| Package | Affected versions | Patched versions |
|---|---|---|
| @perfood/couch-auth | ≤ 0.21.2 |
A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free