HIGH7.5

GHSA-9m4x-8w29-r78g

Server-Side Request Forgery in @uppy/companion

Quick fix

GHSA-9m4x-8w29-r78g — @uppy/companion: upgrade to the fixed version with the command below.

npm install @uppy/companion@1.13.2

Details

The @uppy/companion npm package before versions 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@uppy/companion

Introduced in: 0Fixed in: 1.13.2

Fixnpm install @uppy/companion@1.13.2

npm/@uppy/companion

Introduced in: 2.0.0-alpha.0Fixed in: 2.0.0-alpha.5

Fixnpm install @uppy/companion@2.0.0-alpha.5

References

https://nvd.nist.gov/vuln/detail/CVE-2020-8205[ADVISORY]
https://github.com/transloadit/uppy/pull/2322/commits/dbf2f4f30aeaf3bcc5971bb867bb0b5984084828[WEB]
https://hackerone.com/reports/891270[WEB]
https://github.com/transloadit/uppy/blob/master/CHANGELOG.md#1161[WEB]