CVE-2020-11003: CSRF and DNS Rebinding in @fraction/oasis
Summary
CVE-2020-11003: CSRF and DNS Rebinding in Oasis. Affects @fraction/oasis versions < 2.15.0. Fixed in 2.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @fraction/oasis package is an npm package used for running applications on a computer. It provides various functionalities for managing and running applications. However, it is vulnerable to CSRF (Cross-Site Request Forgery) and DNS Rebinding attacks. These vulnerabilities can be exploited if a user visits a malicious website while running a vulnerable application on their computer. The attacker can use DNS rebinding to trick the user's browser into making requests to the vulnerable application, allowing them to read or write sensitive data. It is important to note that there is no evidence of these vulnerabilities being exploited in the wild.
Vulnerability Detail
The CSRF and DNS Rebinding vulnerabilities in @fraction/oasis can be exploited by tricking a user into visiting a malicious website. The attacker can use DNS rebinding to make the user's browser send requests to the vulnerable application running on the user's computer. This allows the attacker to perform actions on behalf of the user, potentially leading to unauthorized access, data leakage, or other malicious activities. The vulnerabilities have been assigned a CVSS score of 4.8, indicating a moderate severity level.
How To Fix
Latest published version: 2.17.0 as of 22 Oct 2026
npm install @fraction/oasis@2.17.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.15.0
This is the first release that contains the fix.
npm install @fraction/oasis@2.15.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The @fraction/oasis package is vulnerable to CSRF and DNS Rebinding attacks. To protect your application, it is crucial to upgrade to version 2.15.0, which includes patches for these vulnerabilities. There is no evidence of these vulnerabilities being exploited in the wild, but it is still recommended to update to ensure the security of your application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @fraction/oasis →
FAQ
CSRF stands for Cross-Site Request Forgery. It is an attack that tricks the victim into submitting a malicious request. In the case of @fraction/oasis, CSRF can be used to perform actions on behalf of the user without their consent.
DNS rebinding is a technique used by attackers to bypass the same-origin policy enforced by web browsers. It involves changing the DNS resolution of a domain name to point to different IP addresses, allowing the attacker to make the victim's browser send requests to a different location.
You can check the version of @fraction/oasis installed in your project by running the following command in your project's directory: npm list @fraction/oasis
No, there is no evidence of these vulnerabilities being exploited in the wild. However, it is still important to update to the patched version to ensure the security of your application.
No, the only way to mitigate these vulnerabilities is to upgrade to version 2.15.0 of @fraction/oasis.
