Description
Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application’s Content Security Policy (CSP). The package’s browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy.
Recommendation
Update the helmet-csp package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.2.2, < 2.9.1
- Patched version(s): 2.9.1
References
Could your website be exposed too?
SmartScanner can check your website for Configuration Override in helmet-csp and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization - Vulnerability
- Insecure Default Configuration in tesseract.js - Vulnerability
- angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend - CVE-2023-28444
- Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023