Vulnerabilities in Cypress 14.1.0 Binary Cache

[eddiehoffman]

Hi,

The binary cache that is downloaded for Cypress 14.1.0 appears to contain 42 vulnerabilities all located in $CYPRESS_CACHE_FOLDER/14.1.0/Cypress/resources/app/node_modules/. Is there a way that these can be patched given they are downloaded directly by Cypress?

Type	Highest Severity	Description
nodejs	critical	minimist version 0.0.8 has 2 vulnerabilities
nodejs	critical	ip version 1.1.8 has 1 vulnerability
nodejs	critical	flat version 4.1.1 has 1 vulnerability
nodejs	high	ws version 7.4.5 has 2 vulnerabilities
nodejs	high	ws version 7.5.7 has 1 vulnerability
nodejs	high	ws version 8.11.0 has 1 vulnerability
nodejs	high	unset-value version 1.0.0 has 1 vulnerability
nodejs	high	terser version 4.8.0 has 1 vulnerability
nodejs	high	squirrelly version 7.9.2 has 1 vulnerability
nodejs	high	socket.io-parser version 4.0.5 has 1 vulnerability
nodejs	high	simple-get version 3.1.0 has 1 vulnerability
nodejs	high	semver version 7.3.5 has 1 vulnerability
nodejs	high	semver version 7.3.2 has 1 vulnerability
nodejs	high	path-to-regexp version 0.1.10 has 1 vulnerability
nodejs	high	nth-check version 1.0.2 has 1 vulnerability
nodejs	high	mocha version 7.0.1 has 1 vulnerability
nodejs	high	minimatch version 3.0.4 has 1 vulnerability
nodejs	high	http-proxy-middleware version 2.0.6 has 1 vulnerability
nodejs	high	http-cache-semantics version 3.8.1 has 1 vulnerability
nodejs	high	glob-parent version 3.1.0 has 1 vulnerability
nodejs	high	glob-parent version 2.0.0 has 1 vulnerability
nodejs	high	engine.io version 5.0.0 has 2 vulnerabilities
nodejs	high	cross-spawn version 7.0.3 has 1 vulnerability
nodejs	high	cross-spawn version 6.0.5 has 1 vulnerability
nodejs	high	braces version 2.3.2 has 1 vulnerability
nodejs	high	body-parser version 1.20.0 has 1 vulnerability
nodejs	high	ansi-regex version 3.0.0 has 1 vulnerability
nodejs	medium	yargs-parser version 13.1.1 has 1 vulnerability
nodejs	medium	xml2js version 0.4.23 has 1 vulnerability
nodejs	medium	webpack version 5.88.2 has 1 vulnerability
nodejs	medium	undici version 6.21.0 has 1 vulnerability
nodejs	medium	serialize-javascript version 6.0.1 has 1 vulnerability
nodejs	medium	ramda version 0.26.1 has 1 vulnerability
nodejs	medium	phin version 2.9.3 has 1 vulnerability
nodejs	medium	micromatch version 3.1.10 has 1 vulnerability
nodejs	medium	micromatch version 4.0.6 has 1 vulnerability
nodejs	medium	hosted-git-info version 2.8.8 has 1 vulnerability
nodejs	medium	got version 8.3.2 has 1 vulnerability
nodejs	medium	clean-css version 4.2.3 has 1 vulnerability

[MikeMcC399]

@eddiehoffman

These are related to your question:

• CVE-2020-36632 reported in Trivy scan for flat dependency #27763
• CVE-2021-44906 found on trivy scan for minimist dependency #28209