# @saltcorn/server (npm) vulnerabilities 4 known vulnerabilities (1 critical, 1 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.6.4 (Nov 3, 2026): no advisory affects it - Newest unaffected release: 1.6.4 (Nov 3, 2026), the latest release - Weekly downloads: 8,041 - Dependents: 1 - Releases: 500+ since 0.7.2 (Jun 20, 2022) - Registry: https://www.npmjs.com/package/@saltcorn/server - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-42259: 0.7.2-beta.7 to 1.4.5 (1.4.6 is outside it); 1.5.0-beta.0 to 1.5.5 (1.5.6 is outside it); 1.6.0-alpha.0 to 1.6.0-beta.4 (1.6.0-beta.5 is outside it) - CVE-2026-41478: 0.7.2-beta.7 to 1.4.5 (1.4.6 is outside it); 1.5.0-beta.0 to 1.5.5 (1.5.6 is outside it); 1.6.0-alpha.0 to 1.6.0-beta.4 (1.6.0-beta.5 is outside it) - CVE-2026-40163: 0.7.2-beta.7 to 1.4.4 (1.4.5 is outside it); 1.5.0-beta.0 to 1.5.5-beta.0 (1.5.5 is outside it); 1.6.0-alpha.0 to 1.6.0-beta.3 (1.6.0-beta.4 is outside it) - CVE-2024-47818: 0.7.2-beta.7 to 1.0.0-beta.15 (1.0.0-beta.16 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (4) ### [CVE-2026-42259](https://cve.now/CVE-2026-42259): Saltcorn: Open Redirect in \`POST /auth/login\` due to incomplete \`is\_relative\_url\` validation (backslash bypass) - Severity: Medium 5.1 - Published: May 7, 2026 - Affected: fixed in 1.4.6; from 1.5.0-beta.0, fixed in 1.5.6; from 1.6.0-alpha.0, fixed in 1.6.0-beta.5. - Fixed in 1.4.6 (released Apr 14, 2026, 23 days before disclosure), 1.5.6 (released Apr 14, 2026, 23 days before disclosure) and 1.6.0-beta.5 (released Apr 13, 2026, 24 days before disclosure). - The latest release, 1.6.4, is not affected. - 79% of @saltcorn/server downloads last week were affected versions (3K). ### [CVE-2026-41478](https://cve.now/CVE-2026-41478): Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) - Severity: Critical 10.0 - Published: Apr 24, 2026 - Affected: fixed in 1.4.6; from 1.5.0-beta.0, fixed in 1.5.6; from 1.6.0-alpha.0, fixed in 1.6.0-beta.5. - Fixed in 1.4.6 (released Apr 14, 2026, 10 days before disclosure), 1.5.6 (released Apr 14, 2026, 10 days before disclosure) and 1.6.0-beta.5 (released Apr 13, 2026, 11 days before disclosure). - The latest release, 1.6.4, is not affected. - 79% of @saltcorn/server downloads last week were affected versions (3K). ### [CVE-2026-40163](https://cve.now/CVE-2026-40163): Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read - Severity: High 8.2 - Published: Apr 10, 2026 - Affected: fixed in 1.4.5; from 1.5.0-beta.0, fixed in 1.5.5; from 1.6.0-alpha.0, fixed in 1.6.0-beta.4. - Fixed in 1.4.5 (released Apr 8, 2026, 2 days before disclosure), 1.5.5 (released Apr 5, 2026, 5 days before disclosure) and 1.6.0-beta.4 (released Apr 5, 2026, 5 days before disclosure). - The latest release, 1.6.4, is not affected. - 77% of @saltcorn/server downloads last week were affected versions (3K). ### [CVE-2024-47818](https://cve.now/CVE-2024-47818): Logged-in users with any role can delete arbitrary files in @saltcorn/server - Severity: Medium 6.5 - Published: Oct 7, 2024 - Affected: fixed in 1.0.0-beta.16. - Fixed in 1.0.0-beta.16 (released Oct 6, 2024, 1 day before disclosure). - The latest release, 1.6.4, is not affected. - 51% of @saltcorn/server downloads last week were affected versions (1.9K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@saltcorn/server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.