What is GHSA-x8rq-rc7x-5fg5?

GHSA-x8rq-rc7x-5fg5 is a security advisory published by GitHub Security Advisories with High severity. uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF)

Which CVE IDs does GHSA-x8rq-rc7x-5fg5 cover?

GHSA-x8rq-rc7x-5fg5 covers the following CVE IDs: CVE-2022-0086. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x8rq-rc7x-5fg5?

GHSA-x8rq-rc7x-5fg5 has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

Which products are affected by GHSA-x8rq-rc7x-5fg5?

GHSA-x8rq-rc7x-5fg5 affects 1 product, including: npm/@uppy/companion:\u003c 3.1.5.

GHSA-x8rq-rc7x-5fg5HighCVSS 8.2

uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF)

Vendor

GitHub Security Advisories

Published

January 6, 2022

Last Modified

December 22, 2025

🔗 CVE IDs covered (1)

CVE-2022-0086 →

📋 Description

uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.

🎯 Affected products1

npm/@uppy/companion:< 3.1.5

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2022-0086
https://github.com/transloadit/uppy/commit/fc137e30a2a3102eb191141f280d5de20dacdf8f
https://huntr.dev/bounties/c1c03ef6-3f18-4976-a9ad-08c251279122
https://github.com/transloadit/uppy/pull/3403
https://github.com/transloadit/uppy/releases/tag/uppy%402.3.3
https://github.com/advisories/GHSA-x8rq-rc7x-5fg5