Repository: create-react-app
Issue: Npx create-react-app: 8 vulnerabilities (2 moderate, 6 high) in new react app 
Labels: needs triage

PS C:\> npx create-react-app mern-stack

Creating a new React app in C:\mern-stack.

Installing packages. This might take a couple of minutes.
Installing react, react-dom, and react-scripts with cra-template...


added 1482 packages in 4m

261 packages are looking for funding
  run `npm fund` for details

Initialized a git repository.

Installing template dependencies using npm...

added 63 packages, and changed 1 package in 25s

261 packages are looking for funding
  run `npm fund` for details
Removing template package using npm...


removed 1 package, and audited 1545 packages in 6s

261 packages are looking for funding
  run `npm fund` for details

8 vulnerabilities (2 moderate, 6 high)

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

Created git commit.

Success! Created mern-stack at C:\Users\LENOVO\Desktop\programing_Files\node_Files\learing_react\mern-stack
Inside that directory, you can run several commands:

  npm start
    Starts the development server.

  npm run build
    Bundles the app into static files for production.

  npm test
    Starts the test runner.

  npm run eject
    Removes this tool and copies build dependencies, configuration files
    and scripts into the app directory. If you do this, you can’t go back!

We suggest that you begin by typing:

  cd mern-stack
  npm start

Happy hacking!

PS C:\cd .\mern-stack\
PS C:\mern-stack> npm fund        
mern-stack@0.1.0
├─┬ https://github.com/chalk/chalk?sponsor=1
│ │ └── chalk@4.1.2
│ └── https://github.com/chalk/ansi-styles?sponsor=1
│     └── ansi-styles@4.3.0, ansi-styles@5.2.0, ansi-styles@6.2.1
├── https://github.com/sponsors/jonschlinkert
│   └── picomatch@2.3.1
├── https://github.com/sponsors/sibiraj-s
│   └── ci-info@3.9.0
├── https://github.com/sponsors/ljharb
│   └── deep-equal@2.2.3, array-buffer-byte-length@1.0.1, call-bind@1.0.7, function-bind@1.1.2, define-data-property@1.1.4, gopd@1.0.1, has-property-descriptors@1.0.2, es-get-iterator@1.1.3, has-symbols@1.0.3, is-map@2.0.3, is-set@2.0.3, is-string@1.0.7, has-tostringtag@1.0.2, get-intrinsic@1.2.4, has-proto@1.0.3, is-arguments@1.1.1, is-array-buffer@3.0.4, is-date-object@1.0.5, is-regex@1.1.4, is-shared-array-buffer@1.0.3, object-is@1.1.6, define-properties@1.2.1, object.assign@4.1.5, regexp.prototype.flags@1.5.2, functions-have-names@1.2.3, side-channel@1.0.6, object-inspect@1.13.2, which-boxed-primitive@1.0.2, is-bigint@1.0.4, has-bigints@1.0.2, is-boolean-object@1.1.2, is-number-object@1.0.7, is-symbol@1.0.4, which-collection@1.0.2, is-weakmap@2.0.2, is-weakset@2.0.3, which-typed-array@1.1.15, available-typed-arrays@1.0.7, is-callable@1.2.7, object.values@1.2.0, util.promisify@1.0.1, es-abstract@1.23.3, arraybuffer.prototype.slice@1.0.3, data-view-buffer@1.0.1, data-view-byte-length@1.0.1, data-view-byte-offset@1.0.0, es-to-primitive@1.2.1, function.prototype.name@1.1.6, get-symbol-description@1.0.2, globalthis@1.0.4, is-data-view@1.0.1, is-negative-zero@2.0.3, is-typed-array@1.1.13, is-weakref@1.0.2, safe-array-concat@1.1.2, safe-regex-test@1.0.3, string.prototype.trim@1.2.9, string.prototype.trimend@1.0.8, string.prototype.trimstart@1.0.8, typed-array-byte-length@1.0.1, typed-array-byte-offset@1.0.2, typed-array-length@1.0.6, unbox-primitive@1.0.2, object.getownpropertydescriptors@2.1.8, array.prototype.reduce@1.0.7, minimist@1.2.8, resolve@2.0.0-next.5, supports-preserve-symlinks-flag@1.0.0, qs@6.11.0, array-includes@3.1.8, array.prototype.findlastindex@1.2.5, array.prototype.flat@1.3.2, array.prototype.flatmap@1.3.2, is-core-module@2.15.0, object.fromentries@2.0.8, reflect.getprototypeof@1.0.6, which-builtin-type@1.1.3, is-async-function@2.0.0, is-finalizationregistry@1.0.2, is-generator-function@1.0.10, array.prototype.findlast@1.2.5, string.prototype.matchall@4.0.11, shell-quote@1.8.1
├── https://opencollective.com/babel
│   └── @babel/core@7.24.9
├─┬ https://github.com/sponsors/gregberge
│ │ └── @svgr/webpack@5.5.0, @svgr/core@5.5.0, @svgr/plugin-jsx@5.5.0, @svgr/babel-preset@5.5.0, @svgr/babel-plugin-add-jsx-attribute@5.4.0, @svgr/babel-plugin-remove-jsx-attribute@5.4.0, @svgr/babel-plugin-remove-jsx-empty-expression@5.0.1, @svgr/babel-plugin-replace-jsx-attribute-value@5.0.1, @svgr/babel-plugin-svg-dynamic-title@5.4.0, @svgr/babel-plugin-svg-em-dimensions@5.4.0, @svgr/babel-plugin-transform-react-native-svg@5.4.0, @svgr/babel-plugin-transform-svg-component@5.5.0, @svgr/hast-util-to-babel-ast@5.5.0, @svgr/plugin-svgo@5.5.0
│ └── https://opencollective.com/core-js
│     └── core-js-compat@3.37.1, core-js-pure@3.37.1, core-js@3.37.1
├── https://opencollective.com/browserslist
│   └── browserslist@4.23.2, caniuse-lite@1.0.30001642, update-browserslist-db@1.1.0
├── https://opencollective.com/webpack
│   └── css-loader@6.11.0, css-minimizer-webpack-plugin@3.4.1, eslint-webpack-plugin@3.2.0, file-loader@6.2.0, schema-utils@3.3.0, mini-css-extract-plugin@2.9.0, postcss-loader@6.2.1, sass-loader@12.6.0, source-map-loader@3.0.2, style-loader@3.3.4, terser-webpack-plugin@5.3.10, webpack@5.93.0, webpack-dev-server@4.15.2, webpack-dev-middleware@5.3.4, schema-utils@2.7.0
├─┬ https://opencollective.com/eslint
│ │ └── eslint@8.57.0, @eslint/eslintrc@2.1.4, eslint-scope@7.2.2, eslint-visitor-keys@3.4.3, espree@9.6.1
│ ├── https://github.com/sponsors/nzakas
│ │   └── @humanwhocodes/module-importer@1.0.1
│ └── https://github.com/sponsors/isaacs
│     └── rimraf@3.0.2, glob@10.4.5, foreground-child@3.2.1, signal-exit@4.1.0, jackspeak@3.4.3, minimatch@9.0.5, path-scurry@1.11.1
├─┬ https://opencollective.com/html-webpack-plugin
│ │ └── html-webpack-plugin@5.6.0
│ └── https://github.com/fb55/htmlparser2?sponsor=1
│     └── htmlparser2@6.1.0
├── https://opencollective.com/postcss/
│   └── postcss@7.0.39, autoprefixer@10.4.19, postcss-js@4.0.1, postcss-load-config@4.0.2, postcss-nested@6.2.0
├─┬ https://opencollective.com/csstools
│ │ └── postcss-preset-env@7.8.3, @csstools/postcss-cascade-layers@1.1.1, @csstools/selector-specificity@2.2.0, @csstools/postcss-color-function@1.1.1, @csstools/postcss-font-format-keywords@1.0.1, @csstools/postcss-hwb-function@1.0.2, @csstools/postcss-ic-unit@1.0.1, @csstools/postcss-is-pseudo-class@2.0.7, @csstools/postcss-nested-calc@1.0.0, @csstools/postcss-normalize-display-values@1.0.1, @csstools/postcss-oklab-function@1.1.1, @csstools/postcss-stepped-value-functions@1.0.1, @csstools/postcss-text-decoration-shorthand@1.0.0, @csstools/postcss-trigonometric-functions@1.0.2, @csstools/postcss-unset-value@1.0.2, cssdb@7.11.2, postcss-attribute-case-insensitive@5.0.2, postcss-color-functional-notation@4.2.4, postcss-color-hex-alpha@8.0.4, postcss-color-rebeccapurple@7.1.1, postcss-custom-media@8.0.2, postcss-custom-properties@12.1.11, postcss-custom-selectors@6.0.3, postcss-dir-pseudo-class@6.0.5, postcss-double-position-gradients@3.1.2, postcss-gap-properties@3.0.5, postcss-image-set-function@4.0.7, postcss-lab-function@4.2.1, postcss-nesting@10.2.0, postcss-overflow-shorthand@3.0.4, postcss-place@7.0.5, postcss-pseudo-class-any-link@7.1.6, postcss-selector-not@6.0.1
│ └── https://ko-fi.com/mrcgrtz
│     └── postcss-opacity-percentage@1.1.3
├── https://github.com/sponsors/mdevils
│   └── html-entities@2.5.2
├── https://github.com/chalk/supports-color?sponsor=1
│   └── supports-color@8.1.1
├── https://github.com/avajs/find-cache-dir?sponsor=1
│   └── find-cache-dir@3.3.2
├── https://opencollective.com/typescript-eslint
│   └── @typescript-eslint/eslint-plugin@5.62.0, @typescript-eslint/scope-manager@5.62.0, @typescript-eslint/types@5.62.0, @typescript-eslint/visitor-keys@5.62.0, @typescript-eslint/type-utils@5.62.0, @typescript-eslint/typescript-estree@5.62.0, @typescript-eslint/utils@5.62.0, @typescript-eslint/parser@5.62.0, @typescript-eslint/experimental-utils@5.62.0
├── https://github.com/sindresorhus/emittery?sponsor=1
│   └── emittery@0.10.2
├── https://github.com/sindresorhus/execa?sponsor=1
│   └── execa@5.1.1
├─┬ https://github.com/chalk/strip-ansi?sponsor=1
│ │ └── strip-ansi@7.1.0
│ └── https://github.com/chalk/ansi-regex?sponsor=1
│     └── ansi-regex@6.0.1
├── https://opencollective.com/immer
│   └── immer@9.0.21
└── https://paulmillr.com/funding/
    └── chokidar@3.6.0

