I have a vulnerability scanner than detected a security vulnerability in a particular package. Let's call it package "D@4.0". D@4.0 is used by other dependencies, such as this:
A@1.0 > B@2.0 > C@3.0 > D@4.0.
Typically there's a recommended version upgrade, which is an easy fix. But in this case, there's no upgrade path for D@4.0. I'm trying to understand the actual risk this presents in my project rather than just accepting the risk, and would like to test if the reported vulnerability is exploitable. With so many other dependencies using it, how would I go about testing an exploit? Is it even possible? If not, in the above dependency "tree", which packages should I focus on upgrading?
