Configuration Override Affecting helmet-csp package, versions >=1.2.2 <2.9.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-HELMETCSP-469436
- published 29 Sep 2019
- disclosed 20 Sep 2019
- credit William Durand
How to fix?
Upgrade helmet-csp to version 2.9.2 or higher.
Overview
helmet-csp is a Content Security Policy that helps prevent unwanted content being injected into your webpages.
Affected versions of this package are vulnerable to Configuration Override affecting the application's Content Security Policy (CSP). It's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP.
References
CVSS Scores
version 3.1