Vulnerability GHSA-g6f8-c3x9-jv7f
Medium Risk
MEDIUM RISK
CVSS Score: 5.4
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
22 hours ago
November 12, 2026 at 06:21 PM UTC
code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check
v4.0-BETA1 and v4.0-BETA2 and v4.0-BETA3 and v4.0-BETA4 and v4.0-BETA5 and v4.0-BETA6 and v4.0.0 and v4.0.1 and v4.0.2 and v4.0.3 and v4.0.4 and v4.0.5 and v4.0.6 and v4.0.7 and v4.0.8 and v4.0.9 and v4.0.10 and v4.0.11 and v4.0.12 and v4.0.13 and v4.0.14 and v4.0.15 and v4.0.16 and v4.0.17 and v4.0.18 and v4.0.19 and v4.0.20 and v4.0.21 and v4.1.0 and v4.1.1 and v4.1.2 and v4.1.3 and v4.1.4 and v4.1.5 and v4.1.6 and v4.1.7 and v4.1.8 and v4.1.9 and v4.1.10 and v4.1.11 and v4.1.12 and v4.1.13 and v4.1.14 and v4.1.15 and v4.1.16 and v4.1.17 and v4.1.18 and v4.1.19 and v4.1.20 and v4.1.21 and v4.1.22 and v4.1.23 and v4.1.24 and v4.1.25 and v4.2.0 and v4.2.1 and v4.2.2 and v4.2.3 and v4.2.4 and v4.2.5 and v4.2.6 and v5.0.0-alpha.1 and v5.0.0-alpha.2 and v5.0.0-alpha.3 and v5.0.0-alpha.4 and v5.0.0-alpha.5 and v5.0.0-alpha.6 and v5.0.0-alpha.7 and v5.0.0-alpha.8 and v5.0.0-alpha.9 and v5.0.0-alpha.10 and v5.0.0 and v5.0.1 and v5.1.0 and v5.1.1 and v5.1.2 and v5.2.0 and v5.3.0 and v5.3.1 and v5.3.2 and v5.3.3 and v5.3.4 and v5.3.5 and v5.4.0 and v5.4.1 and v5.4.2 and v5.4.3 and v5.4.4 and v5.4.5 and v5.4.6 and v6.0.0-alpha.1 and v6.0.0-alpha.2 and v6.0.0-alpha.3 and v6.0.0-alpha.4 and v6.0.0-alpha.5 and v6.0.0-alpha.6 and v6.0.0-alpha.7 and v6.0.0-beta.1 and v6.0.0-beta.2 and v6.0.0-beta.3 and v6.0.0 and v6.0.1 and v6.1.0 and v6.1.1 and v6.1.2 and v6.1.3 and v6.1.4 and v6.1.5 and v6.2.0 and v6.3.0 and v6.3.1 and v6.3.2 and v6.3.3 and v6.4.0 and v6.4.1 and v6.5.0 and v6.5.1 and v6.5.2 and v6.5.3 and v6.5.4 and v6.5.5 and 7.0.0-alpha.1 and v7.0.0-beta.1 and v7.0.0-beta.2 and v7.0.0-beta.3 and v7.0.0-beta.4 and v7.0.0-beta.5 and v7.0.0-beta.6 and v7.0.0 and v7.0.1 and v7.0.2 and v7.1.0 and v7.2.0 and v7.2.1 and v7.2.2 and v7.2.3 and v7.2.4 and v7.2.5 and v7.3.0 and v7.4.0 and v7.5.0 and v7.5.1 and v7.5.2 and v7.6.0 and v7.7.0 and v7.7.1 and 7.7.2 and v7.8.0 and v7.9.0 and v7.10.0 and v7.11.0 and v7.12.0 and v7.13.0 and v7.14.0 and v7.15.0 and v7.16.0 and v7.17.0 and v7.17.1 and v7.17.2 and v7.17.3 and v7.18.0 and v7.19.0 and v7.19.1 and v7.20.0 and v7.21.0 and v7.22.0 and v7.23.0 and v7.23.1 and v7.23.2 and v7.24.0 and v7.24.1 and v7.25.0 and v7.25.1 and v7.25.2 and v7.26.0 and v7.26.1 and v7.26.2 and 7.27.0 and v7.27.1 and v7.28.0 and v7.29.0 and v7.29.1 and v7.29.2 and v7.29.3 and v7.29.4 and v7.29.5 and v7.29.6 and v7.29.7 and v7.30.0 and v8.0.0 and v8.0.1 and v8.0.2 and v8.0.3 and v8.0.4 and v8.0.5 and v8.0.6 and v8.0.7 and v8.1.0 and v8.1.1 and v8.1.2 and v8.2.0 and v8.2.1 and v8.3.0 and v8.3.1 and v8.3.2 and v8.3.3 and v8.3.4 and v8.3.5 and v8.3.6 and v8.3.7 and v8.4.0 and v8.4.1 and v8.4.2 and v8.4.3 and v8.4.4 and v8.5.0 and v8.6.0 and v8.6.1 and v9.0.0-alpha.1 and v9.0.0-alpha.2 and v9.0.0-beta.1 and v9.0.0-beta.2 and v9.0.0-beta.3 and v9.0.0-beta.4 and v9.0.0-beta.5 and v9.0.0-beta.6 and v9.0.0-beta.7 and v9.0.0-beta.8 and v9.0.0-beta.9 and v9.0.0-beta.10 and v9.0.0-beta.11 and v9.0.0-beta.12 and v9.0.0-beta.13 and v9.0.0-beta.14 and v9.0.0-beta.15 and v9.0.0-beta.16 and v9.0.0-beta.17 and v9.0.0 and v9.0.1 and v9.0.2 and v9.0.3 and v9.0.4 and v9.0.5 and v9.0.6 and v9.0.7 and v9.0.8 and v9.0.9 and v9.1.0 and v9.1.1 and v9.1.2 and v9.2.0 and v9.2.1 and v9.2.2 and v9.2.3 and v9.2.4 and v9.2.5 and v9.2.6 and v9.2.7 and v9.2.8 and v9.3.0 and v9.3.1 and v9.3.2 and v9.3.3 and v9.3.4 and v9.3.5 and v9.3.6 and v9.3.7 and v9.4.0 and v9.4.1 and v9.5.0 and v9.5.1 and v9.5.2 and v9.6.0 and v9.6.1 and v9.6.2 and v9.6.3 and v9.6.4 and v9.6.5 and v9.6.6 and v9.7.0 and v9.7.1 and v9.7.2 and v9.7.3 and v9.8.0 and v9.8.1 and v9.9.0 and v9.10.0 and v9.10.1 and v9.10.2 and v9.11.0 and v9.11.1 and v9.12.0 and v9.13.0 and v9.13.1 and v9.14.0 and v9.14.1 and v9.14.2 and v9.14.3 and v9.14.4 and v9.15.0 and v9.15.1 and v9.16.0 and v9.16.1 and v9.17.0 and v9.17.1 and v9.18.0 and v9.19.0 and v9.19.1 and v9.19.2 and v9.19.3 and v9.20.0 and v9.21.0 and v9.21.1 and v9.21.2 and v9.22.0 and v9.22.1 and v9.22.2 and v9.22.3 and v9.22.4 and v9.22.5 and v10.0.0-beta.1 and v10.0.0-beta.2 and v10.0.0-beta.3
v4.0-BETA1 and v4.0-BETA2 and v4.0-BETA3 and v4.0-BETA4 and v4.0-BETA5 and v4.0-BETA6 and v4.0.0 and v4.0.1 and v4.0.2 and v4.0.3 and v4.0.4 and v4.0.5 and v4.0.6 and v4.0.7 and v4.0.8 and v4.0.9 and v4.0.10 and v4.0.11 and v4.0.12 and v4.0.13 and v4.0.14 and v4.0.15 and v4.0.16 and v4.0.17 and v4.0.18 and v4.0.19 and v4.0.20 and v4.0.21 and v4.1.0 and v4.1.1 and v4.1.2 and v4.1.3 and v4.1.4 and v4.1.5 and v4.1.6 and v4.1.7 and v4.1.8 and v4.1.9 and v4.1.10 and v4.1.11 and v4.1.12 and v4.1.13 and v4.1.14 and v4.1.15 and v4.1.16 and v4.1.17 and v4.1.18 and v4.1.19 and v4.1.20 and v4.1.21 and v4.1.22 and v4.1.23 and v4.1.24 and v4.1.25 and v4.2.0 and v4.2.1 and v4.2.2 and v4.2.3 and v4.2.4 and v4.2.5 and v4.2.6 and v5.0.0-alpha.1 and v5.0.0-alpha.2 and v5.0.0-alpha.3 and v5.0.0-alpha.4 and v5.0.0-alpha.5 and v5.0.0-alpha.6 and v5.0.0-alpha.7 and v5.0.0-alpha.8 and v5.0.0-alpha.9 and v5.0.0-alpha.10 and v5.0.0 and v5.0.1 and v5.1.0 and v5.1.1 and v5.1.2 and v5.2.0 and v5.3.0 and v5.3.1 and v5.3.2 and v5.3.3 and v5.3.4 and v5.3.5 and v5.4.0 and v5.4.1 and v5.4.2 and v5.4.3 and v5.4.4 and v5.4.5 and