Server-side request forgery (SSRF) in osm-static-maps
Priority LOW 36CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.
Why it matters now
EPSS 0.016 75th percentileScored 2026-11-07
Fix Fixed osm-static-maps (npm): 3.9.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | osm-static-maps | all versions | — | No fix listed | CNA |
| — | osm-static-maps (npm) | before 3.9.0 | 3.9.0 | Patch available | GHSA-pxcf-v868-m492 |
- osm-static-maps Vendor— Affected all versions Fixed in — No fix listed CNA
- osm-static-maps (npm) Vendor— Affected before 3.9.0 Fixed in 3.9.0 Patch available GHSA-pxcf-v868-m492
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:osm-static-maps_project:osm-static-maps:*:*:*:*:*:node.js:*:* | all versions | Vulnerable | Osm-static-maps Project |
- cpe:2.3:a:osm-static-maps_project:osm-static-maps:*:*:*:*:*:node.js:*:* Versions all versions Vulnerable ·Osm-static-maps Project
Remediation
- Fix · GHSA-pxcf-v868-m492 osm-static-maps (npm) Fixed in 3.9.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7749
- 2026-10-03 Alias added: GHSA-pxcf-v868-m492
References
Sources
- CVE-2020-7749 · CVE Program
- CVE-2020-7749 · NVD
- FIRST EPSS
- GHSA-pxcf-v868-m492 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences