Nixpkgs security tracker
7.4 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse dismissed (not in Nixpkgs)
Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. This issue has been patched in @clerk/hono version 0.1.5, @clerk/express version 2.0.7, @clerk/backend version 3.2.3, and @clerk/fastify version 3.1.5.
References
-
https://github.com/clerk/javascript/security/advisories/GHSA-gjxx-92w9-8v8f x_refsource_CONFIRM
Affected products
- ==@clerk/backend >= 3.0.0, < 3.2.3
- ==@clerk/express >= 2.0.0, < 2.0.7
- ==@clerk/fastify >= 3.1.0, < 3.1.5
- ==@clerk/hono >= 0.1.0, < 0.1.5
Matching in nixpkgs
pkgs.javascript-typescript-langserver
JavaScript and TypeScript code intelligence through the Language Server Protocol
pkgs.haskellPackages.gi-javascriptcore
JavaScriptCore 6.x bindings (compatibility layer)
pkgs.perlPackages.JavaScriptMinifierXS
XS based JavaScript minifier
pkgs.haskellPackages.gi-javascriptcore4
None
pkgs.haskellPackages.gi-javascriptcore6
JavaScriptCore 6.x bindings
pkgs.haskellPackages.yi-mode-javascript
Yi editor javascript mode
pkgs.perl5Packages.JavaScriptMinifierXS
XS based JavaScript minifier
pkgs.perlPackages.JavaScriptValueEscape
Avoid XSS with JavaScript value interpolation
pkgs.haskellPackages.language-javascript
Parser for JavaScript
pkgs.perl5Packages.JavaScriptValueEscape
Avoid XSS with JavaScript value interpolation
pkgs.perl538Packages.JavaScriptMinifierXS
None
pkgs.perl540Packages.JavaScriptMinifierXS
None
pkgs.perl538Packages.JavaScriptValueEscape
None
pkgs.perl540Packages.JavaScriptValueEscape
None
pkgs.perlPackages.TemplatePluginJavaScript
Encodes text to be safe in JavaScript
pkgs.perl5Packages.TemplatePluginJavaScript
Encodes text to be safe in JavaScript
pkgs.perl538Packages.TemplatePluginJavaScript
None
pkgs.perl540Packages.TemplatePluginJavaScript
None
pkgs.python312Packages.tree-sitter-javascript
None
pkgs.python313Packages.tree-sitter-javascript
JavaScript and JSX grammar for tree-sitter
pkgs.python314Packages.tree-sitter-javascript
JavaScript and JSX grammar for tree-sitter
-
nixos-unstable 2.21.08.31
- nixpkgs-unstable 2.21.08.31
- nixos-unstable-small 2.21.08.31
-
nixos-unstable 0.0.0+rev=58404d8
- nixpkgs-unstable 0.0.0+rev=58404d8
- nixos-unstable-small 0.0.0+rev=58404d8
-
nixos-unstable 0.0.0+rev=5cc865a
- nixpkgs-unstable 0.0.0+rev=5cc865a
- nixos-unstable-small 0.0.0+rev=5cc865a
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-javascript
Python bindings for tree-sitter-javascript
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-javascript
Python bindings for tree-sitter-javascript
Package maintainers
-
@dywedir Vladyslav M. <dywedir@gra.red>
-
@A-jay98 Ali Jamadi <ali@jamadi.me>
-
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
-
@adfaure Adrien Faure <adfaure@pm.me>
-
@stepbrobd Yifei Sun <ysun@hey.com>
-
@doronbehar Doron Behar <me@doronbehar.com>