npmPackage

@saltcorn/server

4 known vulnerabilities (1 critical, 1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: 1.6.4 (Nov 3, 2026): no advisory affects it
Newest unaffected release: 1.6.4 (Nov 3, 2026), the latest release
Advisories: 4 · 1 critical, 1 high, 2 medium

Weekly downloads: 8,041
Dependents: 1
Releases: 500+ since 0.7.2 (Jun 20, 2022)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-42259
Affects 0.7.2-beta.7 to 1.4.5 (1.4.6 is outside it); 1.5.0-beta.0 to 1.5.5 (1.5.6 is outside it); 1.6.0-alpha.0 to 1.6.0-beta.4 (1.6.0-beta.5 is outside it)
CVE-2026-41478
Affects 0.7.2-beta.7 to 1.4.5 (1.4.6 is outside it); 1.5.0-beta.0 to 1.5.5 (1.5.6 is outside it); 1.6.0-alpha.0 to 1.6.0-beta.4 (1.6.0-beta.5 is outside it)
CVE-2026-40163
Affects 0.7.2-beta.7 to 1.4.4 (1.4.5 is outside it); 1.5.0-beta.0 to 1.5.5-beta.0 (1.5.5 is outside it); 1.6.0-alpha.0 to 1.6.0-beta.3 (1.6.0-beta.4 is outside it)
CVE-2024-47818
Affects 0.7.2-beta.7 to 1.0.0-beta.15 (1.0.0-beta.16 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 4

CVE-2026-42259Medium 5.1
Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)
Affected: fixed in 1.4.6; from 1.5.0-beta.0, fixed in 1.5.6; from 1.6.0-alpha.0, fixed in 1.6.0-beta.5.
Fixed in 1.4.6 (released Apr 14, 2026, 23 days before disclosure), 1.5.6 (released Apr 14, 2026, 23 days before disclosure) and 1.6.0-beta.5 (released Apr 13, 2026, 24 days before disclosure).
The latest release, 1.6.4, is not affected.
79% of @saltcorn/server downloads last week were affected versions (3K).
CVE-2026-41478Critical 10.0
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)
Affected: fixed in 1.4.6; from 1.5.0-beta.0, fixed in 1.5.6; from 1.6.0-alpha.0, fixed in 1.6.0-beta.5.
Fixed in 1.4.6 (released Apr 14, 2026, 10 days before disclosure), 1.5.6 (released Apr 14, 2026, 10 days before disclosure) and 1.6.0-beta.5 (released Apr 13, 2026, 11 days before disclosure).
The latest release, 1.6.4, is not affected.
79% of @saltcorn/server downloads last week were affected versions (3K).
CVE-2026-40163High 8.2
Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read
Affected: fixed in 1.4.5; from 1.5.0-beta.0, fixed in 1.5.5; from 1.6.0-alpha.0, fixed in 1.6.0-beta.4.
Fixed in 1.4.5 (released Apr 8, 2026, 2 days before disclosure), 1.5.5 (released Apr 5, 2026, 5 days before disclosure) and 1.6.0-beta.4 (released Apr 5, 2026, 5 days before disclosure).
The latest release, 1.6.4, is not affected.
77% of @saltcorn/server downloads last week were affected versions (3K).
CVE-2024-47818Medium 6.5
Logged-in users with any role can delete arbitrary files in @saltcorn/server
Affected: fixed in 1.0.0-beta.16.
Fixed in 1.0.0-beta.16 (released Oct 6, 2024, 1 day before disclosure).
The latest release, 1.6.4, is not affected.
51% of @saltcorn/server downloads last week were affected versions (1.9K).