DiracX-Web is vulnerable to attack through an Open Redirect on its login page

Description

An attacker can forge a request to redirect an authenticated user to any arbitrary website.

Recommendation

Update the @dirac-grid/diracx-web-components package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.1.0-a8
• Patched version(s): 0.1.0-a8

References

• GHSA-hfj7-542q-8fvv
• CVE-2025-54066
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Axios is vulnerable to DoS attack through lack of data size check - CVE-2025-58754
• @pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation - CVE-2025-53626
• Flowise is vulnerable to arbitrary file write through its WriteFileTool - CVE-2025-61913
• Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation - materialize-css - CVE-2019-11004

You might also like:

Should I Hide My Admin Login Page? Yes, You Should!

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@dirac-grid/diracx-web-components