Eslint version 0.0.7 represents a minor update over its predecessor, version 0.0.6, in this early stage of development for the popular JavaScript linting tool. Both versions, built around Esprima, aim to help developers maintain consistent code styles and catch potential errors. A notable difference lies in the dependencies. While both rely on JSHint, Esprima, and Optimist, version 0.0.7 specifies a version constraint ~1.2.0 for estraverse, whereas version 0.0.6 uses a looser, non-versioned approach of just using *. This suggests a potential concern for compatibility or bug fixing with newer versions of estraverse, important for users relying on specific estraverse features. The development dependencies remain consistent, featuring Vows for testing, Sinon for mocking, JSHint for secondary linting during development, and Istanbul for code coverage reporting. The licensing remains under the MIT license, and the main author remains Nicholas C. Zakas. The core functionality, using Esprima to parse and check JavaScript code based on defined rules, likely remains similar, but the update has changed the verioning of estraverse to ~1.2.0. Developers should consider the estraverse difference if they depend upon and carefully examine their codebase when upgrading. The difference in release dates indicates a relatively short time elapsed between the two releases.
All the vulnerabilities related to the version 0.0.7 of the package
Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
