Open redirect in karma

Description

Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.

Recommendation

Update the karma package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.3.16
• Patched version(s): 6.3.16

References

• GHSA-rc3x-jf5g-xvc5
• snyk.io
• CVE-2021-23495
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Open redirect in @auth0/nextjs-auth0 - CVE-2021-43812
• Open redirect in url-parse - url-parse - CVE-2021-3664
• Oils JS vulnerable to Open Redirect - CVE-2021-4260
• Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) - CVE-2026-42259

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

karma