Packages / karma / Security

ModerateVulnerabilityGHSA-7x7c-qm48-pq9cCVE-2022-0437Published 6 Feb 2022

Cross-site Scripting in karma

Affected releases · karma

  • 6.x6.0.0 – 6.3.13Fixed in 6.3.14
  • 5.x and older0.0.0 – 5.2.3No fix, no longer updated

On 6.x, the newest line:

npm install karma@6.3.14
6.x

  1. Affected

    6.0.0 – 6.3.13

    23 releases

  2. Fixed

    6.3.14 – 6.4.4

    12 releases, latest

5.x

  1. Affected

    5.0.0 – 5.2.3

    16 releases

4.x

  1. Affected

    4.0.0 – 4.4.1

    7 releases

3.x

  1. Affected

    3.0.0 – 3.1.4

    6 releases

2.x

  1. Affected

    2.0.0 – 2.0.5

    5 releases

1.x

  1. Affected

    1.0.0 – 1.7.1

    12 releases

0.x

  1. Affected

    0.0.0 – 0.13.22

    106 releases

187 stable releases of karma, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for karma. It is read in your browser and sent nowhere.

What happens

karma prior to version 6.3.14 contains a cross-site scripting vulnerability.