CVE-2021-23495: Open redirect in karma

February 25, 2022 (updated March 8, 2022)

The package karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.

References

github.com/advisories/GHSA-rc3x-jf5g-xvc5
github.com/karma-runner/karma/commit/ff7edbb2ffbcdd69761bece86b7dc1ef0740508d
nvd.nist.gov/vuln/detail/CVE-2021-23495
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2412347
snyk.io/vuln/SNYK-JS-KARMA-2396325

Code Behaviors & Features

Detect and mitigate CVE-2021-23495 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →