@saltcorn/admin-models (>=1.5.0 <=1.5.0-rc.2), @saltcorn/base-plugin (>=1.5.0 <=1.5.0-rc.2) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.5.0-beta.0 <=1.5.0)

@saltcorn/data NPM version =1.5.0-beta.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0-rc.2 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-16318351...

@saltcorn/cli (>=1.6.0-alpha.0 <=1.6.0-alpha.17), @saltcorn/mobile-builder (>=1.6.0-alpha.0 <=1.6.0-alpha.17) potentially affected by unknown CVE via @saltcorn/server (>=1.6.0-alpha.0 <=1.6.0-alpha.9)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.17 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-16318352...

Incorrect Authorization

Overview @saltcorn/server is a Server app for Saltcorn, open-source no-code platform Affected versions of this package are vulnerable to Incorrect Authorization through the role context evaluation process. An attacker can gain unauthorized administrative privileges on the root domain by...

@saltcorn/cli (>=1.5.0 <=1.5.0-rc.2), @saltcorn/mobile-builder (>=1.5.0 <=1.5.0-rc.2) potentially affected by unknown CVE via @saltcorn/server (>=1.5.0-beta.0 <=1.5.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0, =1.5.0, =1.5.0-rc.2 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-16318352...

@saltcorn/cli (>=1.0.0 <=1.4.3), @saltcorn/mobile-builder (>=1.0.0 <=1.4.3) potentially affected by unknown CVE via @saltcorn/server (>=1.0.0-beta.1 <=1.4.3)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0, =1.0.0, =1.4.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-16318352...

@saltcorn/cli (>=1.0.0 <=1.4.5), @saltcorn/mobile-builder (>=1.0.0 <=1.4.5) potentially affected by CVE-2026-42259 via @saltcorn/server (>=1.0.0-beta.1 <=1.4.5)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0, =1.0.0, =1.4.5 Source cves: CVE-2026-42259 Source advisory: SNYK:JS-SALTCORNSERVER-16111017...

@saltcorn/cli (>=1.5.0 <=1.5.5-beta.0), @saltcorn/mobile-builder (>=1.5.0 <=1.5.5-beta.0) potentially affected by CVE-2026-42259 via @saltcorn/server (>=1.5.0-beta.0 <=1.5.5)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0, =1.5.0, =1.5.5-beta.0 Source cves: CVE-2026-42259 Source advisory: SNYK:JS-SALTCORNSERVER-16111017...

@saltcorn/cli (>=1.6.0-alpha.0 <=1.6.0-beta.4), @saltcorn/mobile-builder (>=1.6.0-alpha.0 <=1.6.0-beta.4) potentially affected by CVE-2026-42259 via @saltcorn/server (>=1.6.0-alpha.0 <=1.6.0-beta.4)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.4 Source cves: CVE-2026-42259 Source advisory: OSV:GHSA-F3G8-9XV5-77GV...

@christianhugo/mobile-builder (>=0.7.3-beta.3 <=0.7.4-beta.9), @christianhugoch/cli (>=0.7.2-beta.12 <=0.7.2-beta.13) +4 more potentially affected by CVE-2026-42259 via @saltcorn/server (>=0.0.2 <=1.4.5)

@saltcorn/server NPM version =0.0.2, =0.7.3-beta.3, =0.7.2-beta.12, =0.0.2, =0.7.2, =0.0.2, =0.2.3-beta.2 Source cves: CVE-2026-42259 Source advisory: OSV:GHSA-F3G8-9XV5-77GV...

@saltcorn/cli (>=1.6.0-alpha.0 <=1.6.0-beta.4), @saltcorn/mobile-builder (>=1.6.0-alpha.0 <=1.6.0-beta.4) potentially affected by CVE-2026-42259 via @saltcorn/server (>=1.6.0-alpha.0 <=1.6.0-beta.4)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.4 Source cves: CVE-2026-42259 Source advisory: SNYK:JS-SALTCORNSERVER-16111017...

