SEC2-053: postulo-thunderbird's dev chain locks web-ext 8.10.0 with thirteen open advisories (three critical), and CI runs no `npm audit` #13

New issue

Closed

opened 2026-10-17 10:39:36 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-17 10:39:36 +00:00

Owner

Found on 2026-10-16 in a read-only security review of postulo-thunderbird at 4a10c95, checked by a second, independent pass.

Severity: Low · Category: Dependencies · Reference: CWE-1104 (Use of Unmaintained Third Party Components); OWASP A06:2021 (Vulnerable and Outdated Components)

Location:

package.json:16-17 ("web-ext": "^8.0.0"), package-lock.json (node_modules/web-ext at 8.10.0)
.forgejo/workflows/ci.yml:19-35 (npm ci, npm test, npm run lint, npm run build; no audit step)

Issue

An npm audit run on 2026-10-16 against package-lock.json reports 13 advisories (3 critical, 7 high, 3 moderate), all in the web-ext 8.x tree (shell-quote, fx-runner, web-ext critical). The repository shares code from postulo-chromium through scripts/shared.mjs, so its only Node dependency is this tool chain, and the workflow does not audit it.

Impact

Development-time only: web-ext run --firefox thunderbird, lint and build on a contributor's machine and in CI. No shipped bytes come from these packages.

Fix

npm install --save-dev web-ext@^10.8.0 && npm audit fix (web-ext 10 needs Node >= 20), and add npm audit --audit-level=high after npm ci in ci.yml. Done when: npm audit is clean and the CI workflow fails on a new high advisory.

postulo/postulo-chromium SEC2-051 - the same chain in the Chromium extension.

Found on 2026-10-16 in a read-only security review of `postulo-thunderbird` at `4a10c95`, checked by a second, independent pass. **Severity:** Low · **Category:** Dependencies · **Reference:** CWE-1104 (Use of Unmaintained Third Party Components); OWASP A06:2021 (Vulnerable and Outdated Components) **Location:** - `package.json:16-17` (`"web-ext": "^8.0.0"`), `package-lock.json` (`node_modules/web-ext` at `8.10.0`) - `.forgejo/workflows/ci.yml:19-35` (`npm ci`, `npm test`, `npm run lint`, `npm run build`; no audit step) ## Issue An `npm audit` run on 2026-10-16 against `package-lock.json` reports 13 advisories (3 critical, 7 high, 3 moderate), all in the `web-ext` 8.x tree (`shell-quote`, `fx-runner`, `web-ext` critical). The repository shares code from postulo-chromium through `scripts/shared.mjs`, so its only Node dependency is this tool chain, and the workflow does not audit it. ## Impact Development-time only: `web-ext run --firefox thunderbird`, `lint` and `build` on a contributor's machine and in CI. No shipped bytes come from these packages. ## Fix `npm install --save-dev web-ext@^10.8.0 && npm audit fix` (web-ext 10 needs Node >= 20), and add `npm audit --audit-level=high` after `npm ci` in `ci.yml`. Done when: `npm audit` is clean and the CI workflow fails on a new high advisory. ## Related postulo/postulo-chromium SEC2-051 - the same chain in the Chromium extension.

tiagoagueda added the

bug

security

labels

2026-10-17 10:39:36 +00:00

tiagoagueda referenced this issue from Postulo/postulo

2026-10-17 10:41:23 +00:00

SEC2 index: security review of 2026-10-16 (86 issues across the core, plugins and extensions) #992

tiagoagueda referenced this issue from a commit

2026-10-19 07:09:37 +00:00

Move the development chain to web-ext 10.8 and audit it in CI

tiagoagueda referenced this issue from a pull request that will close it,