I have a vulnerability scanner than detected a security vulnerability in a particular package. Let's call it package "D@4.0". D@4.0 is used by other dependencies, such as this:

A@1.0 > B@2.0 > C@3.0 > D@4.0.

Typically there's a recommended version upgrade, which is an easy fix. But in this case, there's no upgrade path for D@4.0. I'm trying to understand the actual risk this presents in my project rather than just accepting the risk, and would like to test if the reported vulnerability is exploitable. With so many other dependencies using it, how would I go about testing an exploit? Is it even possible? If not, in the above dependency "tree", which packages should I focus on upgrading?

New contributor
icdcoffee is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • I'm not sure how anyone can answer this question with all relevant details removed. This is like asking "I have an illness. I won't tell you which one or what type it is. How do I cure it? And how do I treat the symptoms I won't disclose?"
    – schroeder
    Jun 24 at 7:24


Browse other questions tagged or ask your own question.