`react-dev-utils`: Prototype Pollution in Immer
Created by: SalGnt-Dev
Describe the bug
The react-dev-utils package uses a vulnerable version (v8.0.4) of Immer.
The fix, commit fa671e5, is part of the v9.0.6 release.
The react-dev-utils package should use this specific version of Immer.
GitHub CVE
- Prototype Pollution in immer (critical severity): CVE-2021-3757.
- Prototype Pollution in immer (high severity): CVE-2021-23436.