| Package | Affected versions | Patched versions |
|---|---|---|
| rclone | ≥ 1.52.0, < 1.75.2 | 1.75.2 |
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free