v5.4.6 and v6.0.0-alpha.1 and v6.0.0-alpha.2 and v6.0.0-alpha.3 and v6.0.0-alpha.4 and v6.0.0-alpha.5 and v6.0.0-alpha.6 and v6.0.0-alpha.7 and v6.0.0-beta.1 and v6.0.0-beta.2 and v6.0.0-beta.3 and v6.0.0 and v6.0.1 and v6.1.0 and v6.1.1 and v6.1.2 and v6.1.3 and v6.1.4 and v6.1.5 and v6.2.0 and v6.3.0 and v6.3.1 and v6.3.2 and v6.3.3 and v6.4.0 and v6.4.1 and v6.5.0 and v6.5.1 and v6.5.2 and v6.5.3 and v6.5.4 and v6.5.5 and 7.0.0-alpha.1 and v7.0.0-beta.1 and v7.0.0-beta.2 and v7.0.0-beta.3 and v7.0.0-beta.4 and v7.0.0-beta.5 and v7.0.0-beta.6 and v7.0.0 and v7.0.1 and v7.0.2 and v7.1.0 and v7.2.0 and v7.2.1 and v7.2.2 and v7.2.3 and v7.2.4 and v7.2.5 and v7.3.0 and v7.4.0 and v7.5.0 and v7.5.1 and v7.5.2 and v7.6.0 and v7.7.0 and v7.7.1 and 7.7.2 and v7.8.0 and v7.9.0 and v7.10.0 and v7.11.0 and v7.12.0 and v7.13.0 and v7.14.0 and v7.15.0 and v7.16.0 and v7.17.0 and v7.17.1 and v7.17.2 and v7.17.3 and v7.18.0 and v7.19.0 and v7.19.1 and v7.20.0 and v7.21.0 and v7.22.0 and v7.23.0 and v7.23.1 and v7.23.2 and v7.24.0 and v7.24.1 and v7.25.0 and v7.25.1 and v7.25.2 and v7.26.0 and v7.26.1 and v7.26.2 and 7.27.0 and v7.27.1 and v7.28.0 and v7.29.0 and v7.29.1 and v7.29.2 and v7.29.3 and v7.29.4 and v7.29.5 and v7.29.6 and v7.29.7 and v7.30.0 and v8.0.0 and v8.0.1 and v8.0.2 and v8.0.3 and v8.0.4 and v8.0.5 and v8.0.6 and v8.0.7 and v8.1.0 and v8.1.1 and v8.1.2 and v8.2.0 and v8.2.1 and v8.3.0 and v8.3.1 and v8.3.2 and v8.3.3 and v8.3.4 and v8.3.5 and v8.3.6 and v8.3.7 and v8.4.0 and v8.4.1 and v8.4.2 and v8.4.3 and v8.4.4 and v8.5.0 and v8.6.0 and v8.6.1 and v9.0.0-alpha.1 and v9.0.0-alpha.2 and v9.0.0-beta.1 and v9.0.0-beta.2 and v9.0.0-beta.3 and v9.0.0-beta.4 and v9.0.0-beta.5 and v9.0.0-beta.6 and v9.0.0-beta.7 and v9.0.0-beta.8 and v9.0.0-beta.9 and v9.0.0-beta.10 and v9.0.0-beta.11 and v9.0.0-beta.12 and v9.0.0-beta.13 and v9.0.0-beta.14 and v9.0.0-beta.15 and v9.0.0-beta.16 and v9.0.0-beta.17 and v9.0.0 and v9.0.1 and v9.0.2 and v9.0.3 and v9.0.4 and v9.0.5 and v9.0.6 and v9.0.7 and v9.0.8 and v9.0.9 and v9.1.0 and v9.1.1 and v9.1.2 and v9.2.0 and v9.2.1 and v9.2.2 and v9.2.3 and v9.2.4 and v9.2.5 and v9.2.6 and v9.2.7 and v9.2.8 and v9.3.0 and v9.3.1 and v9.3.2 and v9.3.3 and v9.3.4 and v9.3.5 and v9.3.6 and v9.3.7 and v9.4.0 and v9.4.1 and v9.5.0 and v9.5.1 and v9.5.2 and v9.6.0 and v9.6.1 and v9.6.2 and v9.6.3 and v9.6.4 and v9.6.5 and v9.6.6 and v9.7.0 and v9.7.1 and v9.7.2 and v9.7.3 and v9.8.0 and v9.8.1 and v9.9.0 and v9.10.0 and v9.10.1 and v9.10.2 and v9.11.0 and v9.11.1 and v9.12.0 and v9.13.0 and v9.13.1 and v9.14.0 and v9.14.1 and v9.14.2 and v9.14.3 and v9.14.4 and v9.15.0 and v9.15.1 and v9.16.0 and v9.16.1 and v9.17.0 and v9.17.1 and v9.18.0 and v9.19.0 and v9.19.1 and v9.19.2 and v9.19.3 and v9.20.0 and v9.21.0 and v9.21.1 and v9.21.2 and v9.22.0 and v9.22.1 and v9.22.2 and v9.22.3 and v9.22.4 and v9.22.5 and v10.0.0-beta.1 and v10.0.0-beta.2 and v10.0.0-beta.3
Summary
code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check
Details
Impact
An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route.
Patches
The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection.
Workarounds
Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint().
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
22 hours ago
code16/sharp: Arbitrary class instantiation through the embed_key API parameter
v4.0-BETA1 and v4.0-BETA2 and v4.0-BETA3 and v4.0-BETA4 and v4.0-BETA5 and v4.0-BETA6 and v4.0.0 and v4.0.1 and v4.0.2 and v4.0.3 and v4.0.4 and v4.0.5 and v4.0.6 and v4.0.7 and v4.0.8 and v4.0.9 and v4.0.10 and v4.0.11 and v4.0.12 and v4.0.13 and v4.0.14 and v4.0.15 and v4.0.16 and v4.0.17 and v4.0.18 and v4.0.19 and v4.0.20 and v4.0.21 and v4.1.0 and v4.1.1 and v4.1.2 and v4.1.3 and v4.1.4 and v4.1.5 and v4.1.6 and v4.1.7 and v4.1.8 and v4.1.9 and v4.1.10 and v4.1.11 and v4.1.12 and v4.1.13 and v4.1.14 and v4.1.15 and v4.1.16 and v4.1.17 and v4.1.18 and v4.1.19 and v4.1.20 and v4.1.21 and v4.1.22 and v4.1.23 and v4.1.24 and v4.1.25 and v4.2.0 and v4.2.1 and v4.2.2 and v4.2.3 and v4.2.4 and v4.2.5 and v4.2.6 and v5.0.0-alpha.1 and v5.0.0-alpha.2 and v5.0.0-alpha.3 and v5.0.0-alpha.4 and v5.0.0-alpha.5 and v5.0.0-alpha.6 and v5.0.0-alpha.7 and v5.0.0-alpha.8 and v5.0.0-alpha.9 and v5.0.0-alpha.10 and v5.0.0 and v5.0.1 and v5.1.0 and v5.1.1 and v5.1.2 and v5.2.0 and v5.3.0 and v5.3.1 and v5.3.2 and v5.3.3 and v5.3.4 and v5.3.5 and v5.4.0 and v5.4.1 and v5.4.2 and v5.4.3 and v5.4.4 and v5.4.5 and v5.4.6 and v6.0.0-alpha.1 and v6.0.0-alpha.2 and v6.0.0-alpha.3 and v6.0.0-alpha.4 and v6.0.0-alpha.5 and v6.0.0-alpha.6 and v6.0.0-alpha.7 and v6.0.0-beta.1 and v6.0.0-beta.2 and v6.0.0-beta.3 and v6.0.0 and v6.0.1 and v6.1.0 and v6.1.1 and v6.1.2 and v6.1.3 and v6.1.4 and v6.1.5 and v6.2.0 and v6.3.0 and v6.3.1 and v6.3.2 and v6.3.3 and v6.4.0 and v6.4.1 and v6.5.0 and v6.5.1 and v6.5.2 and v6.5.3 and v6.5.4 and v6.5.5 and 7.0.0-alpha.1 and v7.0.0-beta.1 and v7.0.0-beta.2 and v7.0.0-beta.3 and v7.0.0-beta.4 and v7.0.0-beta.5 and v7.0.0-beta.6 and v7.0.0 and v7.0.1 and v7.0.2 and v7.1.0 and v7.2.0 and v7.2.1 and v7.2.2 and v7.2.3 and v7.2.4 and v7.2.5 and v7.3.0 and v7.4.0 and v7.5.0 and v7.5.1 and v7.5.2 and v7.6.0 and v7.7.0 and v7.7.1 and 7.7.2 and v7.8.0 and v7.9.0 and v7.10.0 and v7.11.0 and v7.12.0 and v7.13.0 and v7.14.0 and v7.15.0 and v7.16.0 and v7.17.0 and v7.17.1 and v7.17.2 and v7.17.3 