Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@eeacms/volto-chatbot

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2npmAmendedPublished

    @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy

    GHSA-w9x9-j56r-h98r

    Affected
    • npm @eeacms/volto-chatbot < 2.0.4
    Fixed in
    2.0.4· Vendor fix available
    Issue
    Unauthenticated Danswer API Confused Deputy Proxy in @eeacms/volto-chatbot Summary `@eeacms/volto-chatbot` exposes an Express middleware route (`/_v1_da/`) that accepts unauthenticated HTTP requests from any network client and proxies them to the configured upstream Danswer API, automatically attaching the server-side service credentials (`DANSWER_API_KEY` or session cookie). Because no authorization check, path allowlist, or method restriction is applied before the upstream request is issued, an unauthenticated attacker can invoke arbitrary Danswer API operations — including privileged admin endpoints — as the configured service account. This is a classic Confused Deputy attack: the Volto proxy acts as a deputy that carries credentials on behalf of the attacker. Details The vulnerability is introduced across two source files in `@eeacms/volto-chatbot@2.0.3`. Route registration (`src/index.js:15`): ```js middleware.all('/_v1_da/', proxyMiddleware); ``` The…

    Recommended action: Upgrade to 2.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →