Description
Versions of @uppy/companion prior to 1.9.3 are vulnerable to Server-Side Request Forgery (SSRF). The get route passes the user-controlled variable req.body.url to a GET request without sanitizing the value. This allows attackers to inject arbitrary URLs and make GET requests on behalf of the server.
Recommendation
Update the @uppy/companion package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.9.3
- Patched version(s): 1.9.3
References
- GHSA-mm7r-265w-jv6f
- hackerone.com
- www.npmjs.com
- CVE-2020-8135
- CWE-918
- CAPEC-310
- OWASP 2021-A10
- OWASP 2021-A6
Related Issues
- Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571
- Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881
- Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) - CVE-2025-4643
- Vite's server.fs.deny bypassed with /. for files under project root - CVE-2025-46565
- Tags:
- npm
- @uppy/companion
Anything's wrong? Let us know Last updated on January 09, 2023