Open Redirect Vulnerability in hekto
Summary
GHSA-c5j4-vw9m-xc95: Open Redirect in hekto. Affects hekto versions < 0.2.4. Fixed in 0.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hekto is an npm package that provides functionality for redirecting URLs. It is commonly used in web applications to handle URL redirection. However, a vulnerability has been discovered in the package that allows for open redirects, potentially leading to phishing attacks or other malicious activities.
Vulnerability Detail
The vulnerability in hekto arises from a flaw in the URL redirection mechanism. Attackers can exploit this vulnerability by crafting a malicious URL that redirects users to a different website, which may be designed to deceive or trick them. This can be particularly dangerous in scenarios where the redirected website is controlled by the attacker and used for phishing or distributing malware. The vulnerability has been assigned a low severity rating.
How To Fix
Latest published version: 0.2.4 as of 22 Oct 2026
npm install hekto@0.2.4The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the latest version of hekto to ensure the issue is resolved.
Conclusion
The open redirect vulnerability in hekto can be a serious security risk, potentially leading to phishing attacks and the distribution of malware. It is crucial to update to the latest version of hekto (0.2.4 or later) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for hekto →
FAQ
An open redirect vulnerability is a security flaw that allows an attacker to redirect users to a different website using a manipulated URL. This can be exploited for phishing attacks or other malicious activities.
The open redirect vulnerability in hekto can be used by attackers to deceive users and redirect them to malicious websites. This can lead to phishing attacks, the distribution of malware, or other harmful activities.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a fix is available for this vulnerability. It is recommended to update hekto to version 0.2.4 or later to resolve the open redirect issue.
You can find more information about this vulnerability, including technical details and the fix, in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-c5j4-vw9m-xc95/GHSA-c5j4-vw9m-xc95.json
References
Related vulnerabilities
Recent vulnerabilities recorded for hekto.
