npm/engramx: high
engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection
Action: Upgrade engramx to 2.0.2 or later.
npm i engramx@2.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.2 | - |
Fixed versions
| 2.0.2 |
Sources
- osv: GHSA-2r2p-4cgf-hv7h
- https://github.com/NickCirv/engram/security/advisories/GHSA-2r2p-4cgf-hv7h
- https://github.com/NickCirv/engram/issues/7
- https://github.com/NickCirv/engram
published · modified · JSON