GHSA-g2gw-q38m-vjfc

Source

https://github.com/advisories/GHSA-g2gw-q38m-vjfc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-g2gw-q38m-vjfc/GHSA-g2gw-q38m-vjfc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g2gw-q38m-vjfc

Aliases

CVE-2026-58201

Published

2026-06-19T22:10:39Z

Modified

2026-09-17T03:56:01Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Lokka: Azure Resource Manager URL path validation issue

Details

Lokka versions prior to 2.1.2 constructed Azure Resource Manager request URLs using direct string concatenation with user-controlled path input. Specially crafted path values could alter URL authority parsing and cause Azure Resource Manager bearer tokens to be sent to an unintended host. Version 2.1.2 fixes the issue by validating Azure paths before token acquisition and constructing Azure Resource Manager URLs with the standard URL API while preserving the expected management.azure.com host.

Reported by 정해창 haechang__@naver.com

Database specific

{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-19T22:10:39Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / @merill/lokka

Package

Name: @merill/lokka; View open source insights on deps.dev
Purl: pkg:npm/%40merill/lokka

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.1.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-g2gw-q38m-vjfc/GHSA-g2gw-q38m-vjfc.json"