starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Security]: Including pre-bundled libs #1304

New Issue
Open
opened 2026-04-24 23:39:07 +02:00 by adam · 0 comments
adam commented 2026-04-24 23:39:07 +02:00
Owner
Copy Link
Copy Source

Originally created by @NiclasHaderer on GitHub (Aug 5, 2023).

Describe the issue

First of all, I wanted to thank you for maintaining such a big project. I know how much work this is and I really appreciate the work you put in.

While I was browsing through your code-base I came across the libs folder and discovered that there are different pre-bundled libraries in there. I don't know why you put them there instead of pulling them from npm, but I think that they pose a serious security risk. By hiding external dependencies (like jsonwebtoken) inside your code and not put it in your package.json tools like npm audit (for all its deficiencies) cannot pick up on potential vulnerable libraries.
In addition to that putting the libraries there makes it hard for people like me, who are just looking through the code to quickly check if the bundled version has any problems.

Audiobookshelf version

v2.3.3

Originally created by @NiclasHaderer on GitHub (Aug 5, 2023). ### Describe the issue First of all, I wanted to thank you for maintaining such a big project. I know how much work this is and I really appreciate the work you put in. While I was browsing through your code-base I came across the *libs* folder and discovered that there are different pre-bundled libraries in there. I don't know why you put them there instead of pulling them from npm, but I think that they pose a serious security risk. By hiding external dependencies (like jsonwebtoken) inside your code and not put it in your package.json tools like npm audit (for all its deficiencies) cannot pick up on potential vulnerable libraries. In addition to that putting the libraries there makes it hard for people like me, who are just looking through the code to quickly check if the bundled version has any problems. ### Audiobookshelf version v2.3.3
adam added the bug label 2026-04-24 23:39:07 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#1304
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?