CVE-2025-54798 in tmp via inquirer and external-editor #5074
Description
The latest version of codeceptjs at the time of writing is version 3.7.3...
- which has a production dependency on
[email protected]... - which has a production dependency on
external-editor@^3.0.3, which in practice resolves to[email protected]... - which has a production dependency on
tmp@^0.0.33, which resolves to[email protected]... - which has CVE-2025-54798 in it.
tmp is patched as of [email protected], which means that external-editor needs to upgrade. Unfortunately external-editor is not maintained and no new version has appeared for about six years. This in turn means that inquirer must stop using external-editor. inquirer has indeed done this as of [email protected]. So now codeceptjs must upgrade from [email protected] to [email protected].