-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in how urllib3 handled redirect control when operating within a Pyodide environment, specifically when that environment is Node.js. The core issue is that urllib3's parameters intended to control HTTP redirects (e.g., retries and redirect) were not being honored. Instead, the redirect behavior was dictated by the underlying JavaScript runtime (Node.js Fetch API defaults).
The function urllib3.contrib.emscripten.fetch.send_jspi_request is responsible for dispatching HTTP requests using the JavaScript fetch API in this context. The security patch (commit 7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f) modifies this function. Specifically, it adds a check to determine if the code is running in Node.js (_is_node_js()). If it is, the patch ensures that fetch_data["redirect"] = "manual" is set before calling js.fetch(...).
This explicit setting of "redirect": "manual" instructs the Node.js Fetch API not to follow redirects automatically, thereby allowing urllib3's own logic (based on retries and redirect parameters) to manage the redirect process. Before this change, the absence of this manual setting meant that send_jspi_request effectively delegated redirect handling to the Node.js runtime, bypassing urllib3's controls. This could lead to vulnerabilities like SSRF or open redirects if an application developer relied on urllib3 to disable or limit redirects, but those settings were silently ignored in the Pyodide/Node.js environment.
Therefore, send_jspi_request is identified as the vulnerable function because, prior to the patch, it did not correctly implement the user-specified redirect controls when running in Node.js via Pyodide.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| urllib3 | pip | < 2.5.0 | 2.5.0 |
Ongoing coverage of React2Shell