Oils JS vulnerable to Open Redirect

Description

A vulnerability was found in oils-js. This vulnerability affects unknown code of the file core/Web.js. The manipulation leads to open redirect and the attack can be initiated remotely. The name of the patch is fad8fbae824a7d367dacb90d56cb02c5cb999d42. It is recommended to apply a patch to fix this issue.

Recommendation

Update the oils package to the latest compatible version. Followings are version details:

• Affected version(s): < 8.0.0
• Patched version(s): 8.0.0

References

• GHSA-v279-v2xm-whq9
• vuldb.com
• web.archive.org
• CVE-2021-4260
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Open redirect in @auth0/nextjs-auth0 - CVE-2021-43812
• Open redirect in url-parse (GHSA-hh27-ffr2-f2jc) - CVE-2021-3664
• Open redirect in karma - CVE-2021-23495
• undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect - CVE-2022-31151

Tags:

npm

oils