and v7.18.0 and v7.19.0 and v7.19.1 and v7.20.0 and v7.21.0 and v7.22.0 and v7.23.0 and v7.23.1 and v7.23.2 and v7.24.0 and v7.24.1 and v7.25.0 and v7.25.1 and v7.25.2 and v7.26.0 and v7.26.1 and v7.26.2 and 7.27.0 and v7.27.1 and v7.28.0 and v7.29.0 and v7.29.1 and v7.29.2 and v7.29.3 and v7.29.4 and v7.29.5 and v7.29.6 and v7.29.7 and v7.30.0 and v8.0.0 and v8.0.1 and v8.0.2 and v8.0.3 and v8.0.4 and v8.0.5 and v8.0.6 and v8.0.7 and v8.1.0 and v8.1.1 and v8.1.2 and v8.2.0 and v8.2.1 and v8.3.0 and v8.3.1 and v8.3.2 and v8.3.3 and v8.3.4 and v8.3.5 and v8.3.6 and v8.3.7 and v8.4.0 and v8.4.1 and v8.4.2 and v8.4.3 and v8.4.4 and v8.5.0 and v8.6.0 and v8.6.1 and v9.0.0-alpha.1 and v9.0.0-alpha.2 and v9.0.0-beta.1 and v9.0.0-beta.2 and v9.0.0-beta.3 and v9.0.0-beta.4 and v9.0.0-beta.5 and v9.0.0-beta.6 and v9.0.0-beta.7 and v9.0.0-beta.8 and v9.0.0-beta.9 and v9.0.0-beta.10 and v9.0.0-beta.11 and v9.0.0-beta.12 and v9.0.0-beta.13 and v9.0.0-beta.14 and v9.0.0-beta.15 and v9.0.0-beta.16 and v9.0.0-beta.17 and v9.0.0 and v9.0.1 and v9.0.2 and v9.0.3 and v9.0.4 and v9.0.5 and v9.0.6 and v9.0.7 and v9.0.8 and v9.0.9 and v9.1.0 and v9.1.1 and v9.1.2 and v9.2.0 and v9.2.1 and v9.2.2 and v9.2.3 and v9.2.4 and v9.2.5 and v9.2.6 and v9.2.7 and v9.2.8 and v9.3.0 and v9.3.1 and v9.3.2 and v9.3.3 and v9.3.4 and v9.3.5 and v9.3.6 and v9.3.7 and v9.4.0 and v9.4.1 and v9.5.0 and v9.5.1 and v9.5.2 and v9.6.0 and v9.6.1 and v9.6.2 and v9.6.3 and v9.6.4 and v9.6.5 and v9.6.6 and v9.7.0 and v9.7.1 and v9.7.2 and v9.7.3 and v9.8.0 and v9.8.1 and v9.9.0 and v9.10.0 and v9.10.1 and v9.10.2 and v9.11.0 and v9.11.1 and v9.12.0 and v9.13.0 and v9.13.1 and v9.14.0 and v9.14.1 and v9.14.2 and v9.14.3 and v9.14.4 and v9.15.0 and v9.15.1 and v9.16.0 and v9.16.1 and v9.17.0 and v9.17.1 and v9.18.0 and v9.19.0 and v9.19.1 and v9.19.2 and v9.19.3 and v9.20.0 and v9.21.0 and v9.21.1 and v9.21.2 and v9.22.0 and v9.22.1 and v9.22.2 and v9.22.3 and v9.22.4 and v9.22.5 and v10.0.0-beta.1 and v10.0.0-beta.2 and v10.0.0-beta.3 GHSA-h24v-f482-8cwf
v4.0-BETA1 and v4.0-BETA2 and v4.0-BETA3 and v4.0-BETA4 and v4.0-BETA5 and v4.0-BETA6 and v4.0.0 and v4.0.1 and v4.0.2 and v4.0.3 and v4.0.4 and v4.0.5 and v4.0.6 and v4.0.7 and v4.0.8 and v4.0.9 and v4.0.10 and v4.0.11 and v4.0.12 and v4.0.13 and v4.0.14 and v4.0.15 and v4.0.16 and v4.0.17 and v4.0.18 and v4.0.19 and v4.0.20 and v4.0.21 and v4.1.0 and v4.1.1 and v4.1.2 and v4.1.3 and v4.1.4 and v4.1.5 and v4.1.6 and v4.1.7 and v4.1.8 and v4.1.9 and v4.1.10 and v4.1.11 and v4.1.12 and v4.1.13 and v4.1.14 and v4.1.15 and v4.1.16 and v4.1.17 and v4.1.18 and v4.1.19 and v4.1.20 and v4.1.21 and v4.1.22 and v4.1.23 and v4.1.24 and v4.1.25 and v4.2.0 and v4.2.1 and v4.2.2 and v4.2.3 and v4.2.4 and v4.2.5 and v4.2.6 and v5.0.0-alpha.1 and v5.0.0-alpha.2 and v5.0.0-alpha.3 and v5.0.0-alpha.4 and v5.0.0-alpha.5 and v5.0.0-alpha.6 and v5.0.0-alpha.7 and v5.0.0-alpha.8 and v5.0.0-alpha.9 and v5.0.0-alpha.10 and v5.0.0 and v5.0.1 and v5.1.0 and v5.1.1 and v5.1.2 and v5.2.0 and v5.3.0 and v5.3.1 and v5.3.2 and v5.3.3 and v5.3.4 and v5.3.5 and v5.4.0 and v5.4.1 and v5.4.2 and v5.4.3 and v5.4.4 and v5.4.5 and v5.4.6 and v6.0.0-alpha.1 and v6.0.0-alpha.2 and v6.0.0-alpha.3 and v6.0.0-alpha.4 and v6.0.0-alpha.5 and v6.0.0-alpha.6 and v6.0.0-alpha.7 and v6.0.0-beta.1 and v6.0.0-beta.2 and v6.0.0-beta.3 and v6.0.0 and v6.0.1 and v6.1.0 and v6.1.1 and v6.1.2 and v6.1.3 and v6.1.4 and v6.1.5 and v6.2.0 and v6.3.0 and v6.3.1 and v6.3.2 and v6.3.3 and v6.4.0 and v6.4.1 and v6.5.0 and v6.5.1 and v6.5.2 and v6.5.3 and v6.5.4 and v6.5.5 and 7.0.0-alpha.1 and v7.0.0-beta.1 and v7.0.0-beta.2 and v7.0.0-beta.3 and v7.0.0-beta.4 and v7.0.0-beta.5 and v7.0.0-beta.6 and v7.0.0 and v7.0.1 and v7.0.2 and v7.1.0 and v7.2.0 and v7.2.1 and v7.2.2 and v7.2.3 and v7.2.4 and v7.2.5 and v7.3.0 and v7.4.0 and v7.5.0 and v7.5.1 and v7.5.2 and v7.6.0 and v7.7.0 and v7.7.1 and 7.7.2 and v7.8.0 and v7.9.0 and v7.10.0 and v7.11.0 and v7.12.0 and v7.13.0 and v7.14.0 and v7.15.0 and v7.16.0 and v7.17.0 and v7.17.1 and v7.17.2 and v7.17.3 and v7.18.0 and v7.19.0 and v7.19.1 and v7.20.0 and v7.21.0 and v7.22.0 and v7.23.0 and v7.23.1 and v7.23.2 and v7.24.0 and v7.24.1 and v7.25.0 and v7.25.1 and v7.25.2 and v7.26.0 and v7.26.1 and v7.26.2 and 7.27.0 and v7.27.1 and v7.28.0 and v7.29.0 and v7.29.1 and v7.29.2 and v7.29.3 and v7.29.4 and v7.29.5 and v7.29.6 and v7.29.7 and v7.30.0 and v8.0.0 and v8.0.1 and v8.0.2 and v8.0.3 and v8.0.4 and v8.0.5 and v8.0.6 and v8.0.7 and v8.1.0 and v8.1.1 and v8.1.2 and v8.2.0 and v8.2.1 and v8.3.0 and v8.3.1 and v8.3.2 and v8.3.3 and v8.3.4 and v8.3.5 and v8.3.6 and v8.3.7 and v8.4.0 and v8.4.1 and v8.4.2 and v8.4.3 and v8.4.4 and v8.5.0 and v8.6.0 and v8.6.1 and v9.0.0-alpha.1 and v9.0.0-alpha.2 and v9.0.0-beta.1 and v9.0.0-beta.2 and v9.0.0-beta.3 and v9.0.0-beta.4 and v9.0.0-beta.5 and v9.0.0-beta.6 and v9.0.0-beta.7 and v9.0.0-beta.8 and v9.0.0-beta.9 and v9.0.0-beta.10 and v9.0.0-beta.11 and v9.0.0-beta.12 and v9.0.0-beta.13 and v9.0.0-beta.14 and v9.0.0-beta.15 and v9.0.0-beta.16 and v9.0.0-beta.17 and v9.0.0 and v9.0.1 and v9.0.2 and v9.0.3 and v9.0.4 and v9.0.5 and v9.0.6 and v9.0.7 and v9.0.8 and v9.0.9 and v9.1.0 and v9.1.1 and v9.1.2 and v9.2.0 and v9.2.1 and v9.2.2 and v9.2.3 and v9.2.4 and v9.2.5 and v9.2.6 and v9.2.7 and v9.2.8 and v9.3.0 and v9.3.1 and v9.3.2 and v9.3.3 and v9.3.4 and v9.3.5 and v9.3.6 and v9.3.7 and v9.4.0 and v9.4.1 and v9.5.0 and v9.5.1 and v9.5.2 and v9.6.0 and v9.6.1 and v9.6.2 and v9.6.3 and v9.6.4 and v9.6.5 and v9.6.6 and v9.7.0 and v9.7.1 and v9.7.2 and v9.7.3 and v9.8.0 and v9.8.1 and v9.9.0 and v9.10.0 and v9.10.1 and v9.10.2 and v9.11.0 and v9.11.1 and v9.12.0 and v9.13.0 and v9.13.1 and v9.14.0 and v9.14.1 and v9.14.2 and v9.14.3 and v9.14.4 and v9.15.0 and v9.15.1 and v9.16.0 and v9.16.1 and v9.17.0 and v9.17.1 and v9.18.0 and v9.19.0 and v9.19.1 and v9.19.2 and v9.19.3 and v9.20.0 and v9.21.0 and v9.21.1 and v9.21.2 and v9.22.0 and v9.22.1 and v9.22.2 and v9.22.3 and v9.22.4 and v9.22.5 and v10.0.0-beta.1 and v10.0.0-beta.2 and v10.0.0-beta.3 GHSA-h24v-f482-8cwf
