Homepage

@actual-app/sync-server@25.11.0-nightly.20251022 vulnerabilities

actual syncing server

  • latest version

    25.11.0

  • latest non vulnerable version

    25.12.0-nightly.20251104

  • first published

    6 months ago

  • latest version published

    16 hours ago

  • licenses detected

  • View sync-server package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @actual-app/sync-server package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Information Exposure

    @actual-app/sync-server is an actual syncing server

    Affected versions of this package are vulnerable to Information Exposure via the console.log and console.debug functions, which log sensitive response payloads from external services, including bearer tokens, account numbers, and personally identifiable information, to standard output and log files. An attacker can gain unauthorized access to confidential information by obtaining access to these logs in environments where logs are accessible to unauthorized parties, such as shared or managed hosting environments.

    How to fix Information Exposure?

    Upgrade @actual-app/sync-server to version 25.11.0 or higher.

    <25.11.0
    Go back to all versions of this package