MediumGHSA-cm5g-3pgc-8rg4CVE-2024-10491

Express ressource injection

Published 29 Oct 2024 · Updated 19 Dec 2024

Affected package

expressnpm
Affected
<4.0.0-rc1
Fixed in
4.0.0-rc1
Update to the fixed version for your release line, for example:npm install express@4.0.0-rc1

Details

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and <> to preload malicious resources.

This vulnerability is especially relevant for dynamic parameters.

Is GHSA-cm5g-3pgc-8rg4 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected express, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.