High Risk
1 month ago
code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute
v4.0-BETA1 and v4.0-BETA2 and v4.0-BETA3 and v4.0-BETA4 and v4.0-BETA5 and v4.0-BETA6 and v4.0.0 and v4.0.1 and v4.0.2 and v4.0.3 and v4.0.4 and v4.0.5 and v4.0.6 and v4.0.7 and v4.0.8 and v4.0.9 and v4.0.10 and v4.0.11 and v4.0.12 and v4.0.13 and v4.0.14 and v4.0.15 and v4.0.16 and v4.0.17 and v4.0.18 and v4.0.19 and v4.0.20 and v4.0.21 and v4.1.0 and v4.1.1 and v4.1.2 and v4.1.3 and v4.1.4 and v4.1.5 and v4.1.6 and v4.1.7 and v4.1.8 and v4.1.9 and v4.1.10 and v4.1.11 and v4.1.12 and v4.1.13 and v4.1.14 and v4.1.15 and v4.1.16 and v4.1.17 and v4.1.18 and v4.1.19 and v4.1.20 and v4.1.21 and v4.1.22 and v4.1.23 and v4.1.24 and v4.1.25 and v4.2.0 and v4.2.1 and v4.2.2 and v4.2.3 and v4.2.4 and v4.2.5 and v4.2.6 and v5.0.0-alpha.1 and v5.0.0-alpha.2 and v5.0.0-alpha.3 and v5.0.0-alpha.4 and v5.0.0-alpha.5 and v5.0.0-alpha.6 and v5.0.0-alpha.7 and v5.0.0-alpha.8 and v5.0.0-alpha.9 and v5.0.0-alpha.10 and v5.0.0 and v5.0.1 and v5.1.0 and v5.1.1 and v5.1.2 and v5.2.0 and v5.3.0 and v5.3.1 and v5.3.2 and v5.3.3 and v5.3.4 and v5.3.5 and v5.4.0 and v5.4.1 and v5.4.2 and v5.4.3 and v5.4.4 and v5.4.5 and v5.4.6 and v6.0.0-alpha.1 and v6.0.0-alpha.2 and v6.0.0-alpha.3 and v6.0.0-alpha.4 and v6.0.0-alpha.5 and v6.0.0-alpha.6 and v6.0.0-alpha.7 and v6.0.0-beta.1 and v6.0.0-beta.2 and v6.0.0-beta.3 and v6.0.0 and v6.0.1 and v6.1.0 and v6.1.1 and v6.1.2 and v6.1.3 and v6.1.4 and v6.1.5 and v6.2.0 and v6.3.0 and v6.3.1 and v6.3.2 and v6.3.3 and v6.4.0 and v6.4.1 and v6.5.0 and v6.5.1 and v6.5.2 and v6.5.3 and v6.5.4 and v6.5.5 and 7.0.0-alpha.1 and v7.0.0-beta.1 and v7.0.0-beta.2 and v7.0.0-beta.3 and v7.0.0-beta.4 and v7.0.0-beta.5 and v7.0.0-beta.6 and v7.0.0 and v7.0.1 and v7.0.2 and v7.1.0 and v7.2.0 and v7.2.1 and v7.2.2 and v7.2.3 and v7.2.4 and v7.2.5 and v7.3.0 and v7.4.0 and v7.5.0 and v7.5.1 and v7.5.2 and v7.6.0 and v7.7.0 and v7.7.1 and 7.7.2 and v7.8.0 and v7.9.0 and v7.10.0 and v7.11.0 and v7.12.0 and v7.13.0 and v7.14.0 and v7.15.0 and v7.16.0 and v7.17.0 and v7.17.1 and v7.17.2 and v7.17.3 and v7.18.0 and v7.19.0 and v7.19.1 and v7.20.0 and v7.21.0 and v7.22.0 and v7.23.0 and v7.23.1 and v7.23.2 and v7.24.0 and v7.24.1 and v7.25.0 and v7.25.1 and v7.25.2 and v7.26.0 and v7.26.1 and v7.26.2 and 7.27.0 and v7.27.1 and v7.28.0 and v7.29.0 and v7.29.1 and v7.29.2 and v7.29.3 and v7.29.4 and v7.29.5 and v7.29.6 and v7.29.7 and v7.30.0 and v8.0.0 and v8.0.1 and v8.0.2 and v8.0.3 and v8.0.4 and v8.0.5 and v8.0.6 and v8.0.7 and v8.1.0 and v8.1.1 and v8.1.2 and v8.2.0 and v8.2.1 and v8.3.0 and v8.3.1 and v8.3.2 and v8.3.3 and v8.3.4 and v8.3.5 and v8.3.6 and v8.3.7 and v8.4.0 and v8.4.1 and v8.4.2 and v8.4.3 and v8.4.4 and v8.5.0 and v8.6.0 and v8.6.1 and v9.0.0-alpha.1 and v9.0.0-alpha.2 and v9.0.0-beta.1 and v9.0.0-beta.2 and v9.0.0-beta.3 and v9.0.0-beta.4 and v9.0.0-beta.5 and v9.0.0-beta.6 and v9.0.0-beta.7 and v9.0.0-beta.8 and v9.0.0-beta.9 and v9.0.0-beta.10 and v9.0.0-beta.11 and v9.0.0-beta.12 and v9.0.0-beta.13 and v9.0.0-beta.14 and v9.0.0-beta.15 and v9.0.0-beta.16 and v9.0.0-beta.17 and v9.0.0 and v9.0.1 and v9.0.2 and v9.0.3 and v9.0.4 and v9.0.5 and v9.0.6 and v9.0.7 and v9.0.8 and v9.0.9 and v9.1.0 and v9.1.1 and v9.1.2 and v9.2.0 and v9.2.1 and v9.2.2 and v9.2.3 and v9.2.4 and v9.2.5 and v9.2.6 and v9.2.7 and v9.2.8 and v9.3.0 and v9.3.1 and v9.3.2 and v9.3.3 and v9.3.4 and v9.3.5 and v9.3.6 and v9.3.7 and v9.4.0 and v9.4.1 and v9.5.0 and v9.5.1 and v9.5.2 and v9.6.0 and v9.6.1 and v9.6.2 and v9.6.3 and v9.6.4 and v9.6.5 and v9.6.6 and v9.7.0 and v9.7.1 and v9.7.2 and v9.7.3 and v9.8.0 and v9.8.1 and v9.9.0 and v9.10.0 and v9.10.1 and v9.10.2 and v9.11.0 and v9.11.1 and v9.12.0 and v9.13.0 and v9.13.1 and v9.14.0 and v9.14.1 and v9.14.2 and v9.14.3 and v9.14.4 and v9.15.0 and v9.15.1 and v9.16.0 and v9.16.1 and v9.17.0 and v9.17.1 and v9.18.0 and v9.19.0 and v9.19.1 and v9.19.2 and v9.19.3 and v9.20.0 and v9.21.0 and v9.21.1 and v9.21.2 and v9.22.0 and v9.22.1 and v9.22.2 and v9.22.3 and v9.22.4 GHSA-qxg3-46rw-79j8
v4.0-BETA1 and v4.0-BETA2 and v4.0-BETA3 and v4.0-BETA4 and v4.0-BETA5 and v4.0-BETA6 and v4.0.0 and v4.0.1 and v4.0.2 and v4.0.3 and v4.0.4 and v4.0.5 and v4.0.6 and v4.0.7 and v4.0.8 and v4.0.9 and v4.0.10 and v4.0.11 and v4.0.12 and v4.0.13 and v4.0.14 and v4.0.15 and v4.0.16 and v4.0.17 and v4.0.18 and v4.0.19 and v4.0.20 and v4.0.21 and v4.1.0 and v4.1.1 and v4.1.2 and v4.1.3 and v4.1.4 and v4.1.5 and v4.1.6 and v4.1.7 and v4.1.8 and v4.1.9 and v4.1.10 and v4.1.11 and v4.1.12 and v4.1.13 and v4.1.14 and v4.1.15 and v4.1.16 and v4.1.17 and v4.1.18 and v4.1.19 and v4.1.20 and v4.1.21 and v4.1.22 and v4.1.23 and v4.1.24 and v4.1.25 and v4.2.0 and v4.2.1 and v4.2.2 and v4.2.3 and v4.2.4 and v4.2.5 and v4.2.6 and v5.0.0-alpha.1 and v5.0.0-alpha.2 and v5.0.0-alpha.3 and v5.0.0-alpha.4 and v5.0.0-alpha.5 and v5.0.0-alpha.6 and v5.0.0-alpha.7 and v5.0.0-alpha.8 and v5.0.0-alpha.9 and v5.0.0-alpha.10 and v5.0.0 and v5.0.1 and v5.1.0 and v5.1.1 and v5.1.2 and v5.2.0 and v5.3.0 and v5.3.1 and v5.3.2 and v5.3.3 and v5.3.4 and v5.3.5 and v5.4.0 and v5.4.1 and v5.4.2 and v5.4.3 and v5.4.4 and v5.4.5 and v5.4.6 and v6.0.0-alpha.1 and v6.0.0-alpha.2 and v6.0.0-alpha.3 and v6.0.0-alpha.4 and v6.0.0-alpha.5 and v6.0.0-alpha.6 and v6.0.0-alpha.7 and v6.0.0-beta.1 and v6.0.0-beta.2 and v6.0.0-beta.3 and v6.0.0 and v6.0.1 and v6.1.0 and v6.1.1 and v6.1.2 and v6.1.3 and v6.1.4 and v6.1.5 and v6.2.0 and v6.3.0 and v6.3.1 and v6.3.2 and v6.3.3 and v6.4.0 and v6.4.1 and v6.5.0 and v6.5.1 and v6.5.2 and v6.5.3 and v6.5.4 and v6.5.5 and 7.0.0-alpha.1 and v7.0.0-beta.1 and v7.0.0-beta.2 and v7.0.0-beta.3 and v7.0.0-beta.4 and v7.0.0-beta.5 and v7.0.0-beta.6 and v7.0.0 and v7.0.1 and v7.0.2 and v7.1.0 and v7.2.0 and v7.2.1 and v7.2.2 and v7.2.3 and v7.2.4 and v7.2.5 and v7.3.0 and v7.4.0 and v7.5.0 and v7.5.1 and v7.5.2 and v7.6.0 and v7.7.0 and v7.7.1 and 7.7.2 and v7.8.0 and v7.9.0 and v7.10.0 and v7.11.0 and v7.12.0 and v7.13.0 and v7.14.0 and v7.15.0 and v7.16.0 and v7.17.0 and v7.17.1 and v7.17.2 and v7.17.3 and v7.18.0 and v7.19.0 and v7.19.1 and v7.20.0 and v7.21.0 and v7.22.0 and v7.23.0 and v7.23.1 and v7.23.2 and v7.24.0 and v7.24.1 and v7.25.0 and v7.25.1 and v7.25.2 and v7.26.0 and v7.26.1 and v7.26.2 and 7.27.0 and v7.27.1 and v7.28.0 and v7.29.0 and v7.29.1 and v7.29.2 and v7.29.3 and v7.29.4 and v7.29.5 and v7.29.6 and v7.29.7 and v7.30.0 and v8.0.0 and v8.0.1 and v8.0.2 and v8.0.3 and v8.0.4 and v8.0.5 and v8.0.6 and v8.0.7 and v8.1.0 and v8.1.1 and v8.1.2 and v8.2.0 and v8.2.1 and v8.3.0 and v8.3.1 and v8.3.2 and v8.3.3 and v8.3.4 and v8.3.5 and v8.3.6 and v8.3.7 and v8.4.0 and v8.4.1 and v8.4.2 and v8.4.3 and v8.4.4 and v8.5.0 and v8.6.0 and v8.6.1 and v9.0.0-alpha.1 and v9.0.0-alpha.2 and v9.0.0-beta.1 and v9.0.0-beta.2 and v9.0.0-beta.3 and v9.0.0-beta.4 and v9.0.0-beta.5 and v9.0.0-beta.6 and v9.0.0-beta.7 and v9.0.0-beta.8 and v9.0.0-beta.9 and v9.0.0-beta.10 and v9.0.0-beta.11 and v9.0.0-beta.12 and v9.0.0-beta.13 and v9.0.0-beta.14 and v9.0.0-beta.15 and v9.0.0-beta.16 and v9.0.0-beta.17 and v9.0.0 and v9.0.1 and v9.0.2 and v9.0.3 and v9.0.4 and v9.0.5 and v9.0.6 and v9.0.7 and v9.0.8 and v9.0.9 and v9.1.0 and v9.1.1 and v9.1.2 and v9.2.0 and v9.2.1 and v9.2.2 and v9.2.3 and v9.2.4 and v9.2.5 and v9.2.6 and v9.2.7 and v9.2.8 and v9.3.0 and v9.3.1 and v9.3.2 and v9.3.3 and v9.3.4 and v9.3.5 and v9.3.6 and v9.3.7 and v9.4.0 and v9.4.1 and v9.5.0 and v9.5.1 and v9.5.2 and v9.6.0 and v9.6.1 and v9.6.2 and v9.6.3 and v9.6.4 and v9.6.5 and v9.6.6 and v9.7.0 and v9.7.1 and v9.7.2 and v9.7.3 and v9.8.0 and v9.8.1 and v9.9.0 and v9.10.0 and v9.10.1 and v9.10.2 and v9.11.0 and v9.11.1 and v9.12.0 and v9.13.0 and v9.13.1 and v9.14.0 and v9.14.1 and v9.14.2 and v9.14.3 and v9.14.4 and v9.15.0 and v9.15.1 and v9.16.0 and v9.16.1 and v9.17.0 and v9.17.1 and v9.18.0 and v9.19.0 and v9.19.1 and v9.19.2 and v9.19.3 and v9.20.0 and v9.21.0 and v9.21.1 and v9.21.2 and v9.22.0 and v9.22.1 and v9.22.2 and v9.22.3 and v9.22.4 GHSA-qxg3-46rw-79j8
High Risk
1 month ago
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
v4.0-BETA1 and v4.0-BETA2 and v4.0-BETA3 and v4.0-BETA4 and v4.0-BETA5 and v4.0-BETA6 and v4.0.0 and v4.0.1 and v4.0.2 and v4.0.3 and v4.0.4 and v4.0.5 and v4.0.6 and v4.0.7 and v4.0.8 and v4.0.9 and v4.0.10 and v4.0.11 and v4.0.12 and v4.0.13 and v4.0.14 and v4.0.15 and v4.0.16 and v4.0.17 and v4.0.18 and v4.0.19 and v4.0.20 and v4.0.21 and v4.1.0 and v4.1.1 and v4.1.2 and v4.1.3 and v4.1.4 and v4.1.5 and v4.1.6 and v4.1.7 and v4.1.8 and v4.1.9 and v4.1.10 and v4.1.11 and v4.1.12 and v4.1.13 and v4.1.14 and v4.1.15 and v4.1.16 and v4.1.17 and v4.1.18 and v4.1.19 and v4.1.20 and v4.1.21 and v4.1.22 and v4.1.23 and v4.1.24 and v4.1.25 and v4.2.0 and v4.2.1 and v4.2.2 and v4.2.3 and v4.2.4 and v4.2.5 and v4.2.6 and v5.0.0-alpha.1 and v5.0.0-alpha.2 and v5.0.0-alpha.3 and v5.0.0-alpha.4 and v5.0.0-alpha.5 and v5.0.0-alpha.6 and v5.0.0-alpha.7 and v5.0.0-alpha.8 and v5.0.0-alpha.9 and v5.0.0-alpha.10 and v5.0.0 and v5.0.1 and v5.1.0 and v5.1.1 and v5.1.2 and v5.2.0 and v5.3.0 and v5.3.1 and v5.3.2 and v5.3.3 and v5.3.4 and v5.3.5 and v5.4.0 and v5.4.1 and v5.4.2 and v5.4.3 and v5.4.4 and v5.4.5 and v5.4.6 and v6.0.0-alpha.1 and v6.0.0-alpha.2 and v6.0.0-alpha.3 and v6.0.0-alpha.4 and v6.0.0-alpha.5 and v6.0.0-alpha.6 and v6.0.0-alpha.7 and v6.0.0-beta.1 and v6.0.0-beta.2 and v6.0.0-beta.3 and v6.0.0 and v6.0.1 and v6.1.0 and v6.1.1 and v6.1.2 and v6.1.3 and v6.1.4 and v6.1.5 and v6.2.0 and v6.3.0 and v6.3.1 and v6.3.2 and v6.3.3 and v6.4.0 and v6.4.1 and v6.5.0 and v6.5.1 and v6.5.2 and v6.5.3 and v6.5.4 and v6.5.5 and 7.0.0-alpha.1 and v7.0.0-beta.1 and v7.0.0-beta.2 and v7.0.0-beta.3 and v7.0.0-beta.4 and v7.0.0-beta.5 and v7.0.0-beta.6 and v7.0.0 and v7.0.1 and v7.0.2 and v7.1.0 and v7.2.0 and v7.2.1 and v7.2.2 and v7.2.3 and v7.2.4 and v7.2.5 and v7.3.0 and v7.4.0 and v7.5.0 and v7.5.1 and v7.5.2 and v7.6.0 and v7.7.0 and v7.7.1 and 7.7.2 and v7.8.0 and v7.9.0 and v7.10.0 and v7.11.0 and v7.12.0 and v7.13.0 and v7.14.0 and v7.15.0 and v7.16.0 and v7.17.0 and v7.17.1 and v7.17.2 and v7.17.3 and v7.18.0 and v7.19.0 and v7.19.1 and v7.20.0 and v7.21.0 and v7.22.0 and v7.23.0 and v7.23.1 and v7.23.2 and v7.24.0 and v7.24.1 and v7.25.0 and v7.25.1 and v7.25.2 and v7.26.0 and v7.26.1 and v7.26.2 and 7.27.0 and v7.27.1 and v7.28.0 and v7.29.0 and v7.29.1 and v7.29.2 and v7.29.3 and v7.29.4 and v7.29.5 and v7.29.6 and v7.29.7 and v7.30.0 and v8.0.0 and v8.0.1 and v8.0.2 and v8.0.3 and v8.0.4 and v8.0.5 and v8.0.6 and v8.0.7 and v8.1.0 and v8.1.1 and v8.1.2 and v8.2.0 and v8.2.1 and v8.3.0 and v8.3.1 and v8.3.2 and v8.3.3 and v8.3.4 and v8.3.5 and v8.3.6 and v8.3.7 and v8.4.0 and v8.4.1 and v8.4.2 and v8.4.3 and v8.4.4 and v8.5.0 and v8.6.0 and v8.6.1 and v9.0.0-alpha.1 and v9.0.0-alpha.2 and v9.0.0-beta.1 and v9.0.0-beta.2 and v9.0.0-beta.3 and v9.0.0-beta.4 and v9.0.0-beta.5 and v9.0.0-beta.6 and v9.0.0-beta.7 and v9.0.0-beta.8 and v9.0.0-beta.9 and v9.0.0-beta.10 and v9.0.0-beta.11 and v9.0.0-beta.12 and v9.0.0-beta.13 and v9.0.0-beta.14 and v9.0.0-beta.15 and v9.0.0-beta.16 and v9.0.0-beta.17 and v9.0.0 and v9.0.1 and v9.0.2 and v9.0.3 and v9.0.4 and v9.0.5 and v9.0.6 and v9.0.7 and v9.0.8 and v9.0.9 and v9.1.0 and v9.1.1 and v9.1.2 and v9.2.0 and v9.2.1 and v9.2.2 and v9.2.3 and v9.2.4 and v9.2.5 and v9.2.6 and v9.2.7 and v9.2.8 and v9.3.0 and v9.3.1 and v9.3.2 and v9.3.3 and v9.3.4 and v9.3.5 and v9.3.6 and v9.3.7 and v9.4.0 and v9.4.1 and v9.5.0 and v9.5.1 and v9.5.2 and v9.6.0 and v9.6.1 and v9.6.2 and v9.6.3 and v9.6.4 and v9.6.5 and v9.6.6 and v9.7.0 and v9.7.1 and v9.7.2 and v9.7.3 and v9.8.0 and v9.8.1 and v9.9.0 and v9.10.0 and v9.10.1 and v9.10.2 and v9.11.0 and v9.11.1 and v9.12.0 and v9.13.0 and v9.13.1 and v9.14.0 and v9.14.1 and v9.14.2 and v9.14.3 and v9.14.4 and v9.15.0 and v9.15.1 and v9.16.0 and v9.16.1 and v9.17.0 and v9.17.1 and v9.18.0 and v9.19.0 and v9.19.1 and v9.19.2 and v9.19.3 and v9.20.0 and v9.21.0 and v9.21.1 and v9.21.2 and v9.22.0 and v9.22.1 and v9.22.2 and v9.22.3 and v9.22.4 GHSA-vj3q-vp3g-j9c8
v4.0-BETA1 and v4.0-BETA2 and v4.0-BETA3 and v4.0-BETA4 and v4.0-BETA5 and v4.0-BETA6 and v4.0.0 and v4.0.1 and v4.0.2 and v4.0.3 and v4.0.4 and v4.0.5 and v4.0.6 and v4.0.7 and v4.0.8 and v4.0.9 and v4.0.10 and v4.0.11 and v4.0.12 and v4.0.13 and v4.0.14 and v4.0.15 and v4.0.16 and v4.0.17 and v4.0.18 and v4.0.19 and v4.0.20 and v4.0.21 and v4.1.0 and v4.1.1 and v4.1.2 and v4.1.3 and v4.1.4 and v4.1.5 and v4.1.6 and v4.1.7 and v4.1.8 and v4.1.9 and v4.1.10 and v4.1.11 and v4.1.12 and v4.1.13 and v4.1.14 and v4.1.15 and v4.1.16 and v4.1.17 and v4.1.18 and v4.1.19 and v4.1.20 and v4.1.21 and v4.1.22 and v4.1.23 and v4.1.24 and v4.1.25 and v4.2.0 and v4.2.1 and v4.2.2 and v4.2.3 and v4.2.4 and v4.2.5 and v4.2.6 and v5.0.0-alpha.1 and v5.0.0-alpha.2 and v5.0.0-alpha.3 and v5.0.0-alpha.4 and v5.0.0-alpha.5 and v5.0.0-alpha.6 and v5.0.0-alpha.7 and v5.0.0-alpha.8 and v5.0.0-alpha.9 and v5.0.0-alpha.10 and v5.0.0 and v5.0.1 and v5.1.0 and v5.1.1 and v5.1.2 and v5.2.0 and v5.3.0 and v5.3.1 and v5.3.2 and v5.3.3 and v5.3.4 and v5.3.5 and v5.4.0 and v5.4.1 and v5.4.2 and v5.4.3 and v5.4.4 and v5.4.5 and v5.4.6 and v6.0.0-alpha.1 and v6.0.0-alpha.2 and v6.0.0-alpha.3 and v6.0.0-alpha.4 and v6.0.0-alpha.5 and v6.0.0-alpha.6 and v6.0.0-alpha.7 and v6.0.0-beta.1 and v6.0.0-beta.2 and v6.0.0-beta.3 and v6.0.0 and v6.0.1 and v6.1.0 and v6.1.1 and v6.1.2 and v6.1.3 and v6.1.4 and v6.1.5 and v6.2.0 and v6.3.0 and v6.3.1 and v6.3.2 and v6.3.3 and v6.4.0 and v6.4.1 and v6.5.0 and v6.5.1 and v6.5.2 and v6.5.3 and v6.5.4 and v6.5.5 and 7.0.0-alpha.1 and v7.0.0-beta.1 and v7.0.0-beta.2 and v7.0.0-beta.3 and v7.0.0-beta.4 and v7.0.0-beta.5 and v7.0.0-beta.6 and v7.0.0 and v7.0.1 and v7.0.2 and v7.1.0 and v7.2.0 and v7.2.1 and v7.2.2 and v7.2.3 and v7.2.4 and v7.2.5 and v7.3.0 and v7.4.0 and v7.5.0 and v7.5.1 and v7.5.2 and v7.6.0 and v7.7.0 and v7.7.1 and 7.7.2 and v7.8.0 and v7.9.0 and v7.10.0 and v7.11.0 and v7.12.0 and v7.13.0 and v7.14.0 and v7.15.0 and v7.16.0 and v7.17.0 and v7.17.1 and v7.17.2 and v7.17.3 and v7.18.0 and v7.19.0 and v7.19.1 and v7.20.0 and v7.21.0 and v7.22.0 and v7.23.0 and v7.23.1 and v7.23.2 and v7.24.0 and v7.24.1 and v7.25.0 and v7.25.1 and v7.25.2 and v7.26.0 and v7.26.1 and v7.26.2 and 7.27.0 and v7.27.1 and v7.28.0 and v7.29.0 and v7.29.1 and v7.29.2 and v7.29.3 and v7.29.4 and v7.29.5 and v7.29.6 and v7.29.7 and v7.30.0 and v8.0.0 and v8.0.1 and v8.0.2 and v8.0.3 and v8.0.4 and v8.0.5 and v8.0.6 and v8.0.7 and v8.1.0 and v8.1.1 and v8.1.2 and v8.2.0 and v8.2.1 and v8.3.0 and v8.3.1 and v8.3.2 and v8.3.3 and v8.3.4 and v8.3.5 and v8.3.6 and v8.3.7 and v8.4.0 and v8.4.1 and v8.4.2 and v8.4.3 and v8.4.4 and v8.5.0 and v8.6.0 and v8.6.1 and v9.0.0-alpha.1 and v9.0.0-alpha.2 and v9.0.0-beta.1 and v9.0.0-beta.2 and v9.0.0-beta.3 and v9.0.0-beta.4 and v9.0.0-beta.5 and v9.0.0-beta.6 and v9.0.0-beta.7 and v9.0.0-beta.8 and v9.0.0-beta.9 and v9.0.0-beta.10 and v9.0.0-beta.11 and v9.0.0-beta.12 and v9.0.0-beta.13 and v9.0.0-beta.14 and v9.0.0-beta.15 and v9.0.0-beta.16 and v9.0.0-beta.17 and v9.0.0 and v9.0.1 and v9.0.2 and v9.0.3 and v9.0.4 and v9.0.5 and v9.0.6 and v9.0.7 and v9.0.8 and v9.0.9 and v9.1.0 and v9.1.1 and v9.1.2 and v9.2.0 and v9.2.1 and v9.2.2 and v9.2.3 and v9.2.4 and v9.2.5 and v9.2.6 and v9.2.7 and v9.2.8 and v9.3.0 and v9.3.1 and v9.3.2 and v9.3.3 and v9.3.4 and v9.3.5 and v9.3.6 and v9.3.7 and v9.4.0 and v9.4.1 and v9.5.0 and v9.5.1 and v9.5.2 and v9.6.0 and v9.6.1 and v9.6.2 and v9.6.3 and v9.6.4 and v9.6.5 and v9.6.6 and v9.7.0 and v9.7.1 and v9.7.2 and v9.7.3 and v9.8.0 and v9.8.1 and v9.9.0 and v9.10.0 and v9.10.1 and v9.10.2 and v9.11.0 and v9.11.1 and v9.12.0 and v9.13.0 and v9.13.1 and v9.14.0 and v9.14.1 and v9.14.2 and v9.14.3 and v9.14.4 and v9.15.0 and v9.15.1 and v9.16.0 and v9.16.1 and v9.17.0 and v9.17.1 and v9.18.0 and v9.19.0 and v9.19.1 and v9.19.2 and v9.19.3 and v9.20.0 and v9.21.0 and v9.21.1 and v9.21.2 and v9.22.0 and v9.22.1 and v9.22.2 and v9.22.3 and v9.22.4 GHSA-vj3q-vp3g-j9c8
