Description
This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators.
Recommendation
Update the firebase-tools package to the latest compatible version. Followings are version details:
- Affected version(s): < 13.6.0
- Patched version(s): 13.6.0
References
Related Issues
- Nuxt vulnerable to remote code execution via the browser when running the test locally - CVE-2024-34344
- es5-ext vulnerable to Regular Expression Denial of Service in `function#copy` and `function#toStringTokens` - CVE-2024-27088
- node-gettext vulnerable to Prototype Pollution - CVE-2024-21528
- Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server - CVE-2024-11023
You might also like:
- Tags:
- npm
- firebase-tools
Anything's wrong? Let us know Last updated on July 22, 2025