Homepage
About Snyk

cypress@3.4.1 vulnerabilities

Cypress is a next generation front end testing tool built for the modern web

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the cypress package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Insecure Configuration

Affected versions of this package are vulnerable to Insecure Configuration. JavaScript inserted as part of a test has the ability to execute arbitrary code due to contextIsolation setting not being set within webpreferences.

PoC

<onmouseover="alert(1)"> <s onmouseover="var os = require('os'); var hostname = os.platform(); var homedir = os.homedir(); alert('Host:' + hostname + 'directory: ' + homedir);">Hallo</s>

How to fix Insecure Configuration?

Upgrade cypress to version 7.2.0 or higher.

<7.2.0
Go back to all versions of this package