SEC2-051: postulo-chromium's dev chain locks web-ext 8.10.0 with sixteen open advisories (three critical), and CI runs no `npm audit` #32

New issue

Closed

opened 2026-10-17 10:39:33 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-17 10:39:33 +00:00

Owner

Found on 2026-10-16 in a read-only security review of postulo-chromium at b6c1009, checked by a second, independent pass.

Severity: Low · Category: Dependencies · Reference: CWE-1104 (Use of Unmaintained Third Party Components); OWASP A06:2021 (Vulnerable and Outdated Components)

Location:

package.json:16-18 ("web-ext": "^8.0.0", "jsdom": "^30.0.1"), package-lock.json (node_modules/web-ext at 8.10.0)
.forgejo/workflows/ci.yml:19-35 (npm ci, npm test, npm run build, npx web-ext lint, npm run package; no audit step)

Issue

An npm audit run on 2026-10-16 against package-lock.json reports 16 advisories (3 critical, 9 high, 4 moderate), all in the web-ext 8.x tree (shell-quote and fx-runner critical; adm-zip, node-forge, tmp, image-size, addons-linter, firefox-profile, @devicefarmer/adbkit high; ajv, uuid, node-notifier, fast-uri moderate), plus brace-expansion and source-map-js with direct fixes. npm's fix is web-ext@10.8.0 (semver-major) and npm audit fix for the rest. Nothing in the extension's shipped bundle comes from these packages: scripts/build.mjs copies the extension's own sources and web-ext build only zips them, so this is the tool chain that runs on a contributor's machine and in CI. The core's own CI audits its Node tree (postulo/postulo .forgejo/workflows/ci.yml, "Audit the asset build's Node dependencies", npm audit --audit-level=high); this workflow does not.

Impact

web-ext run, lint and build execute these packages on the developer's machine against the extension's files and, through fx-runner/shell-quote, build command lines from paths and profile names; a malicious path or a compromised transitive release reaches the contributor, not a Postulo instance or a user of the extension. Development-time only, hence Low.

Fix

npm install --save-dev web-ext@^10.8.0 && npm audit fix (web-ext 10 needs Node >= 20, which CI has), then diff the npm run package output against the current zip once, since the web-ext build major may change file ordering or exclusions; add npm audit --audit-level=high after npm ci in ci.yml. Done when: npm audit is clean and the CI workflow fails on a new high advisory.

postulo/postulo-firefox#1 (closed) - touched the CI of both extensions (artifact action, reproducible builds), not the audit. No issue in this repository names web-ext or npm audit.

Found on 2026-10-16 in a read-only security review of `postulo-chromium` at `b6c1009`, checked by a second, independent pass. **Severity:** Low · **Category:** Dependencies · **Reference:** CWE-1104 (Use of Unmaintained Third Party Components); OWASP A06:2021 (Vulnerable and Outdated Components) **Location:** - `package.json:16-18` (`"web-ext": "^8.0.0"`, `"jsdom": "^30.0.1"`), `package-lock.json` (`node_modules/web-ext` at `8.10.0`) - `.forgejo/workflows/ci.yml:19-35` (`npm ci`, `npm test`, `npm run build`, `npx web-ext lint`, `npm run package`; no audit step) ## Issue An `npm audit` run on 2026-10-16 against `package-lock.json` reports 16 advisories (3 critical, 9 high, 4 moderate), all in the `web-ext` 8.x tree (`shell-quote` and `fx-runner` critical; `adm-zip`, `node-forge`, `tmp`, `image-size`, `addons-linter`, `firefox-profile`, `@devicefarmer/adbkit` high; `ajv`, `uuid`, `node-notifier`, `fast-uri` moderate), plus `brace-expansion` and `source-map-js` with direct fixes. npm's fix is `web-ext@10.8.0` (semver-major) and `npm audit fix` for the rest. Nothing in the extension's shipped bundle comes from these packages: `scripts/build.mjs` copies the extension's own sources and `web-ext build` only zips them, so this is the tool chain that runs on a contributor's machine and in CI. The core's own CI audits its Node tree (postulo/postulo `.forgejo/workflows/ci.yml`, "Audit the asset build's Node dependencies", `npm audit --audit-level=high`); this workflow does not. ## Impact `web-ext run`, `lint` and `build` execute these packages on the developer's machine against the extension's files and, through `fx-runner`/`shell-quote`, build command lines from paths and profile names; a malicious path or a compromised transitive release reaches the contributor, not a Postulo instance or a user of the extension. Development-time only, hence Low. ## Fix `npm install --save-dev web-ext@^10.8.0 && npm audit fix` (web-ext 10 needs Node >= 20, which CI has), then diff the `npm run package` output against the current zip once, since the `web-ext build` major may change file ordering or exclusions; add `npm audit --audit-level=high` after `npm ci` in `ci.yml`. Done when: `npm audit` is clean and the CI workflow fails on a new high advisory. ## Related postulo/postulo-firefox#1 (closed) - touched the CI of both extensions (artifact action, reproducible builds), not the audit. No issue in this repository names `web-ext` or `npm audit`.

tiagoagueda added the

bug

security

labels

2026-10-17 10:39:34 +00:00

tiagoagueda referenced this issue from Postulo/postulo

2026-10-17 10:41:23 +00:00

SEC2 index: security review of 2026-10-16 (86 issues across the core, plugins and extensions) #992

tiagoagueda referenced this issue from a pull request that will close it,

2026-10-18 18:28:07 +00:00

Fix the open bug and security issues #40

tiagoagueda referenced this issue from a commit