You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. The issue has been patched in release 11.1.0.
CVE-2021-37699 - Medium Severity Vulnerability
Vulnerable Library - next-10.2.3.tgz
The React Framework
Library home page: https://registry.npmjs.org/next/-/next-10.2.3.tgz
Path to dependency file: /tilt_modules/tilt_inspector/package.json
Path to vulnerable library: /tilt_modules/tilt_inspector/node_modules/next/package.json
Dependency Hierarchy:
Found in HEAD commit: db90168d76823eb927283f83cb3173cd9cf16599
Found in base branch: master
Vulnerability Details
Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. The issue has been patched in release 11.1.0.
Publish Date: 2021-08-12
URL: CVE-2021-37699
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-vxf5-wxwp-m7g9
Release Date: 2021-08-12
Fix Resolution (next): 11.0.1-canary.0
Direct dependency fix Resolution (@tilt.dev/tilt-inspector): 0.1.8
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: