Description
The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | uppy | Fixed Versions: 1.13.2, 2.0.0-alpha.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @uppy/companion | < 1.13.2 | 1.13.2 | GHSA-9m4x-8w29-r78g |
| npm | @uppy/companion | >= 2.0.0-alpha.0, < 2.0.0-alpha.5 | 2.0.0-alpha.5 | GHSA-9m4x-8w29-r78g |