CVE-2024-43799: send vulnerable to template injection that can lead to XSS

September 10, 2024 (updated November 3, 2025)

passing untrusted user input - even after sanitizing it - to SendStream.redirect() may execute untrusted code

References

github.com/advisories/GHSA-m6fv-jmcg-4jfg
github.com/pillarjs/send
github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35
github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg
lists.debian.org/debian-lts-announce/2025/06/msg00022.html
nvd.nist.gov/vuln/detail/CVE-2024-43799

Code Behaviors & Features

Detect and mitigate CVE-2024-43799 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →