| Package | Affected versions | Patched versions |
|---|---|---|
| pubnet | < 1.1.4 | 1.1.4 |
PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain attacks. This issue has been patched in version 1.1.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free