Closed andrewjwu closed 9 months ago
Based on the steps to reproduce in https://github.com/axios/axios/issues/6006 this CVE only seems to affect cases where withCredentials: true
is used in axios, which we do not use in typesense-js.
In any case, we'll plan a round of dependency upgrades separately.
This is now available in 1.8.0-0
.
Description
CSRF vulnerability affecting axios versions < 1.6.0.
typesense-js currently depends on
"axios": "^0.26.0"
.Steps to reproduce
https://github.com/axios/axios/issues/6022 https://github.com/axios/axios/issues/6006 https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459
Expected Behavior
Upgrade axios to version 1.6.0 or higher.