GHSA-h97g-4mx7-5p2p
Open Redirect in apostrophe
Versions of apostrophe prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing / were appended at the end.
Recommendation
Update to version 2.92.0 or later.
What each source reports
GitHub AdvisoriesNo score
Open Redirect in apostrophe
Versions of apostrophe prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing / were appended at the end.
Recommendation
Update to version 2.92.0 or later.
- Record
GHSA-h97g-4mx7-5p2p- Weakness
- CWE-601
- Updated
- 2026-11-02
OSVNo score
Open Redirect in apostrophe
Versions of apostrophe prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing / were appended at the end.
Recommendation
Update to version 2.92.0 or later.
- Record
GHSA-h97g-4mx7-5p2p- Weakness
- CWE-601
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apostrophenpm | before 2.92.0 | 2.92.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-h97g-4mx7-5p2p is a vulnerability with no CVSS score yet in apostrophe, published September 3, 2020. No source lists public exploit code. Fixed in apostrophe 2.92.0.