CVE-2020-8135

The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal systems.

Recent assessments:

ericalexanderorg at March 21, 2020 1:52pm UTC reported:

SSRF in npm package that’s downloaded 23k/week and is found in 4k Github repos. High because of it’s value to grab access keys from cloud metadata urls.

<https://hackerone.com/reports/786956&gt;

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 5