Potential exposure of tokens to an Unauthorized Actor

Description

When using this library as a way to programmatically communicate with Replit in a standalone fashion, if there are multiple failed attempts to contact Replit through a WebSocket, the library will attempt to communicate using a fallback poll-based proxy.

Recommendation

Update the @replit/crosis package to the latest compatible version. Followings are version details:

• Affected version(s): < 7.3.1
• Patched version(s): 7.3.1

References

• GHSA-7w54-gp8x-f33m
• CVE-2022-21671
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Exposure of Sensitive Information to an Unauthorized Actor in nanoid - CVE-2021-23566
• Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy - CVE-2022-31070
• Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy - CVE-2022-31069
• @kilocode/cli Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor - CVE-2026-8766

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@replit/crosis