Medium Risk
4 months ago
Sharp Missing Authorization Check in Quick Creation Command Endpoints
v9.0.0 and v9.0.1 and v9.0.2 and v9.0.3 and v9.0.4 and v9.0.5 and v9.0.6 and v9.0.7 and v9.0.8 and v9.0.9 and v9.1.0 and v9.1.1 and v9.1.2 and v9.2.0 and v9.2.1 and v9.2.2 and v9.2.3 and v9.2.4 and v9.2.5 and v9.2.6 and v9.2.7 and v9.2.8 and v9.3.0 and v9.3.1 and v9.3.2 and v9.3.3 and v9.3.4 and v9.3.5 and v9.3.6 and v9.3.7 and v9.4.0 and v9.4.1 and v9.5.0 and v9.5.1 and v9.5.2 and v9.6.0 and v9.6.1 and v9.6.2 and v9.6.3 and v9.6.4 and v9.6.5 and v9.6.6 and v9.7.0 and v9.7.1 and v9.7.2 and v9.7.3 and v9.8.0 and v9.8.1 and v9.9.0 and v9.10.0 and v9.10.1 and v9.10.2 and v9.11.0 and v9.11.1 and v9.12.0 and v9.13.0 and v9.13.1 and v9.14.0 and v9.14.1 and v9.14.2 and v9.14.3 and v9.14.4 and v9.15.0 and v9.15.1 and v9.16.0 and v9.16.1 and v9.17.0 and v9.17.1 and v9.18.0 and v9.19.0 and v9.19.1 and v9.19.2 and v9.19.3 and v9.20.0 and v9.21.0 and v9.21.1 and v9.21.2 and v9.22.0 and v9.22.1 and v9.22.2 GHSA-vmwx-m75v-qvch
v9.0.0 and v9.0.1 and v9.0.2 and v9.0.3 and v9.0.4 and v9.0.5 and v9.0.6 and v9.0.7 and v9.0.8 and v9.0.9 and v9.1.0 and v9.1.1 and v9.1.2 and v9.2.0 and v9.2.1 and v9.2.2 and v9.2.3 and v9.2.4 and v9.2.5 and v9.2.6 and v9.2.7 and v9.2.8 and v9.3.0 and v9.3.1 and v9.3.2 and v9.3.3 and v9.3.4 and v9.3.5 and v9.3.6 and v9.3.7 and v9.4.0 and v9.4.1 and v9.5.0 and v9.5.1 and v9.5.2 and v9.6.0 and v9.6.1 and v9.6.2 and v9.6.3 and v9.6.4 and v9.6.5 and v9.6.6 and v9.7.0 and v9.7.1 and v9.7.2 and v9.7.3 and v9.8.0 and v9.8.1 and v9.9.0 and v9.10.0 and v9.10.1 and v9.10.2 and v9.11.0 and v9.11.1 and v9.12.0 and v9.13.0 and v9.13.1 and v9.14.0 and v9.14.1 and v9.14.2 and v9.14.3 and v9.14.4 and v9.15.0 and v9.15.1 and v9.16.0 and v9.16.1 and v9.17.0 and v9.17.1 and v9.18.0 and v9.19.0 and v9.19.1 and v9.19.2 and v9.19.3 and v9.20.0 and v9.21.0 and v9.21.1 and v9.21.2 and v9.22.0 and v9.22.1 and v9.22.2 GHSA-vmwx-m75v-qvch
High Risk
6 months ago
Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint
v4.0-BETA1 and v4.0-BETA2 and v4.0-BETA3 and v4.0-BETA4 and v4.0-BETA5 and v4.0-BETA6 and v4.0.0 and v4.0.1 and v4.0.2 and v4.0.3 and v4.0.4 and v4.0.5 and v4.0.6 and v4.0.7 and v4.0.8 and v4.0.9 and v4.0.10 and v4.0.11 and v4.0.12 and v4.0.13 and v4.0.14 and v4.0.15 and v4.0.16 and v4.0.17 and v4.0.18 and v4.0.19 and v4.0.20 and v4.0.21 and v4.1.0 and v4.1.1 and v4.1.2 and v4.1.3 and v4.1.4 and v4.1.5 and v4.1.6 and v4.1.7 and v4.1.8 and v4.1.9 and v4.1.10 and v4.1.11 and v4.1.12 and v4.1.13 and v4.1.14 and v4.1.15 and v4.1.16 and v4.1.17 and v4.1.18 and v4.1.19 and v4.1.20 and v4.1.21 and v4.1.22 and v4.1.23 and v4.1.24 and v4.1.25 and v4.2.0 and v4.2.1 and v4.2.2 and v4.2.3 and v4.2.4 and v4.2.5 and v4.2.6 and v5.0.0-alpha.1 and v5.0.0-alpha.2 and v5.0.0-alpha.3 and v5.0.0-alpha.4 and v5.0.0-alpha.5 and v5.0.0-alpha.6 and v5.0.0-alpha.7 and v5.0.0-alpha.8 and v5.0.0-alpha.9 and v5.0.0-alpha.10 and v5.0.0 and v5.0.1 and v5.1.0 and v5.1.1 and v5.1.2 and v5.2.0 and v5.3.0 and v5.3.1 and v5.3.2 and v5.3.3 and v5.3.4 and v5.3.5 and v5.4.0 and v5.4.1 and v5.4.2 and v5.4.3 and v5.4.4 and v5.4.5 and v5.4.6 and v6.0.0-alpha.1 and v6.0.0-alpha.2 and v6.0.0-alpha.3 and v6.0.0-alpha.4 and v6.0.0-alpha.5 and v6.0.0-alpha.6 and v6.0.0-alpha.7 and v6.0.0-beta.1 and v6.0.0-beta.2 and v6.0.0-beta.3 and v6.0.0 and v6.0.1 and v6.1.0 and v6.1.1 and v6.1.2 and v6.1.3 and v6.1.4 and v6.1.5 and v6.2.0 and v6.3.0 and v6.3.1 and v6.3.2 and v6.3.3 and v6.4.0 and v6.4.1 and v6.5.0 and v6.5.1 and v6.5.2 and v6.5.3 and v6.5.4 and v6.5.5 and 7.0.0-alpha.1 and v7.0.0-beta.1 and v7.0.0-beta.2 and v7.0.0-beta.3 and v7.0.0-beta.4 and v7.0.0-beta.5 and v7.0.0-beta.6 and v7.0.0 and v7.0.1 and v7.0.2 and v7.1.0 and v7.2.0 and v7.2.1 and v7.2.2 and v7.2.3 and v7.2.4 and v7.2.5 and v7.3.0 and v7.4.0 and v7.5.0 and v7.5.1 and v7.5.2 and v7.6.0 and v7.7.0 and v7.7.1 and 7.7.2 and v7.8.0 and v7.9.0 and v7.10.0 and v7.11.0 and v7.12.0 and v7.13.0 and v7.14.0 and v7.15.0 and v7.16.0 and v7.17.0 and v7.17.1 and v7.17.2 and v7.17.3 and v7.18.0 and v7.19.0 and v7.19.1 and v7.20.0 and v7.21.0 and v7.22.0 and v7.23.0 and v7.23.1 and v7.23.2 and v7.24.0 and v7.24.1 and v7.25.0 and v7.25.1 and v7.25.2 and v7.26.0 and v7.26.1 and v7.26.2 and 7.27.0 and v7.27.1 and v7.28.0 and v7.29.0 and v7.29.1 and v7.29.2 and v7.29.3 and v7.29.4 and v7.29.5 and v7.29.6 and v7.29.7 and v7.30.0 and v8.0.0 and v8.0.1 and v8.0.2 and v8.0.3 and v8.0.4 and v8.0.5 and v8.0.6 and v8.0.7 and v8.1.0 and v8.1.1 and v8.1.2 and v8.2.0 and v8.2.1 and v8.3.0 and v8.3.1 and v8.3.2 and v8.3.3 and v8.3.4 and v8.3.5 and v8.3.6 and v8.3.7 and v8.4.0 and v8.4.1 and v8.4.2 and v8.4.3 and v8.4.4 and v8.5.0 and v8.6.0 and v8.6.1 