[email protected]: The library contains critical security issues and should not be used for production!

[9mm]

Describe the bug

When installing nuxt-og-image I get this error because of some insane chain of dependencies. I don't know where in the chain the issue should be added, but considering nuxt-og-image is the actual library I care about I'm putting here.

 WARN  deprecated [email protected]: The library contains critical security issues and should not be used for production! The maintenance of the project has been discontinued. Consider migrating your code to isolated-vm.

Reproduction

No response

System / Nuxt Info

I'm using pnpm to install

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ vm2 Sandbox Escape vulnerability                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ vm2                                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=3.9.19                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ <0.0.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > [email protected] > [email protected] >          │
│                     │ [email protected] > [email protected] >               │
│                     │ [email protected] > [email protected] >        │
│                     │ [email protected] > [email protected] >            │
│                     │ [email protected] > [email protected] > [email protected]    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-cchq-frgv-rjh5      │
└─────────────────────┴────────────────────────────────────────────────────────┘

[6ixfalls]

You can use overrides in package.json for npm or resolutions for yarn - here's a reference:

• npm overrides: 6ixfalls/sixfolio@c97dcb9
• yarn resolutions: 6ixfalls/sixfolio@d49c88a

Concept TooTallNate/superagent-proxy#48 (comment) - This doesn't seem to affect functionality for my use-case.

[harlan-zw]

To give some context on this error, this is from inline-css dependency which is used to inline styles.

The inline-css implementation won't process fetch's so the vm2 code should never run.

I'd like to replace this dependency with something else but I don't have the capacity at the moment.

[aoor9]

I took care of it once, and I can contribute by doing the same to this package.

[harlan-zw]

I took care of it once, and I can contribute by doing the same to this package.

That would be amazing!

[harlan-zw]

Fixed in 2.0.27 thanks to the great work of @aoor9 🙌