Read the docs
TI-2020-19418 Aliases GHSA-whrh-9j4q-g7ph

CSRF Vulnerability in polaris-website

Priority LOW 38CWE-352Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Tampering
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-352.

Summary

### Impact CSRF vulnerability: In some very specific circumstances, an attacker would be able to update your settings. Basically you would need to navigate to hackersite.com while logged into our panel. Then they could modify your settings. They couldn't check if it worked, nor could they read your settings. ### Patches As of v1.1.1 this has been patched by implementing the Double submit pattern using a cookie. ### For more information If you have any questions or comments about this advisory: * Open an issue in [Polaris-React](https://github.com/polaris-rbx/polaris-react) * Email us at [[email protected]](mailto:[email protected]) * Join our discord (preferred): https://discord.gg/QevWabU

Why it matters now

Fix Fixed polaris-website (npm): 1.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—polaris-website (npm)before 1.1.11.1.1Patch availableGHSA-whrh-9j4q-g7ph
  • polaris-website (npm) Vendor— Affected before 1.1.1 Fixed in 1.1.1 Patch available GHSA-whrh-9j4q-g7ph

Remediation

  • Fix · GHSA-whrh-9j4q-g7ph polaris-website (npm) Fixed in 1.1.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-whrh-9j4q-g7ph

References

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences