GHSA-r385-c5fc-x56c

Source

https://github.com/advisories/GHSA-r385-c5fc-x56c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-r385-c5fc-x56c/GHSA-r385-c5fc-x56c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-r385-c5fc-x56c

Aliases

CVE-2024-57177

Published

2025-02-10T21:31:39Z

Modified

2025-12-18T16:11:14.520289Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

CouchAuth has a Server-Side Template Injection vulnerability in its email functionality

Details

A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information.

Database specific

{
    "nvd_published_at": "2025-02-10T20:15:41Z",
    "cwe_ids": [
        "CWE-1336",
        "CWE-74"
    ],
    "github_reviewed_at": "2025-12-18T15:30:17Z",
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

npm / @perfood/couch-auth

Package

Name: @perfood/couch-auth; View open source insights on deps.dev
Purl: pkg:npm/%40perfood/couch-auth

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.21.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-r385-c5fc-x56c/GHSA-r385-c5fc-x56c.json"