CVE-2024-34706

npm/@valtimo/components CVE-2024-34706: critical 9.8

@valtimo/components exposes access token to form.io

Action: Upgrade @valtimo/components to 10.8.4 or later.

npm i @valtimo/components@10.8.4

npm i @valtimo/components@11.1.6

npm i @valtimo/components@11.2.2

Affected

Fixed versions

Sources

• osv: GHSA-xcp4-62vj-cq3r
• https://github.com/valtimo-platform/valtimo-frontend-libraries/security/advisories/GHSA-xcp4-62vj-cq3r
• https://nvd.nist.gov/vuln/detail/CVE-2024-34706
• https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/1aaba5ef5750dafebbc7476fb08bf2375a25f19e
• https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/8c2dbf2a41180d2b0358d878290e4d37168f0fb6
• https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/d65e05fd2784bd4a628778b34a5b79ce2f0cef8c
• https://github.com/valtimo-platform/valtimo-frontend-libraries

CVE-2024-34706 · published 2024-05-13T16:04:55Z · modified 2026-09-10T03:50:14.583142712Z · JSON