1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low1 (100.0%)
cedar-policy-cedar-wasm
Ecosystem: npm
Downloads: 1.73 Mln
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 1LowAffects 2 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 1
Vulnerabilities (1)
Known vulnerabilities affecting cedar-policy-cedar-wasm, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-c33x-vcv4-vg3g | Low | Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergenceCedar users must be using all of the following features to be affected by this advisory: JSON format policies, policy templates, and the `is in` scope condition. This advisory only affects JSON-formatted Cedar policy templates containing `is in` scope conditions that are **malformed** according to the Cedar syntax. It does **not** affect syntactically well-formed policies. Users of Cedar who author policies in the JSON format were able to write Cedar policies using the `is in` condition with an incorrect slot identifier in the principal and resource scope constraints (e.g., `?principal` in th |
| GitHub (opens in a new tab) |
- GHSA-c33x-vcv4-vg3gLowCedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
>= 4.0.1, < 4.11.1>= 3.2.0, < 3.4.3
Cedar users must be using all of the following features to be affected by this advisory: JSON format policies, policy templates, and the `is in` scope condition. This advisory only affects JSON-formatted Cedar policy templates containing `is in` scope conditions that are **malformed** according to the Cedar syntax. It does **not** affect syntactically well-formed policies. Users of Cedar who author policies in the JSON format were able to write Cedar policies using the `is in` condition with an incorrect slot identifier in the principal and resource scope constraints (e.g., `?principal` in th