medium4.0
CVE-2024-10491
Express ressource injection
Impact
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | express | <= 3.21.4 | 4.0.0-rc1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openjsf | Express | from 3.0.0 before 3.21.5 |