安装react-native-config的高严重性漏洞

Question

当我尝试在 ios 上的 React Native 项目中安装 React-Native-config 时，我总是得到相同的输出：

141 packages are looking for funding
  run `npm fund` for details

5 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

不管我怎么做

npm install react-native-config

npm i react-native-config

npm install github:lugg/react-native-config

我多次尝试从头开始重新安装我的项目。 我已经从 npm 和 github 存储库安装了react-native-config。 我已经执行了

npm audit

:

# npm audit report

ip  *
Severity: high
NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks - https://github.com/advisories/GHSA-78xj-cgh5-2h22
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/ip
  @react-native-community/cli-doctor  *
  Depends on vulnerable versions of ip
  node_modules/@react-native-community/cli-doctor
    @react-native-community/cli  >=4.13.0
    Depends on vulnerable versions of @react-native-community/cli-doctor
    Depends on vulnerable versions of @react-native-community/cli-hermes
    node_modules/@react-native-community/cli
      react-native  <=0.0.0-ffdfbbec0 || >=0.69.0-rc.0
      Depends on vulnerable versions of @react-native-community/cli
      node_modules/react-native
  @react-native-community/cli-hermes  *
  Depends on vulnerable versions of ip
  node_modules/@react-native-community/cli-hermes

5 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

我已经执行了几次

npm audit fix --force

，这让我循环重新安装不同版本的react-native。最后，它让我回到相同的输出。

Answer 1

你能解决这个问题吗？我也遇到了同样的情况，不知道为什么。