GHSA-jqx4-9gpq-rppm: @misskey-dev/summaly allows IP Filter Bypass via Redirect

May 6, 2025

Due to a validation error in got.scpaping, it is possible to use an HTTP redirect to avoid IP filtering.

References

github.com/advisories/GHSA-jqx4-9gpq-rppm
github.com/misskey-dev/summaly
github.com/misskey-dev/summaly/commit/dfe6451012aac42eabe71d4ed721d8058c4066b4
github.com/misskey-dev/summaly/security/advisories/GHSA-jqx4-9gpq-rppm

Code Behaviors & Features

Detect and mitigate GHSA-jqx4-9gpq-rppm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →