Skip to content
OpenAdvisories

Package · npm

formio

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.7
    CVE-2025-67718

    Formio improperly authorized permission elevation through specially crafted request path

    Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. A…

    formio formio formio npm
  • Critical 9.8
    CVE-2020-28246

    Server-Side Template Injection in formio

    A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. NOTE: the email templating service was removed after 2020. Additionally, the vendor disputes this i…

    formio npm