p PatchFirst

PatchFirst · Latest vulnerabilities

workflow vulnerabilities

Vulnerabilities published for workflow in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. GHSA-9r75-g2cr-3h76

    Medium · CVSS 5.3Fix available

    Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens

    `createWebhook()` in Vercel Workflow DevKit accepts a user-specified `token` parameter that serves as the credential for the public webhook endpoint `/.well-known/workflow/v1/webhook/{token}`. Official documentation recommended predictable token patterns, making it possible for an unauthenticated remote attacker to guess the token and inject arbitrary payloads into the workflow execution context. #### Impact An attacker who guesses a webhook token can resume the associated workflow with an attacker-controlled HTTP request body, potentially triggering downstream side effects such as API calls, database writes, or deployments. #### Fix * Up

    workflowNode.js
    • Update to 4.2.0-beta.64
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →