13.3.8 build_angular uses vulnerable terser 5.11.0: CVE-2022-25858

[SymbioticKilla]

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25858

Hi,

is it possible to update terser in 13.3.x branch?
https://github.com/angular/angular-cli/blob/13.3.x/packages/angular_devkit/build_angular/package.json

Thanks!

[andreea-suditu]

Any updates on this issue?

[alan-agius4]

While this vulnerability doesn't apply to the Angular CLI as we don't expect maliciously crafted JS to be passed during the build

We will be updating the version of terser in version 12 and 13.