AIKIDO-2026-10239
@lightdash/common is vulnerable to Information Disclosure
10
Low Risk
This Affects:
@lightdash/commonTL;DR
Affected versions of this package allowed persistent file download URLs under /api/v1/file/ to be indexed by search engines because no crawler restrictions were in place. As a result, sensitive or private files could become discoverable via search queries, since nothing prevented well-behaved crawlers from indexing the 302 redirect targets. An attacker could simply use search engine dorks or automated indexing tools to discover exposed download URLs and retrieve files without needing to guess or brute-force identifiers, leading to unintended data disclosure.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@lightdash/common is vulnerable to Information Disclosure in versions 0.2455.0 - 0.2469.0.
How to fix this
Upgrade the @lightdash/common library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant