GHSA-v82v-rq72-phq9HighCVSS 8.6

Server side request forgery in @isomorphic-git/cors-proxy

Published
January 26, 2022
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2021-23664 →

📋 Description

The package @isomorphic-git/cors-proxy before 2.7.1 is vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.

🎯 Affected products1

  • npm/@isomorphic-git/cors-proxy:< 2.7.1

🔗 References (4)