| Package | Affected versions | Patched versions |
|---|---|---|
| nodebb | < 2.6.1 | 2.6.1 |
| nodebb | < 2.6.1 | 2.6.1 |
Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts.
Patched in 2.6.1
Site maintainers can cherry-pick https://github.com/NodeBB/NodeBB/commit/48d143921753914da45926cca6370a92ed0c46b8 into their codebase to patch the exploit.
If you have any questions or comments about this advisory:
Discuss it on our community forum Email us at [email protected]
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free