Homepage
About Snyk

@actions/http-client@1.0.0 vulnerabilities

Actions Http Client

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the @actions/http-client package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Information Disclosure

@actions/http-client is an actions-http-client.

Affected versions of this package are vulnerable to Information Disclosure. Actions Http-Client can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client:

  1. make an http request with an authorization header
  2. that request leads to a redirect (302) and
  3. the redirect url redirects to another domain or hostname

Then the authorization header will get passed to the other domain.

How to fix Information Disclosure?

Upgrade @actions/http-client to version 1.0.8 or higher.

<1.0.8
Go back to all versions of this package