Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

oceanic.js

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5npmAmendedPublished

    Oceanic allows unsanitized user input to lead to path traversal in URLs

    CVE-2024-34712 · GHSA-5h5v-hw44-f6gg

    Affected
    • npm oceanic.js < 1.10.4
    Fixed in
    1.10.4· Vendor fix available
    Issue
    Impact Input to functions such as Client.rest.channels.removeBan is not url-encoded, resulting in specially crafted input such as ../../../channels/{id} being normalized into the url /api/v10/channels/{id}, and deleting a channel rather than removing a ban. Workarounds Sanitizing user input, ensuring strings are valid for the purpose they are being used for. Encoding input with encodeURIComponent before providing it to the library. References OceanicJS/Oceanic@8bf8ee8373b8c565fbdbf70a609aba4fbc1a1ffe

    Recommended action: Upgrade to 1.10.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →