@budibase/backend-core vulnerabilities (npm)
6 vulnerabilities.
-
@budibase/backend-corenpm Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation 8.5 High -
@budibase/backend-corenpm Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker 6.5 Medium -
@budibase/backend-corenpm Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour 4.2 Medium -
@budibase/backend-corenpm Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover 8.1 High -
@budibase/backend-corenpm Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints 9.1 Critical -
@budibase/backend-corenpm Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist 9.6 Critical