Skip to content
OpenAdvisories

Package · npm

@logto/tunnel

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.7
    CVE-2026-63188

    logto-tunnel serves files outside --experience-path via path traversal

    Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through p…

    logto-io logto @logto/tunnel npm