AIKIDO-2026-10466
@vnedyalk0v/react19-simple-maps is vulnerable to Server-Side Request Forgery (SSRF)
50
Medium Risk
This Affects:
@vnedyalk0v/react19-simple-mapsTL;DR
Affected versions of this package are vulnerable to server-side request forgery (SSRF) through insufficient validation of externally supplied geography URLs. The geography loading utilities accept user-controlled URLs and fetch remote TopoJSON/GeoJSON resources without enforcing strict protocol, host, or network boundary validation, allowing attacker-controlled input to trigger requests to internal services or private network addresses.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@vnedyalk0v/react19-simple-maps is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.0.0 - 2.0.3.
How to fix this
Upgrade the @vnedyalk0v/react19-simple-maps library to a patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant