npm/@redwoodjs/api: high 8.2
Redwood is vulnerable to account takeover via dbAuth "forgot-password"
Action: Upgrade @redwoodjs/api to 2.2.5 or later.
npm i @redwoodjs/api@2.2.5npm i @redwoodjs/api@3.3.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.38.0 | 2.2.5 | - |
| 3.0.0 | 3.3.1 | - |
Fixed versions
| 2.2.5 | 3.3.1 |
Sources
- osv: GHSA-3qmc-2r76-4rqp
- https://github.com/redwoodjs/redwood/security/advisories/GHSA-3qmc-2r76-4rqp
- https://github.com/redwoodjs/redwood/issues/6343
- https://github.com/redwoodjs/redwood/pull/6778
- https://github.com/redwoodjs/redwood
- https://github.com/redwoodjs/redwood/releases/tag/v2.2.5
- https://github.com/redwoodjs/redwood/releases/tag/v3.3.1
published · modified · JSON