Open redirect in karma

Description

Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.

Recommendation

Update the karma package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.3.16
• Patched version(s): 6.3.16

References

• GHSA-rc3x-jf5g-xvc5
• snyk.io
• CVE-2021-23495
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Open redirect in url-parse (GHSA-hh27-ffr2-f2jc) - CVE-2021-3664
• Open redirect in @auth0/nextjs-auth0 - CVE-2021-43812
• Oils JS vulnerable to Open Redirect - CVE-2021-4260
• Open Redirect in urijs - CVE-2022-0868

Tags:

npm

karma