houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: axios requests vulnerable to possible SSRF and credential leakage via absolute URL (#15244)

Browse Source 
Fixes [Dependabot Alert
211](https://github.com/twentyhq/twenty/security/dependabot/211) - axios
requests vulnerable to possible SSRF and credential leakage via absolute
URL.
This commit is contained in:
Abdullah.
2025-10-22 20:15:52 +05:00
committed by GitHub
parent c04b3722b3
commit 8fab1ee668
2 changed files with 26 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/package.json
+1 -1
View File
@@ -17,7 +17,7 @@
"@types/lodash.upperfirst": "^4.3.9",
"@types/uuid": "^10.0.0",
"archiver": "^7.0.1",
"axios": "^1.7.5",
"axios": "^1.12.0",
"bcrypt": "^5.1.1",
"body-parser": "^1.20.3",
"deep-equal": "^2.2.3",
packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/yarn.lock
+25 -11
View File
@@ -607,14 +607,14 @@ __metadata:
languageName: node
linkType: hard
"axios@npm:^1.7.5":
version: 1.7.5
resolution: "axios@npm:1.7.5"
"axios@npm:^1.12.0":
version: 1.12.2
resolution: "axios@npm:1.12.2"
dependencies:
follow-redirects: "npm:^1.15.6"
form-data: "npm:^4.0.0"
form-data: "npm:^4.0.4"
proxy-from-env: "npm:^1.1.0"
checksum: 10c0/1d5daeb28b3d1bb2a7b9f0743433c4bfbeaddc15461e50ebde487eec6c009af2515749d5261096dd430c90cd891bd310bcba5ec3967bae2033c4a307f58a6ad3
checksum: 10c0/80b063e318cf05cd33a4d991cea0162f3573481946f9129efb7766f38fde4c061c34f41a93a9f9521f02b7c9565ccbc197c099b0186543ac84a24580017adfed
languageName: node
linkType: hard
@@ -1185,6 +1185,18 @@ __metadata:
languageName: node
linkType: hard
"es-set-tostringtag@npm:^2.1.0":
version: 2.1.0
resolution: "es-set-tostringtag@npm:2.1.0"
dependencies:
es-errors: "npm:^1.3.0"
get-intrinsic: "npm:^1.2.6"
has-tostringtag: "npm:^1.0.2"
hasown: "npm:^2.0.2"
checksum: 10c0/ef2ca9ce49afe3931cb32e35da4dcb6d86ab02592cfc2ce3e49ced199d9d0bb5085fc7e73e06312213765f5efa47cc1df553a6a5154584b21448e9fb8355b1af
languageName: node
linkType: hard
"event-target-shim@npm:^5.0.0":
version: 5.0.1
resolution: "event-target-shim@npm:5.0.1"
@@ -1256,14 +1268,16 @@ __metadata:
languageName: node
linkType: hard
"form-data@npm:^4.0.0":
version: 4.0.0
resolution: "form-data@npm:4.0.0"
"form-data@npm:^4.0.4":
version: 4.0.4
resolution: "form-data@npm:4.0.4"
dependencies:
asynckit: "npm:^0.4.0"
combined-stream: "npm:^1.0.8"
es-set-tostringtag: "npm:^2.1.0"
hasown: "npm:^2.0.2"
mime-types: "npm:^2.1.12"
checksum: 10c0/cb6f3ac49180be03ff07ba3ff125f9eba2ff0b277fb33c7fc47569fc5e616882c5b1c69b9904c4c4187e97dd0419dd03b134174756f296dec62041e6527e2c6e
checksum: 10c0/373525a9a034b9d57073e55eab79e501a714ffac02e7a9b01be1c820780652b16e4101819785e1e18f8d98f0aee866cc654d660a435c378e16a72f2e7cac9695
languageName: node
linkType: hard
@@ -1343,7 +1357,7 @@ __metadata:
languageName: node
linkType: hard
"get-intrinsic@npm:^1.2.5, get-intrinsic@npm:^1.3.0":
"get-intrinsic@npm:^1.2.5, get-intrinsic@npm:^1.2.6, get-intrinsic@npm:^1.3.0":
version: 1.3.1
resolution: "get-intrinsic@npm:1.3.1"
dependencies:
@@ -2648,7 +2662,7 @@ __metadata:
"@types/lodash.upperfirst": "npm:^4.3.9"
"@types/uuid": "npm:^10.0.0"
archiver: "npm:^7.0.1"
axios: "npm:^1.7.5"
axios: "npm:^1.12.0"
bcrypt: "npm:^5.1.1"
body-parser: "npm:^1.20.3"
deep-equal: "npm:^2.2.3"