Read the docs
TI-2016-08590 Aliases CVE-2016-10549GHSA-qmv4-jgp7-mf68

Improper access control in HackerOne sails node module

Priority LOW 21CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Security bypass, Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284 and CWE-79.

Summary

Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This would allow an attacker to make AJAX requests to vulnerable hosts through cross site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy. Note that this is only an issue when `allRoutes` is set to `true` and `origin` is set to `*` or left commented out in the sails CORS config file. The problem can be compounded when the cors `credentials` setting is not provided. At that point authenticated cross domain requests are possible.

Why it matters now

EPSS 0.00636 50th percentileScored 2026-11-07
Fix Fixed sails (npm): 0.12.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HackerOnesails node moduleup to 0.12.7—No fix listedCNA
—sails (npm)before 0.12.70.12.7Patch availableGHSA-qmv4-jgp7-mf68
  • sails node module VendorHackerOne Affected up to 0.12.7 Fixed in — No fix listed CNA
  • sails (npm) Vendor— Affected before 0.12.7 Fixed in 0.12.7 Patch available GHSA-qmv4-jgp7-mf68

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sailsjs:sails:*:*:*:*:*:node.js:*:*up to 0.12.7VulnerableSailsjs
  • cpe:2.3:a:sailsjs:sails:*:*:*:*:*:node.js:*:* Versions up to 0.12.7 Vulnerable ·Sailsjs

Remediation

  • Fix · GHSA-qmv4-jgp7-mf68 sails (npm) Fixed in 0.12.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-10549
  2. 2026-10-03 Alias added: GHSA-qmv4-jgp7-mf68
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 4

Other 4

  • TI-2021-20324 SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via… CVSS 3.1CRITICAL 9.8
  • TI-2023-19884 Sails DoS vulnerability for apps with sockets enabled CVSS 3.1HIGH 7.5
  • TI-2018-14998 Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences