AIKIDO-2025-10673
@apollo/sandbox is vulnerable to Cross-Site Request Forgery (CSRF)
42
Medium Risk
This Affects:
@apollo/sandboxTL;DR
Affected versions of this package are vulnerable to a Cross-Site Request Forgery (CSRF) that allowed attackers to bypass authenticated cookies via postMessage requests due to missing origin validation. An attacker can exploit this vulnerability by tricking a user into visiting a malicious page, which would then send forged postMessage requests that were processed with the user's session, potentially leading to unauthorized actions.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@apollo/sandbox is vulnerable to Cross-Site Request Forgery (CSRF) in versions 0.1.0 - 2.7.2.
How to fix this
Upgrade the @apollo/sandbox library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant