Skip to content
OpenAdvisories

Package · npm

@saltcorn/data

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High —
    GHSA-9237-rg5p-rhfw

    @saltcorn/data: Tenant user role is used for tenant creation role check

    ## Summary When a tenant admin is logged out of the root domain (e.g., saltcorn.com) but logged in to their own tenant space as admin, they can simply append `/tenant/create` to their tenant URL. The system reads the role from the tenant context (admin), and …

    @saltcorn/data npm
  • None 0.0
    GHSA-59xv-588h-2vmm

    @saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler

    ## Summary The `jsexprToSQL()` function in Saltcorn converts JavaScript expressions to SQL for use in database constraints. The `Literal` handler wraps string values in single quotes without escaping embedded single quotes, allowing SQL injection when creatin…

    @saltcorn/data npm