CSRF vulnerability in save-server

Description

Versions prior to version v1.05 are affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version v1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version.

This is patched by implementing Double submit.

Recommendation

Update the save-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.5
• Patched version(s): 1.0.7

References

• GHSA-wwrj-35w6-77ff
• medium.com
• www.npmjs.com
• CVE-2020-15135
• CWE-352
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• systeminformation command injection vulnerability - CVE-2020-7752
• engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt i - Vulnerability
• Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability - CVE-2025-15104
• ua-parser-js Regular Expression Denial of Service vulnerability - CVE-2020-7793

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

How to Secure your NodeJs Express Javascript Application - part 1

Tags:

npm

save-server