Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
CVE–2022–0235
Vulnerable dependency: node-fetch (npm) 3.0.0-beta.9
Vulnerability details
Description
URL Redirection to Untrusted Site ('Open Redirect')
NVD
GitHub
CVSS details - 6.1
References
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor · CVE-2022-0235 · GitHub Advisory Database · GitHub
NVD - CVE-2022-0235
Exposure of Sensitive Information to an Unauthorized Actor vulnerability found in node-fetch
3.1.1 release (#1451) · node-fetch/node-fetch@36e47e8 · GitHub
Create SECURITY.md by JamieSlome · Pull Request #1445 · node-fetch/node-fetch · GitHub
Potential security issue · Issue #1443 · node-fetch/node-fetch · GitHub
GitHub - node-fetch/node-fetch: A light-weight module that brings the Fetch API to Node.js
backport of #1449 by jimmywarting · Pull Request #1453 · node-fetch/node-fetch · GitHub
fix(Headers): don't forward secure headers to 3th party by jimmywarting · Pull Request #1449 · node-fetch/node-fetch · GitHub
fix(Headers): don't forward secure headers to 3th party · node-fetch/node-fetch@5c32f00 · GitHub
Related information
📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE