CVE-2021-3189

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://security.netapp.com/advisory/ntap-20210401-0004/Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2020-199-open-redirect-slashifyExploit, Third Party Advisory
https://www.npmjs.com/package/slashifyProduct
https://security.netapp.com/advisory/ntap-20210401-0004/Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2020-199-open-redirect-slashifyExploit, Third Party Advisory
https://www.npmjs.com/package/slashifyProduct

Timeline

Published: Feb 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-318909.1A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions CVE-2021-3189110.0A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Deb CVE-2021-318927.4A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMER CVE-2021-318937.8A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC CVE-2021-318948.8A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC CVE-2021-318958.1A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.7), RUGGEDCOM i801 (All versions < V4.3.7), RUGGEDCOM i802 (All v CVE-2021-318979.8In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects.CVE-2021-318987.5In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS.CVE-2021-318998.8In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode.CVE-2021-31909.8The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.t CVE-2021-319005.3In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host.CVE-2021-319017.5In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.