@budibase/backend-core
npm · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker | @budibase/backend-core | npm | Medium | Fix reported | |
| Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour | @budibase/backend-core | npm | Medium | Fix reported | |
| @budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation | @budibase/backend-core | npm | High | Fix reported | |
| Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover | @budibase/backend-core | npm | High | Fix reported | |
| Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints | @budibase/backend-core | npm | Critical | No fix reported | |
| Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist | @budibase/backend-core | npm | Critical | Fix reported |