TI-2024-24689 Aliases CVE-2024-37162 GHSA-wjmj-h3xc-hxp8

zsa Generates Error Messages Containing Sensitive Information

LOW 24CWE-209Published 2024-06-07 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-209.

Summary

zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine username and directory paths. An attacker could exploit this vulnerability to gain unauthorized access to sensitive server information. This information could be used to plan further attacks or gain a deeper understanding of the server infrastructure. This has been patched on `0.3.3`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00292 21st percentileScored 2026-11-07

Fix Fixed zsa (IdoPesok): 0.3.3zsa (npm): 0.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IdoPesok	zsa	before 0.3.3	0.3.3	Patch available	CNA
—	zsa (npm)	before 0.3.3	0.3.3	Patch available	GHSA-wjmj-h3xc-hxp8

zsa VendorIdoPesok Affected before 0.3.3 Fixed in 0.3.3 Patch available CNA
zsa (npm) Vendor— Affected before 0.3.3 Fixed in 0.3.3 Patch available GHSA-wjmj-h3xc-hxp8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:idopesok:zsa::::::::	before 0.3.3	Vulnerable	IdoPesok

cpe:2.3:a:idopesok:zsa:*:*:*:*:*:*:*:* Versions before 0.3.3 Vulnerable ·IdoPesok

Remediation

Fix · CNA zsa (IdoPesok) Fixed in 0.3.3
Fix · GHSA-wjmj-h3xc-hxp8 zsa (npm) Fixed in 0.3.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-37162
2026-10-03 Alias added: GHSA-wjmj-h3xc-hxp8

References

Patch 1

https://github.com/IdoPesok/zsa/commit/86b86b282bde6780963f62406cc8bc65f2c86f3a

Advisory 2

Other 1

https://github.com/IdoPesok/zsa

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences