Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

firebase-tools

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.6npmAmendedPublished

    Firebase vulnerable to CRSF attack

    CVE-2024-4128 · GHSA-rcm2-22f3-pqv3

    Affected
    • npm firebase-tools < 13.6.0
    Fixed in
    13.6.0· Vendor fix available
    Issue
    This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed calls to localhost (ie Chrome before v94), the website could exfiltrate emulator data. We recommend upgrading past version 13.6.0 or commit 068a2b08dc308c7ab4b569617f5fc8821237e3a0.

    Recommended action: Upgrade to 13.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →