-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commit diff shows the framework added security wrappers around express.Response.redirect through the fixOpenRedirect function. The patch introduces allowedRedirectHosts validation and replaces the native redirect implementation. This indicates the original Express.redirect method (called via response.redirect()) was vulnerable to open redirects when handling URLs containing '://' without proper host validation. The vulnerability manifests when using the framework's unpatched redirect functionality with untrusted URL parameters.
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| oils | npm | < 8.0.0 | 8.0.0 |
Ongoing coverage of React2Shell