Cli-table2 is a command-line tool designed to generate visually appealing Unicode tables, building upon the foundation of the original cli-table package. Version 0.1.3 arrived shortly after 0.1.2, with the newer iteration published to npm on December 21, 2014, a day after its predecessor. Both versions share identical core functionalities and dependencies, relying on the "colors" and "lodash" packages. Colors likely handles text coloration within the tables, while lodash provides utility functions for data manipulation. The development dependencies are also mirrored exactly and include tools like Chai, Sinon and Sinon-Chai which are used for testing, Coveralls for coverage reporting, Git-rev to easily access git revision data, Growl for notifications, and Gulp combined with gulp plugins for build automation and running tests.
For developers considering either version; the key takeaway is that 0.1.3 represented a refinement or bug fix over 0.1.2, not a major feature update. Users should select the latest version (0.1.3) for potential stability improvements and bug fixes, even though the changes between the two releases are seemingly minor. Both versions offer developers a convenient way to present tabular data directly in the command line, enhancing the readability and user experience of their CLI applications. The library's MIT license provides developers with the freedom to use and modify the code as needed. The package is hosted on GitHub, which is important for people who want to contribute.
All the vulnerabilities related to the version 0.1.3 of the package
Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Prototype Pollution in lodash
Versions of lodash before 4.17.11 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.17.11 or later.
Prototype Pollution in lodash
Versions of lodash before 4.17.5 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.17.5 or later.
Prototype Pollution in lodash
Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.17.12 or later.
