Skip to content
OpenAdvisories

Product · actions

http-client

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.3
    CVE-2020-11021

    HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client

    Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an…

    actions http-client @actions/http-client npm