Open Redirect

Overview @saltcorn/server is a Server app for Saltcorn, open-source no-code platform Affected versions of this package are vulnerable to Open Redirect via the isrelativeurl function. An attacker can redirect users to an external, attacker-controlled domain by crafting a malicious URL that exploit...

@saltcorn/cli (>=1.5.0 <=1.5.5-beta.0), @saltcorn/mobile-builder (>=1.5.0 <=1.5.5-beta.0) potentially affected by CVE-2026-42259 via @saltcorn/server (>=1.5.0-beta.0 <=1.5.5)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0, =1.5.0, =1.5.5-beta.0 Source cves: CVE-2026-42259 Source advisory: OSV:GHSA-F3G8-9XV5-77GV...

@saltcorn/cli (>=1.5.0 <=1.5.5-beta.0), @saltcorn/mobile-builder (>=1.5.0 <=1.5.5-beta.0) potentially affected by CVE-2026-41478 via @saltcorn/server (>=1.5.0-beta.0 <=1.5.5)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0, =1.5.0, =1.5.5-beta.0 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNSERVER-16110989...

@saltcorn/cli (>=1.0.0 <=1.4.5), @saltcorn/mobile-builder (>=1.0.0 <=1.4.5) potentially affected by CVE-2026-41478 via @saltcorn/server (>=1.0.0-beta.1 <=1.4.5)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0, =1.0.0, =1.4.5 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNSERVER-16110989...

@christianhugo/mobile-builder (>=0.7.3-beta.3 <=0.7.4-beta.9), @christianhugoch/cli (>=0.7.2-beta.12 <=0.7.2-beta.13) +4 more potentially affected by CVE-2026-41478 via @saltcorn/server (>=0.0.2 <=1.4.5)

@saltcorn/server NPM version =0.0.2, =0.7.3-beta.3, =0.7.2-beta.12, =0.0.2, =0.7.2, =0.0.2, =0.2.3-beta.2 Source cves: CVE-2026-41478 Source advisory: OSV:GHSA-JP74-MFRX-3QVH...

@saltcorn/cli (>=1.6.0-alpha.0 <=1.6.0-beta.4), @saltcorn/mobile-builder (>=1.6.0-alpha.0 <=1.6.0-beta.4) potentially affected by CVE-2026-41478 via @saltcorn/server (>=1.6.0-alpha.0 <=1.6.0-beta.4)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.4 Source cves: CVE-2026-41478 Source advisory: OSV:GHSA-JP74-MFRX-3QVH...

@saltcorn/cli (>=1.6.0-alpha.0 <=1.6.0-beta.4), @saltcorn/mobile-builder (>=1.6.0-alpha.0 <=1.6.0-beta.4) potentially affected by CVE-2026-41478 via @saltcorn/server (>=1.6.0-alpha.0 <=1.6.0-beta.4)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.4 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNSERVER-16110989...

@saltcorn/cli (>=1.0.0 <=1.4.3), @saltcorn/mobile-builder (>=1.0.0 <=1.4.3) potentially affected by unknown CVE via @saltcorn/server (>=1.0.0-beta.1 <=1.4.3)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0, =1.0.0, =1.4.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15991556...

SQL Injection

Overview @saltcorn/server is a Server app for Saltcorn, open-source no-code platform Affected versions of this package are vulnerable to SQL Injection via the Literal function. An attacker can execute arbitrary SQL commands, manipulate database schema, or exfiltrate data by injecting crafted inpu...

@saltcorn/cli (>=1.6.0-alpha.0 <=1.6.0-alpha.17), @saltcorn/mobile-builder (>=1.6.0-alpha.0 <=1.6.0-alpha.17) potentially affected by unknown CVE via @saltcorn/server (>=1.6.0-alpha.0 <=1.6.0-alpha.9)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.17 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15991556...