TI-2020-06546 Aliases CVE-2020-8128 GHSA-5fjj-cfh2-ghc5

Server-side request forgery in jsreport

MEDIUM 47CWE-829Published 2020-02-14 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-829.

Summary

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code.

Why it matters now

EPSS 0.02692 85th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed jsreport (npm): 2.6.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	jsreport	Fixed version: 2.6.1	—	No fix listed	CNA
—	jsreport (npm)	before 2.6.0	2.6.0	Patch available	GHSA-5fjj-cfh2-ghc5

jsreport Vendor— Affected Fixed version: 2.6.1 Fixed in — No fix listed CNA
jsreport (npm) Vendor— Affected before 2.6.0 Fixed in 2.6.0 Patch available GHSA-5fjj-cfh2-ghc5

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jsreport:jsreport::::::node.js::*	up to 2.5.0	Vulnerable	jsreport

cpe:2.3:a:jsreport:jsreport:*:*:*:*:*:node.js:*:* Versions up to 2.5.0 Vulnerable ·jsreport

Remediation

Fix · GHSA-5fjj-cfh2-ghc5 jsreport (npm) Fixed in 2.6.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-8128
2026-10-03 Alias added: GHSA-5fjj-cfh2-ghc5

References

Exploit 1

https://hackerone.com/reports/660565

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2020-8128

TI-2023-02413 Code Injection in jsreport/jsreport CVSS 3.1CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences