Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@dirac-grid/diracx-web-components

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.7npmAmendedPublished

    DiracX-Web is vulnerable to attack through an Open Redirect on its login page

    CVE-2025-54066 · GHSA-hfj7-542q-8fvv

    Affected
    • npm @dirac-grid/diracx-web-components < 0.1.0-a8
    Fixed in
    0.1.0-a8· Vendor fix available
    Issue
    An attacker can forge a request to redirect an authenticated user to any arbitrary website. Details On the login page, we have a redirect field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI. Paired with a parameter pollution, we can hide our malicious URI (ex: https://dns.com/?param1=imhiddenifthereslotofargs?param1=bbb). PoC https://diracx-cert.app.cern.ch/auth?redirect=https://ipcim.com/en/where/?dsdsd=qsqsfsjfnsfniizaeiaapzqlalkqkaizqqijsjaopmqmxna?redirect=https://diracx-cert-app.cern.ch/auth This POC can leak user's position. Impact This could be used for phishing and extracting new data (such as redirecting to a new "log in" page, and asking users to reenter credentials).

    Recommended action: Upgrade to 0.1.0-a8 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →