Critical immer vulnerability in @sanity/desk-tool - update to 9.0.6?
I can help you with this security vulnerability issue. The @sanity/desk-tool package you're seeing is from Sanity Studio v2, which reached end-of-life on April 1st, 2024, and no longer receives security updates.
The Solution: Upgrade to Studio v3+
The immer vulnerability you're experiencing (immer 9.0.6 prototype pollution advisory 1002492) was resolved when Sanity migrated to Studio v3. In Studio v3 and later:
- The package is now called
@sanity/structure(previously@sanity/desk-tool) - The Portable Text Editor was completely rewritten and no longer uses Slate (which had the immer dependency)
- These security vulnerabilities were eliminated in the process
Why You Can't Just Update immer
You can't simply update the immer dependency to 9.0.6 because:
- It's a transitive dependency (nested deep:
@sanity/desk-tool > @sanity/form-builder > @sanity/portable-text-editor > slate > immer) - The old Slate-based editor required specific immer versions
- Studio v2 is deprecated and won't receive patches for these vulnerabilities
Your Action Items
For the first vulnerability (via @sanity/desk-tool):
- Upgrade to Studio v3 or later (currently v4 is available, requiring Node.js 20+)
- The migration from v2 to v3 involves configuration changes but is well-documented in the Sanity docs
For the second vulnerability (via sanity-plugin-media):
- Check if there's an updated version of
sanity-plugin-mediacompatible with Studio v3 - Consider migrating to a v3-compatible media plugin or evaluating the official Media Library (Enterprise addon) as a first-party alternative
Temporary Workaround (Not Recommended)
If you absolutely cannot upgrade immediately, you could try using yarn resolutions to force immer to 9.0.6:
"resolutions": {
"immer": "9.0.6"
}However, this may break functionality and is not supported. The proper solution is upgrading to Studio v3 or v4, which removes these vulnerable dependencies entirely. Since Studio v2 is past its end-of-life date, continuing to use it poses ongoing security risks beyond just this immer vulnerability.
Show original thread16 replies
Sanity – Build the way you think, not the way your CMS thinks
Sanity is the developer-first content operating system that gives you complete control. Schema-as-code, GROQ queries, and real-time APIs mean no more workarounds or waiting for deployments. Free to start, scale as you grow.