Open Redirect in apostrophe

Description

Versions of apostrophe prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing / were appended at the end.

Recommendation

Update the apostrophe package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.92.0
• Patched version(s): 2.92.0

References

• GHSA-h97g-4mx7-5p2p
• snyk.io
• www.npmjs.com
• CWE-601
• OWASP 2021-A1

Related Issues

• Prototype pollution in 101 - CVE-2021-25943
• Use-After-Free in puppeteer - CVE-2019-5786
• Open Redirect in node-forge - CVE-2022-0122
• Denial of service in three - CVE-2020-28496

Tags:

npm

apostrophe