 9.5.0 or later.
npm i shakapacker@9.5.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 9.5.0 | - |
Fixed versions
| 9.5.0 |
Sources
- osv: GHSA-96qw-h329-v5rg
- https://github.com/shakacode/shakapacker/security/advisories/GHSA-96qw-h329-v5rg
- https://github.com/shakacode/shakapacker/pull/857
- https://github.com/shakacode/shakapacker/commit/3e06781b18383c5c2857ed3a722f7b91bdc1bc0e
- https://github.com/shakacode/shakapacker
published · modified · JSON