npm/@saltcorn/server: critical 9.6

Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE

Action: Upgrade @saltcorn/server to 1.5.0-beta.19 or later.

npm i @saltcorn/server@1.5.0-beta.19

Affected

Fixed versions

Sources

• osv: GHSA-cr3w-cw5w-h3fj
• https://github.com/saltcorn/saltcorn/security/advisories/GHSA-cr3w-cw5w-h3fj
• https://github.com/saltcorn/saltcorn/commit/1bf681e08c45719a52afcf3506fb5ec59f4974d5
• https://github.com/saltcorn/saltcorn
• https://github.com/saltcorn/saltcorn/blob/020893c0001678fd5ebd2c088ba68b395de1aabc/packages/saltcorn-admin-models/models/backup.ts#L381-L382
• https://github.com/saltcorn/saltcorn/blob/020893c0001678fd5ebd2c088ba68b395de1aabc/packages/server/routes/admin.js#L4886-L4887

published 2026-01-26T23:34:49Z · modified 2026-02-03T03:07:43.305257Z · JSON