CVE-2018-3743: Open Redirect in hekto
Summary
CVE-2018-3743: Open Redirect in hekto. Affects hekto versions < 0.2.4. Fixed in 0.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hekto is an npm package that provides functionality for handling HTML files. It allows users to manipulate and serve HTML content. However, versions of hekto before 0.2.4 are vulnerable to an open redirect issue when a domain name is used as part of the .html filename. This vulnerability can potentially be exploited by an attacker to redirect users to malicious websites.
Vulnerability Detail
The vulnerability in hekto arises from improper input validation when processing domain names in the filename. By crafting a malicious URL with a specially crafted domain name, an attacker can trick users into visiting a different website than intended. This can lead to various attacks, such as phishing or spreading malware. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 0.2.4 as of 22 Oct 2026
npm install hekto@0.2.4The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the hekto package to mitigate the risk of open redirect attacks.
Conclusion
The hekto package versions prior to 0.2.4 are vulnerable to an open redirect issue that can be exploited by attackers. To mitigate this vulnerability, it is crucial to update to version 0.2.4 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hekto →
FAQ
An open redirect vulnerability occurs when a web application redirects users to a different URL without proper validation. Attackers can exploit this vulnerability to redirect users to malicious websites.
This vulnerability can be exploited by attackers to trick users into visiting malicious websites, potentially leading to phishing attacks, malware infections, or other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, updating to version 0.2.4 or later of the hekto package will fix this vulnerability. Make sure to update your package using the command 'npm install hekto@0.2.4'.
No, there are no known workarounds for this vulnerability. It is essential to update to the fixed version of the hekto package to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for hekto.
