Skip to content
OpenAdvisories

Package · npm

@mockoon/cli

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.5
    CVE-2026-59149

    Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

    Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWith(staticBaseDir). That prefix t…

    mockoon mockoon @mockoon/cli @mockoon/commons-server npm
  • High 8.8
    CVE-2026-59148

    Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

    Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Con…

    mockoon mockoon @mockoon/cli @mockoon/commons-server npm
  • High 7.5
    CVE-2025-59049

    Mockoon has a Path Traversal and LFI in the static file serving endpoint

    Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented in the documentation page, where the server filename is generated via templating features from user …

    mockoon mockoon @mockoon/cli @mockoon/commons-server npm