Diavante vue-storefront-api and storefront-api disclose stack trace

MEDIUM 5.3CVE-2020-11883 · GHSA-9wxj-37p8-49ff · Published 17/04/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
storefront-api divante	`= 1.0`	No fix yet
vue-storefront-api divante	`≤ 1.11.1`	No fix yet
storefront-api npm	`< 1.0.0-rc3`	`1.0.0-rc3`
vue-storefront-api npm	`< 1.12.0`	`1.12.0`

Description

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-11883 · ADVISORY
DivanteLtd/storefront-api#59 · WEB
DivanteLtd/vue-storefront-api#431 · WEB
vuestorefront/storefront-api commit 9165b80 · WEB
vuestorefront/vue-storefront-api commit 965247f · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free