crypto-js weakness

[jprtf]

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.

The current version in on drawio is 3.1.2.

Shouldn't this be addressed?

More info:

• GHSA-3w3w-pxmm-2w2j
• https://nvd.nist.gov/vuln/detail/CVE-2020-36732

[davidjgraph]

Thanks for the report. Looking through our usage this doesn't cause a security issue based on these reports. We'll update the library, though, as a matter of course.

[davidjgraph]

To follow up, we won't be updating, as we have a custom, stripped down 3.1.2 build that does not contain the random function causing the problem here. So, the manifest will indicate 3.1.2, but that's mostly not the case.

[jprtf]

Understood. Thank you David!