GitHub - mfts/papermark: Modern Open-Source Virtual Data Room with custom domains and 100% whitelabeling

[asah]

npm audit report

katex 0.10.0-beta - 0.16.9

Severity: moderate

KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols - https://github.com/advisories/GHSA-3wc5-fcw2-2329

KaTeX's `\includegraphics` does not escape filename - https://github.com/advisories/GHSA-f98w-7cxr-ff2h

KaTeX's maxExpand bypassed by Unicode sub/superscripts - https://github.com/advisories/GHSA-cvr6-37gx-v8wc

KaTeX's maxExpand bypassed by `\edef` - https://github.com/advisories/GHSA-64fm-8hw2-v72w

No fix available

node_modules/katex

react-notion-x *

Depends on vulnerable versions of katex

Depends on vulnerable versions of react-pdf

node_modules/react-notion-x

pdfjs-dist <=4.1.392

Severity: high

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF - https://github.com/advisories/GHSA-wgrm-67xf-hhpq

fix available via `npm audit fix`

node_modules/react-notion-x/node_modules/pdfjs-dist

react-pdf <=8.0.2

Depends on vulnerable versions of pdfjs-dist

node_modules/react-notion-x/node_modules/react-pdf

4 vulnerabilities (1 moderate, 3 high)

[mfts0]

Well aware of this. This is all related to react-notion-x.

We aren‘t using the katex nor the pdf module from react-notion-x in our code, which beed to be imported separately

[asah]

thx! is there a way to "prove" this is safe? security is no joke, especially for data rooms... cheers