GHSA-9m4x-8w29-r78g
Server-Side Request Forgery in @uppy/companion
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @uppy/companion | < 1.13.2 | 1.13.2 |
| npm | @uppy/companion | >= 2.0.0-alpha.0, < 2.0.0-alpha.5 | 2.0.0-alpha.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
The @uppy/companion npm package before versions 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.
References
External links from the advisory. They lead to third-party sites.