Packages / karma / Security

ModerateVulnerabilityGHSA-rc3x-jf5g-xvc5CVE-2021-23495Published 26 Feb 2022

Open redirect in karma

Affected releases · karma

  • 6.x6.0.0 – 6.3.15Fixed in 6.3.16
  • 5.x and older0.0.0 – 5.2.3No fix, no longer updated

On 6.x, the newest line:

npm install karma@6.3.16
6.x

  1. Affected

    6.0.0 – 6.3.15

    25 releases

  2. Fixed

    6.3.16 – 6.4.4

    10 releases, latest

5.x

  1. Affected

    5.0.0 – 5.2.3

    16 releases

4.x

  1. Affected

    4.0.0 – 4.4.1

    7 releases

3.x

  1. Affected

    3.0.0 – 3.1.4

    6 releases

2.x

  1. Affected

    2.0.0 – 2.0.5

    5 releases

1.x

  1. Affected

    1.0.0 – 1.7.1

    12 releases

0.x

  1. Affected

    0.0.0 – 0.13.22

    106 releases

187 stable releases of karma, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for karma. It is read in your browser and sent nowhere.

What happens

Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.