uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF)
- Severity:
- High
Description
uppy’s companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.
Recommendation
Update the uppy package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.3.3
- Patched version(s): 2.3.3
References
Related Issues
- @sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params - CVE-2025-32388
- MongoDB Shell may be susceptible to control character injection via pasting - CVE-2025-1692
- Strapi's field level permissions not being respected in relationship title - CVE-2023-37263
- Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS - CVE-2024-45812
- Tags:
- npm
- uppy
Anything's wrong? Let us know Last updated on February 03, 2023