Read the docs
TI-2020-07156 Aliases CVE-2020-8910GHSA-vh5w-fg69-rc8m

Auth Bypass in Google's Closure-Library

Priority LOW 30CWE-625Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.

Why it matters now

EPSS 0.00537 45th percentileScored 2026-11-07
Fix Fixed google-closure-library (npm): 20200315.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleClosure-Libraryv20200224 – v20200224—No fix listedCNA
—google-closure-library (npm)before 20200315.0.020200315.0.0Patch availableGHSA-vh5w-fg69-rc8m
  • Closure-Library VendorGoogle Affected v20200224 – v20200224 Fixed in — No fix listed CNA
  • google-closure-library (npm) Vendor— Affected before 20200315.0.0 Fixed in 20200315.0.0 Patch available GHSA-vh5w-fg69-rc8m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:google:closure_library:*:*:*:*:*:*:*:*before 20200315VulnerableGoogle
  • cpe:2.3:a:google:closure_library:*:*:*:*:*:*:*:* Versions before 20200315 Vulnerable ·Google

Remediation

  • Fix · GHSA-vh5w-fg69-rc8m google-closure-library (npm) Fixed in 20200315.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8910
  2. 2026-10-03 Alias added: GHSA-vh5w-fg69-rc8m

References

Patch 1

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences