~ / search / GHSA-x2rg-q646-7m2v

GHSA-x2rg-q646-7m2v

Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-32379

Packages

EcosystemPackageAffectedFixed in
npm koa < 2.16.1 2.16.1
npm koa >= 3.0.0-alpha.1, < 3.0.0-alpha.5 3.0.0-alpha.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. ### Patches This issue is patched in 2.16.1 and 3.0.0-alpha.5. ### PoC Coming soon... ### Impact 1. Redirect user to another phishing site 2. Make request to another endpoint of the application based on user's cookie 3. Steal user's cookie

References

External links from the advisory. They lead to third-party sites.