Security Vulnerabilities in @wordpress/scripts Dependencies: webpack-dev-server

[robrien-bcgov]

Security Vulnerabilities in @wordpress/scripts Dependencies: webpack-dev-server

Description:
Two moderate severity security vulnerabilities have been identified in the webpack-dev-server dependency (versions <=5.2.0) which is a dependency of @wordpress/scripts package used in our theme.

Current Versions:

• @wordpress/scripts: 30.20.0
• webpack-dev-server: ^5.2.2 (direct dependency)

Vulnerabilities:

1. GHSA-9jgg-88mc-972h

   • Severity: Moderate
   • Impact: Source code exposure risk for non-Chromium based browser users
   • Description: Users' source code may be stolen when accessing a malicious website using non-Chromium based browsers

2. GHSA-4v9v-hfq4-rm2v

   • Severity: Moderate
   • Impact: Source code exposure risk
   • Description: Users' source code may be stolen when accessing a malicious website

Technical Details:
The vulnerabilities are present in webpack-dev-server versions <=5.2.0. While our direct dependency on webpack-dev-server is at ^5.2.2 (which is not vulnerable), there may be a nested dependency through @wordpress/scripts that still uses a vulnerable version.

Proposed Solution:

1. Update the affected packages:
   npm audit fix --force

Note: This will install @wordpress/scripts@19.2.4, which is a breaking change from our current version (30.20.0).

Risk Assessment:

• These vulnerabilities only affect development environments where webpack-dev-server is running
• Production builds are not affected
• The vulnerability requires user interaction with a malicious website
• Impact is limited to potential source code exposure

Required Actions:

1. Review the breaking changes between @wordpress/scripts v30.20.0 and v19.2.4
2. Create a development branch for testing
3. Run the update with detailed testing of all build and development processes
4. Document any required changes to maintain compatibility

Testing Requirements:

1. Verify all npm scripts continue to function:

• build
• build:production
• lint:css
• fix:css
• lint:js
• fix:js
• start
• test:unit

Labels:

• security
• dependencies
• breaking-change

Priority: Medium
(Based on moderate severity and development-only impact)