@sync-in/server
npm7 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @sync-in/serverpage 1 of 1
- CVE-2025-67438MEDIUMCVSS 6.1EG 6.1fixed in 1.9.32026-02-20
A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an att…
- CVE-2026-41161MEDIUMCVSS 5.3EG 5.3fixed in 2.2.02026-05-08
Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate va…
- CVE-2026-47684HIGHCVSS 7.7EG 7.7fixed in 2.3.02026-06-05
Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g.…
- CVE-2026-58269HIGHCVSS 8.1EG 8.1fixed in 2.4.02026-09-21
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full acc…
- CVE-2026-58270MEDIUMCVSS 6.5EG 6.5fixed in 2.4.02026-09-21
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-b…
- CVE-2026-58271MEDIUMCVSS 6.8EG 6.8fixed in 2.4.02026-09-21
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP,…
- CVE-2026-58272MEDIUMCVSS 5.3EG 5.3fixed in 2.4.12026-09-21
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent account…
Check whether @sync-in/server is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @sync-in/server CVEs against the assets you own.
Book a Demo →