CVE-2022-0437

Summary: The CVE-2022-0437 issue affects the karma-runner project (NPM package karma) prior to 6.3.14, with a DOM-based cross-site scripting vulnerability in the client-side DOM. The underlying cause is a DOM-based XSS condition that could allow arbitrary JavaScript execution in the victim’s brow...

CVE-2021-23495

Summary: Karma (JavaScript test runner) before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter. Affected component: karma