Saw this high severity notice generated by Dependabot for a few packages I have that are using airtap.

xmlhttprequest-ssl
Open GitHub opened this alert 8 hours ago
Dependabot cannot update xmlhttprequest-ssl to a non-vulnerable version
The latest possible version that can be installed is 1.5.5 because of the following conflicting dependency:

airtap@4.0.3 requires xmlhttprequest-ssl@~1.5.4 via engine.io-client@3.3.2
The earliest fixed version is 1.6.2.

View logs or learn more about troubleshooting Dependabot errors.

1 xmlhttprequest-ssl vulnerability found in package-lock.json 8 hours ago
Remediation
Upgrade xmlhttprequest-ssl to version 1.6.2 or later. For example:

"dependencies": {
"xmlhttprequest-ssl": ">=1.6.2"
}
or…
"devDependencies": {
"xmlhttprequest-ssl": ">=1.6.2"
}
Always verify the validity and compatibility of suggestions with your codebase.

Details
CVE-2020-28502
high severity
Vulnerable versions: < 1.6.2
Patched version: 1.6.2
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.