GHSA-9m4x-8w29-r78gHighCVSS 7.5

Server-Side Request Forgery in @uppy/companion

Published
August 13, 2020
Last Modified
September 13, 2023

🔗 CVE IDs covered (1)

CVE-2020-8205 →

📋 Description

The @uppy/companion npm package before versions 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.

🎯 Affected products2

  • npm/@uppy/companion:< 1.13.2
  • npm/@uppy/companion:>= 2.0.0-alpha.0, <= 2.0.0-alpha.4

🔗 References (5)