and v9.0.0-alpha.1 and v9.0.0-alpha.2 and v9.0.0-beta.1 and v9.0.0-beta.2 and v9.0.0-beta.3 and v9.0.0-beta.4 and v9.0.0-beta.5 and v9.0.0-beta.6 and v9.0.0-beta.7 and v9.0.0-beta.8 and v9.0.0-beta.9 and v9.0.0-beta.10 and v9.0.0-beta.11 and v9.0.0-beta.12 and v9.0.0-beta.13 and v9.0.0-beta.14 and v9.0.0-beta.15 and v9.0.0-beta.16 and v9.0.0-beta.17 and v9.0.0 and v9.0.1 and v9.0.2 and v9.0.3 and v9.0.4 and v9.0.5 and v9.0.6 and v9.0.7 and v9.0.8 and v9.0.9 and v9.1.0 and v9.1.1 and v9.1.2 and v9.2.0 and v9.2.1 and v9.2.2 and v9.2.3 and v9.2.4 and v9.2.5 and v9.2.6 and v9.2.7 and v9.2.8 and v9.3.0 and v9.3.1 and v9.3.2 and v9.3.3 and v9.3.4 and v9.3.5 and v9.3.6 and v9.3.7 and v9.4.0 and v9.4.1 and v9.5.0 and v9.5.1 and v9.5.2 and v9.6.0 and v9.6.1 and v9.6.2 and v9.6.3 and v9.6.4 and v9.6.5 and v9.6.6 and v9.7.0 and v9.7.1 and v9.7.2 and v9.7.3 and v9.8.0 and v9.8.1 and v9.9.0 and v9.10.0 and v9.10.1 and v9.10.2 and v9.11.0 and v9.11.1 and v9.12.0 and v9.13.0 and v9.13.1 and v9.14.0 and v9.14.1 and v9.14.2 and v9.14.3 and v9.14.4 and v9.15.0 and v9.15.1 and v9.16.0 and v9.16.1 and v9.17.0 and v9.17.1 and v9.18.0 and v9.19.0 and v9.19.1 and v9.19.2 and v9.19.3 and v9.20.0 and v9.21.0 and v9.21.1 and v9.21.2 GHSA-748w-hm6r-qc7v
v4.0-BETA1 and v4.0-BETA2 and v4.0-BETA3 and v4.0-BETA4 and v4.0-BETA5 and v4.0-BETA6 and v4.0.0 and v4.0.1 and v4.0.2 and v4.0.3 and v4.0.4 and v4.0.5 and v4.0.6 and v4.0.7 and v4.0.8 and v4.0.9 and v4.0.10 and v4.0.11 and v4.0.12 and v4.0.13 and v4.0.14 and v4.0.15 and v4.0.16 and v4.0.17 and v4.0.18 and v4.0.19 and v4.0.20 and v4.0.21 and v4.1.0 and v4.1.1 and v4.1.2 and v4.1.3 and v4.1.4 and v4.1.5 and v4.1.6 and v4.1.7 and v4.1.8 and v4.1.9 and v4.1.10 and v4.1.11 and v4.1.12 and v4.1.13 and v4.1.14 and v4.1.15 and v4.1.16 and v4.1.17 and v4.1.18 and v4.1.19 and v4.1.20 and v4.1.21 and v4.1.22 and v4.1.23 and v4.1.24 and v4.1.25 and v4.2.0 and v4.2.1 and v4.2.2 and v4.2.3 and v4.2.4 and v4.2.5 and v4.2.6 and v5.0.0-alpha.1 and v5.0.0-alpha.2 and v5.0.0-alpha.3 and v5.0.0-alpha.4 and v5.0.0-alpha.5 and v5.0.0-alpha.6 and v5.0.0-alpha.7 and v5.0.0-alpha.8 and v5.0.0-alpha.9 and v5.0.0-alpha.10 and v5.0.0 and v5.0.1 and v5.1.0 and v5.1.1 and v5.1.2 and v5.2.0 and v5.3.0 and v5.3.1 and v5.3.2 and v5.3.3 and v5.3.4 and v5.3.5 and v5.4.0 and v5.4.1 and v5.4.2 and v5.4.3 and v5.4.4 and v5.4.5 and v5.4.6 and v6.0.0-alpha.1 and v6.0.0-alpha.2 and v6.0.0-alpha.3 and v6.0.0-alpha.4 and v6.0.0-alpha.5 and v6.0.0-alpha.6 and v6.0.0-alpha.7 and v6.0.0-beta.1 and v6.0.0-beta.2 and v6.0.0-beta.3 and v6.0.0 and v6.0.1 and v6.1.0 and v6.1.1 and v6.1.2 and v6.1.3 and v6.1.4 and v6.1.5 and v6.2.0 and v6.3.0 and v6.3.1 and v6.3.2 and v6.3.3 and v6.4.0 and v6.4.1 and v6.5.0 and v6.5.1 and v6.5.2 and v6.5.3 and v6.5.4 and v6.5.5 and 7.0.0-alpha.1 and v7.0.0-beta.1 and v7.0.0-beta.2 and v7.0.0-beta.3 and v7.0.0-beta.4 and v7.0.0-beta.5 and v7.0.0-beta.6 and v7.0.0 and v7.0.1 and v7.0.2 and v7.1.0 and v7.2.0 and v7.2.1 and v7.2.2 and v7.2.3 and v7.2.4 and v7.2.5 and v7.3.0 and v7.4.0 and v7.5.0 and v7.5.1 and v7.5.2 and v7.6.0 and v7.7.0 and v7.7.1 and 7.7.2 and v7.8.0 and v7.9.0 and v7.10.0 and v7.11.0 and v7.12.0 and v7.13.0 and v7.14.0 and v7.15.0 and v7.16.0 and v7.17.0 and v7.17.1 and v7.17.2 and v7.17.3 and v7.18.0 and v7.19.0 and v7.19.1 and v7.20.0 and v7.21.0 and v7.22.0 and v7.23.0 and v7.23.1 and v7.23.2 and v7.24.0 and v7.24.1 and v7.25.0 and v7.25.1 and v7.25.2 and v7.26.0 and v7.26.1 and v7.26.2 and 7.27.0 and v7.27.1 and v7.28.0 and v7.29.0 and v7.29.1 and v7.29.2 and v7.29.3 and v7.29.4 and v7.29.5 and v7.29.6 and v7.29.7 and v7.30.0 and v8.0.0 and v8.0.1 and v8.0.2 and v8.0.3 and v8.0.4 and v8.0.5 and v8.0.6 and v8.0.7 and v8.1.0 and v8.1.1 and v8.1.2 and v8.2.0 and v8.2.1 and v8.3.0 and v8.3.1 and v8.3.2 and v8.3.3 and v8.3.4 and v8.3.5 and v8.3.6 and v8.3.7 and v8.4.0 and v8.4.1 and v8.4.2 and v8.4.3 and v8.4.4 and v8.5.0 and v8.6.0 and v8.6.1 and v9.0.0-alpha.1 and v9.0.0-alpha.2 and v9.0.0-beta.1 and v9.0.0-beta.2 and v9.0.0-beta.3 and v9.0.0-beta.4 and v9.0.0-beta.5 and v9.0.0-beta.6 and v9.0.0-beta.7 and v9.0.0-beta.8 and v9.0.0-beta.9 and v9.0.0-beta.10 and v9.0.0-beta.11 and v9.0.0-beta.12 and v9.0.0-beta.13 and v9.0.0-beta.14 and v9.0.0-beta.15 and v9.0.0-beta.16 and v9.0.0-beta.17 and v9.0.0 and v9.0.1 and v9.0.2 and v9.0.3 and v9.0.4 and v9.0.5 and v9.0.6 and v9.0.7 and v9.0.8 and v9.0.9 and v9.1.0 and v9.1.1 and v9.1.2 and v9.2.0 and v9.2.1 and v9.2.2 and v9.2.3 and v9.2.4 and v9.2.5 and v9.2.6 and v9.2.7 and v9.2.8 and v9.3.0 and v9.3.1 and v9.3.2 and v9.3.3 and v9.3.4 and v9.3.5 and v9.3.6 and v9.3.7 and v9.4.0 and v9.4.1 and v9.5.0 and v9.5.1 and v9.5.2 and v9.6.0 and v9.6.1 and v9.6.2 and v9.6.3 and v9.6.4 and v9.6.5 and v9.6.6 and v9.7.0 and v9.7.1 and v9.7.2 and v9.7.3 and v9.8.0 and v9.8.1 and v9.9.0 and v9.10.0 and v9.10.1 and v9.10.2 and v9.11.0 and v9.11.1 and v9.12.0 and v9.13.0 and v9.13.1 and v9.14.0 and v9.14.1 and v9.14.2 and v9.14.3 and v9.14.4 and v9.15.0 and v9.15.1 and v9.16.0 and v9.16.1 and v9.17.0 and v9.17.1 and v9.18.0 and v9.19.0 and v9.19.1 and v9.19.2 and v9.19.3 and v9.20.0 and v9.21.0 and v9.21.1 and v9.21.2 GHSA-748w-hm6r-qc7v
Impacted packages
Timeline
Published
22 hours ago
November 12, 2026 at 06:21 PM UTC
Fixed (10.0.0-beta.4)
3 months ago
July 17, 2026 at 08:58 AM UTC
Last Modified
21 hours ago
November 12, 2026 at 06:30 PM UTC