Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

node-etsy-client

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1npmAmendedPublished

    ApiKey secret could be revelated on network issue

    CVE-2021-21421 · GHSA-xw22-wv29-3299

    Affected
    • npm node-etsy-client <= 0.2.0
    Fixed in
    0.3.0· Vendor fix available
    Issue
    Impact What kind of vulnerability is it? Who is impacted? Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too Patches Has the problem been patched? What versions should users upgrade to? creharmony/node-etsy-client#18 fixes this issue. This is fixed in node-etsy-client v0.3.0 and later. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? Do not report or log etsy client error if you are using version <= v0.2.0 Update your version of node-etsy-client References Are there any links users can visit to find out more? - https://github.com/creharmony/node-etsy-client/issues/17 : On connect error secret appears in error #17 For more information If you have any questions or comments about this advisory: Open an issue in github.com/creharmony/node-etsy-client/issues

    Recommended action: Upgrade to 0.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →