MEDIUM4.0
GHSA-cm5g-3pgc-8rg4
Express ressource injection
Quick fix
GHSA-cm5g-3pgc-8rg4 — express: upgrade to the fixed version with the command below.
npm install express@4.0.0-rc1Details
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.
The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources.
This vulnerability is especially relevant for dynamic parameters.
Are you affected?
Enter the version of the package you're using.