Open redirect in karma

Description

Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.

Recommendation

Update the karma package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.3.16
• Patched version(s): 6.3.16

References

• GHSA-rc3x-jf5g-xvc5
• snyk.io
• CVE-2021-23495
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Open redirect in url-parse - url-parse - CVE-2021-3664
• Qwik City Open Redirect via fixTrailingSlash - CVE-2026-25149
• Open Redirect in url-parse - CVE-2018-3774
• ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header - CVE-2026-55087

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

karma