CVE-2020-8205: Server-Side Request Forgery in @uppy/companion
Summary
CVE-2020-8205: Server-Side Request Forgery in @uppy/companion. Affects @uppy/companion across 2 version ranges.
< 1.13.2
>= 2.0.0-alpha.0, < 2.0.0-alpha.5
Fixed in 1.13.2 or 2.0.0-alpha.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @uppy/companion npm package is a module that provides server-side functionality for the Uppy file uploader library. It is designed to handle file uploads, process them, and interact with storage providers. The package is widely used in web applications to facilitate file uploading and management.
Vulnerability Detail
The @uppy/companion package before versions 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability allows an attacker to manipulate the server-side requests made by the package, potentially leading to unauthorized access to internal systems or the scanning of local and external networks. An attacker could abuse this vulnerability to perform actions such as port scanning, accessing sensitive information, or launching attacks against other systems.
How To Fix
Latest published version: 7.2.0 as of 22 Oct 2026
npm install @uppy/companion@7.2.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.13.21.13.2npm install @uppy/companion@1.13.2 -
>= 2.0.0-alpha.0, < 2.0.0-alpha.52.0.0-alpha.5npm install @uppy/companion@2.0.0-alpha.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if updating the package is not immediately feasible, it is recommended to implement proper input validation and sanitization on the server-side to prevent SSRF attacks. This can include validating and restricting the URLs or IP addresses that the package is allowed to access, implementing whitelists or blacklists, and using secure protocols for communication.
Conclusion
The @uppy/companion package is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which can be exploited to manipulate server-side requests and potentially gain unauthorized access to internal systems or scan networks. It is crucial to update the package to the fixed versions mentioned or implement proper input validation and sanitization on the server-side. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @uppy/companion →
FAQ
This vulnerability allows an attacker to manipulate server-side requests, potentially leading to unauthorized access to internal systems or the scanning of networks. The impact can range from information disclosure to the compromise of sensitive data or the ability to launch further attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
Implementing proper input validation and sanitization on the server-side can help mitigate the risk of SSRF attacks. Additionally, using secure protocols for communication and restricting the URLs or IP addresses that the package is allowed to access can provide additional protection.
Yes, a patch is available for this vulnerability. It is recommended to update the @uppy/companion package to version 1.13.2 or later for the 1.x.x branch, or version 2.0.0-alpha.5 or later for the 2.x.x alpha branch.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-9m4x-8w29-r78g/GHSA-9m4x-8w29-r78g.json
Related vulnerabilities
Recent vulnerabilities recorded for @uppy/companion.
