Open redirect in karma

Description

Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.

Recommendation

Update the karma package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.3.16
• Patched version(s): 6.3.16

References

• GHSA-rc3x-jf5g-xvc5
• snyk.io
• CVE-2021-23495
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Lobe Chat API Key Leak - CVE-2024-37895
• Cross-site Scripting in karma - CVE-2022-0437
• Risk of code injection - CVE-2021-21278
• Injection in op-browser - CVE-2020-7625

Tags:

npm

karma