Description
The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.
Remediation
References
https://github.com/karma-runner/karma/commit/ff7edbb2ffbcdd69761bece86b7dc1ef0740508d
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2412347
https://snyk.io/vuln/SNYK-JS-KARMA-2396325
Related Vulnerabilities
CVE-2021-32803 Vulnerability in npm package tar
CVE-2017-16003 Vulnerability in npm package windows-build-tools
CVE-2023-36477 Vulnerability in maven package org.xwiki.platform:xwiki-platform-ckeditor-ui
CVE-2021-21165 Vulnerability in maven package org.webjars.npm:electron
CVE-2021-43841 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore