Skip to content
OpenAdvisories

Package · npm

hfs

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low —
    GHSA-xcxh-6cv4-q8p8

    HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit

    ### Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with `target="_blank"` but without the `rel="noopener noreferrer"` attribute. This allows the opened page to use the `window.opener` property to change the location of t…

    hfs npm