Description
This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators.
Recommendation
Update the firebase-tools package to the latest compatible version. Followings are version details:
- Affected version(s): < 13.6.0
- Patched version(s): 13.6.0
References
Related Issues
- PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF - CVE-2024-4367
- Marvin Attack of RSA and RSAOAEP decryption in jsrsasign - CVE-2024-21484
- TurboBoost Commands vulnerable to arbitrary method invocation - CVE-2024-28181
- Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing - CVE-2024-1899
You might also like:
- Tags:
- npm
- firebase-tools
Anything's wrong? Let us know Last updated on July 22, 2025