When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id

TRUNG BÌNH 6.3CVE-2023-35167 · GHSA-7hh3-3x64-v2g9 · Công bố 23/06/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-35167 là lỗ hổng mức TRUNG BÌNH (CVSS 6.3) ảnh hưởng remult (remult), remult.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.55%, cao hơn 46.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.20.6 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
remult remult	`< 0.20.6`	`0.20.6`
remult npm	`< 0.20.6`	`0.20.6`

Mô tả

Impact

If you used the apiPrefilter option of the @Entity decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the id of an entity instance she is not authorized to access, can gain read, update and delete access to it.

Patches

The issue is fixed in version 0.20.6

Workarounds

Set the apiPrefilter option to a filter object instead of a function.

References

If you're using a minor version < 0.20 and require a patch, please create an issue.

Mô tả của NVD

Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object instead of a function.