Description
Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cube-js | cube | >= 1.1.17, < 1.4.2, >= 1.5.0, < 1.5.13 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @cubejs-backend/server-core | >= 1.1.17, < 1.4.2 | 1.4.2 | GHSA-9vph-2hvm-x66g |
| npm | @cubejs-backend/server-core | >= 1.5.0, < 1.5.13 | 1.5.13 | GHSA-9vph-2hvm-x66g |