https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 18:32:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-271142 EUVD-2026-271142 https://cve.radiocsirt.org/vuln/euvd-2026-271142 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27818 <p>TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration. Version 4.0.3 fixes the issue.</p> <p>TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration. Version 4.0.3 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27818 https://cve.radiocsirt.org/vuln/ghsa-w789-49fc-v8hr <p><strong>Affected:</strong> npm: terriajs-server</p> <p>### Impact A validation bug allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration.</p> <p>The validation only checks if a hostname _ended_ with an allowed domain. This meant:</p> <p>If `example.com` is allowed in `proxyableDomains`:</p> <p>- ✅ example.com is allowed (correct) - ✅ api.example.com is allowed (correct) - ⚠️ maliciousexample.com is allowed (incorrect)</p> <p>An attacker could register maliciousexample.com and proxy content through `terriajs-server`, bypassing proxy restrictions.</p> <p>### Patches All versions up to 4.0.2 are affected. Upgrade to 4.0.3 to address the vulnerability.</p> <p><strong>Affected:</strong> npm: terriajs-server</p> <p>### Impact A validation bug allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration.</p> <p>The validation only checks if a hostname _ended_ with an allowed domain. This meant:</p> <p>If `example.com` is allowed in `proxyableDomains`:</p> <p>- ✅ example.com is allowed (correct) - ✅ api.example.com is allowed (correct) - ⚠️ maliciousexample.com is allowed (incorrect)</p> <p>An attacker could register maliciousexample.com and proxy content through `terriajs-server`, bypassing proxy restrictions.</p> <p>### Patches All versions up to 4.0.2 are affected. Upgrade to 4.0.3 to address the vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-w789-49fc-v8hr