CVE-2022-0086: uppy's companion module is vulnerable to… – CVSS 9.8 · Watchpost

← All vulnerabilities

uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF)

严重 9.8CVE-2022-0086 · GHSA-x8rq-rc7x-5fg5 · Published 04/01/2022 · updated 17/06/2026

要点

CVE-2022-0086 是影响 uppy (transloadit), @uppy/companion 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：1.2%，高于 69.4% 的漏洞。
修复：升级到 2.3.3, 3.1.5 或更高版本。

Package	Affected versions	Patched versions
uppy transloadit	`< 2.3.3`	`2.3.3`
@uppy/companion npm	`< 3.1.5`	`3.1.5`

Description

uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.

NVD description

uppy is vulnerable to Server-Side Request Forgery (SSRF)

References

nvd.nist.gov/vuln/detail/CVE-2022-0086 · ADVISORY
transloadit/uppy#3403 · WEB
transloadit/uppy commit fc137e3 · WEB
transloadit/uppy · WEB
transloadit/uppy release [email protected] · WEB
huntr.dev/bounties/c1c03ef6-3f18-4976-a9ad-08c251279122 · WEB

uppy 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free