[Security] Vulnerability in fstream

[TimoWestland]

Security risk found in fstream package

See: https://www.npmjs.com/advisories/886

• NPM version: 6.5.0 (yarn v1.15.2)
• Node version: 10.13.0
• node-sass version: 4.12.0

Output from yarn audit:

┌───────────────┬─────────────────────────────────────────────────────────────
│ high          │ Arbitrary File Overwrite                                     │
├───────────────┼─────────────────────────────────────────────────────────────
│ Package       │ fstream                                                      │
├───────────────┼─────────────────────────────────────────────────────────────
│ Patched in    │ >=1.0.12                                                     │
├───────────────┼─────────────────────────────────────────────────────────────
│ Dependency of │ node-sass                                                    │
├───────────────┼────────────────────────────────────────────────────────────
│ Path          │ node-sass > node-gyp > fstream                               │
├───────────────┼─────────────────────────────────────────────────────────────
│ More info     │ https://www.npmjs.com/advisories/886                         │
└───────────────┴─────────────────────────────────────────────────────────────

[laboua]

Hello I have the same problem , I hope it will been resolved as soon as possible 💃

[nschonni]

node-gyp doesn't pin to a particular version of fsstream https://github.com/nodejs/node-gyp/blob/9a404d6d36dcf9c7be2ae9963019c4d89bbb9155/package.json#L25
Clean your node modules/reinstall to get an unnaffected version.
There is nothing to be be done in node-sass

[protonate]

A bump of node-gyp to v4.0.0 will remove fstream dependency, see: #2681

[xzyfer]

This PR clearly states why a PR is not required.

[chagar]

For anyone else having this problem:

(Long story short: yarn seems to get confused when upgrading fstream and tar. Upgrading them with explicit versions/tags fixes it.)

node-gyp also pins to an old version of tar (^2.0.0), which depends on the insecure version of fstream. However, node-tar released a new version of this ancient branch, to fix the vulnerability (2.2.2). Thus, upgrading tar will fix the problem.

However, when I run yarn upgrade tar, it does not upgrade tar to 2.2.2. Probably, yarn finds it cannot upgrade to the latest version 4.x because of dependencies, and then gives up. But, upgrading tar worked when I ran yarn upgrade tar@^2.0.0. In addition, I had to do the same thing with fstream, because node-gyp does depend on fstream (run yarn upgrade fstream@^1.0.0). This strategy fixed the security vulnerability for me. (However, it does add new lines to your package.json, explicitly requiring tar and fstream. You can safely remove these lines.)