Description
When invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the expires property is not properly checked against the current date or other date param. This can allow invocations outside of the original intended time period.
Recommendation
Update the @digitalbazaar/zcap package to the latest compatible version. Followings are version details:
- Affected version(s): < 9.0.1
- Patched version(s): 9.0.1
References
Related Issues
- Plate media plugins has a XSS in media embed element when using custom URL parsers - CVE-2024-40631
- Slim Select has potential Cross-site Scripting issue - CVE-2024-9440
- LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - CVE-2026-42349
You might also like:
- Tags:
- npm
- @digitalbazaar/zcap
Anything's wrong? Let us know Last updated on April 21, 2024