PS C:\mern-stack> npm install react-scripts@latest

up to date, audited 1545 packages in 4s

261 packages are looking for funding
  run `npm fund` for details

8 vulnerabilities (2 moderate, 6 high)

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.
PS C:\mern-stack> npm audit
# npm audit report

nth-check  <2.0.1
Severity: high
Inefficient Regular Expression Complexity in nth-check - https://github.com/advisories/GHSA-rp65-9cf3-cjxr
fix available via `npm audit fix --force`
Will install react-scripts@3.0.1, which is a breaking change
node_modules/svgo/node_modules/nth-check
  css-select  <=3.1.0
  Depends on vulnerable versions of nth-check
  node_modules/svgo/node_modules/css-select
    svgo  1.0.0 - 1.3.2
    Depends on vulnerable versions of css-select
    node_modules/svgo
      @svgr/plugin-svgo  <=5.5.0
      Depends on vulnerable versions of svgo
      node_modules/@svgr/plugin-svgo
        @svgr/webpack  4.0.0 - 5.5.0
        Depends on vulnerable versions of @svgr/plugin-svgo
        node_modules/@svgr/webpack
          react-scripts  >=2.1.4
          Depends on vulnerable versions of @svgr/webpack
          Depends on vulnerable versions of resolve-url-loader
          node_modules/react-scripts

postcss  <8.4.31
Severity: moderate
PostCSS line return parsing error - https://github.com/advisories/GHSA-7fh5-64p2-3v2j
fix available via `npm audit fix --force`
Will install react-scripts@3.0.1, which is a breaking change
node_modules/resolve-url-loader/node_modules/postcss
  resolve-url-loader  0.0.1-experiment-postcss || 3.0.0-alpha.1 - 4.0.0
  Depends on vulnerable versions of postcss
  node_modules/resolve-url-loader

8 vulnerabilities (2 moderate, 6 high)

To address all issues (including breaking changes), run:
  npm audit fix --force