GHSA-jqx4-9gpq-rppm: @misskey-dev/summaly allows IP Filter Bypass via Redirect

May 6, 2025

Due to a validation error in got.scpaping, it is possible to use an HTTP redirect to avoid IP filtering.

References

github.com/advisories/GHSA-jqx4-9gpq-rppm
github.com/misskey-dev/summaly
github.com/misskey-dev/summaly/commit/dfe6451012aac42eabe71d4ed721d8058c4066b4
github.com/misskey-dev/summaly/security/advisories/GHSA-jqx4-9gpq-rppm

Code Behaviors & Features

Detect and mitigate GHSA-jqx4-9gpq-rppm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →