High security vulnerability from brace-expansion dependency when installing @percy/cli

[euanblack]

The problem

A high severity vulnerability has been introduced with the brace-expansion package that is a dependency for percy-cli:

GHSA-mh99-v99m-4gvg

npm audit fix + npm audit fix --force can't circumvent this.

When pinning the patched version in package overrides, Percy crashes when attempting to start.

added 159 packages in 8s

22 packages are looking for funding
  run `npm fund` for details
PS C:\Users\EuanBlack\source\repos\npm test repo> npm audit
npm audit report

brace-expansion  <=5.0.7
Severity: high
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
fix available via `npm audit fix --force`
Will install @percy/cli@1.31.9, which is a breaking change
node_modules/brace-expansion
node_modules/glob/node_modules/brace-expansion
  minimatch  2.0.0 - 10.0.2
  Depends on vulnerable versions of brace-expansion
  node_modules/glob/node_modules/minimatch
  node_modules/minimatch
    @percy/cli-doctor  *
    Depends on vulnerable versions of @percy/cli-command
    Depends on vulnerable versions of @percy/core
    Depends on vulnerable versions of minimatch
    node_modules/@percy/cli-doctor
      @percy/cli  1.31.10-alpha.0 - 1.32.5-beta.1
      Depends on vulnerable versions of @percy/cli-app
      Depends on vulnerable versions of @percy/cli-build
      Depends on vulnerable versions of @percy/cli-command
      Depends on vulnerable versions of @percy/cli-config
      Depends on vulnerable versions of @percy/cli-doctor
      Depends on vulnerable versions of @percy/cli-exec
      Depends on vulnerable versions of @percy/cli-snapshot
      Depends on vulnerable versions of @percy/cli-upload
      node_modules/@percy/cli
      @percy/core  *
      Depends on vulnerable versions of @percy/cli-doctor
      Depends on vulnerable versions of fast-xml-parser
      Depends on vulnerable versions of rimraf
      node_modules/@percy/core
        @percy/cli-command  1.31.15-alpha.0 - 1.32.5-beta.1
        Depends on vulnerable versions of @percy/core
        node_modules/@percy/cli-command
          @percy/cli-app  1.31.15-alpha.0 - 1.32.5-beta.1
          Depends on vulnerable versions of @percy/cli-command
          Depends on vulnerable versions of @percy/cli-exec
          node_modules/@percy/cli-app
          @percy/cli-build  1.31.15-alpha.0 - 1.32.5-beta.1
          Depends on vulnerable versions of @percy/cli-command
          node_modules/@percy/cli-build
          @percy/cli-config  1.31.15-alpha.0 - 1.32.5-beta.1
          Depends on vulnerable versions of @percy/cli-command
          node_modules/@percy/cli-config
          @percy/cli-exec  1.31.15-alpha.0 - 1.32.5-beta.1
          Depends on vulnerable versions of @percy/cli-command
          node_modules/@percy/cli-exec
          @percy/cli-snapshot  1.31.15-alpha.0 - 1.32.5-beta.1
          Depends on vulnerable versions of @percy/cli-command
          node_modules/@percy/cli-snapshot
          @percy/cli-upload  1.31.15-alpha.0 - 1.32.5-beta.1
          Depends on vulnerable versions of @percy/cli-command
          node_modules/@percy/cli-upload
    glob  4.3.0 - 10.5.0
    Depends on vulnerable versions of minimatch
    node_modules/glob
      rimraf  2.3.0 - 3.0.2 || 4.2.0 - 5.0.10
      Depends on vulnerable versions of glob
      node_modules/rimraf

fast-xml-parser  <5.7.0
Severity: moderate
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters - https://github.com/advisories/GHSA-gh4j-gqv2-49f6
fix available via `npm audit fix --force`
Will install @percy/cli@1.31.9, which is a breaking change
node_modules/fast-xml-parser

15 vulnerabilities (8 moderate, 7 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force`

Environment

• Node version: node: '20.17.0',
• @percy/cli version: 1.32.4
• Version of Percy SDK you’re using:
• If needed, a build or snapshot ID:
• OS version:
• Type of shell command-line [interface]: powershell

Steps to reproduce

1. Create new repo
2. Run npm install @percy/cli
3. Run npm audit - observe stated vulnerabilities
4. Run npm audit fix - note vulnerability still present
5. Pin v5.0.8 of brace-expansion in package.json overrides
6. Run percy exec start - note error

[prklm10]

Thanks @euanblack for raising this. We will evaluate and get back to you on this.