1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
nocobase-plugin-action-custom-request
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 2 versions
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting nocobase-plugin-action-custom-request, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-wrr5-j383-f7h2 | Moderate | NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides### Summary A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the `@nocobase/plugin-action-custom-request` plugin. A low-privileged authenticated user can call the `customRequests:send` endpoint and override the stored request URL at runtime using `options.url`. This causes the NocoBase server to perform outbound HTTP requests to attacker-controlled or internal URLs. * Product: NocoBase * Version: v2.1.10 * Component: `@nocobase/plugin-action-custom-request` * Severity: Moderate * Required privilege: authenticated low-privileged user / member Testing was performed o |
| GitHub (opens in a new tab) |
- GHSA-wrr5-j383-f7h2ModerateNocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides
>= 2.1.0-alpha.8, < 2.1.15>= 2.2.0-alpha.1, < 2.2.0-alpha.4
### Summary A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the `@nocobase/plugin-action-custom-request` plugin. A low-privileged authenticated user can call the `customRequests:send` endpoint and override the stored request URL at runtime using `options.url`. This causes the NocoBase server to perform outbound HTTP requests to attacker-controlled or internal URLs. * Product: NocoBase * Version: v2.1.10 * Component: `@nocobase/plugin-action-custom-request` * Severity: Moderate * Required privilege: authenticated low-privileged user / member Testing was performed o
CVE: CVE-2026-79914