Read the docs

chaskiq

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

chaskiq records in CISA KEV

No chaskiq vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Chaskiq 2 records LOW

Records

6 records

TI-2026-75449 CVE-2026-111663 · GHSA-rggr-4j68-hc5w

Chaskiq SSRF via createUrlUpload GraphQL Mutation

Priority HIGH 79

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00374 Published 2026-10-16 No fix listed CWE-918
TI-2026-75448 CVE-2026-111662 · GHSA-938p-qgmw-f5v3

Chaskiq Unauthenticated SSRF via /oembed Endpoint

Priority HIGH 70

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0039 Published 2026-10-16 No fix listed CWE-918
TI-2026-50796 CVE-2026-72536 · GHSA-8wp4-ghqw-4g3h

Chaskiq Chaskiq - Missing Authentication

Priority MEDIUM 42

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00573 Published 2026-08-11 No fix listed CWE-306
TI-2026-50795 CVE-2026-72535 · GHSA-hqqc-4mgp-grm6

Chaskiq Chaskiq - Missing Authentication

Priority MEDIUM 42

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00573 Published 2026-08-11 No fix listed CWE-306
TI-2021-02784 CVE-2021-3853 · GHSA-5xxh-8vm7-3hmm

Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq

Priority LOW 28

chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00616 Published 2022-01-17 Fixed in 0.9.8 CWE-79
TI-2021-02788 CVE-2021-3857 · GHSA-c6rr-f65f-365x

Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq

Priority LOW 25

chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.006 Published 2022-01-17 No fix listed CWE-79
Open these records in search →