uppy
Extensible JavaScript file upload widget with support for drag&drop, resumable uploads, previews, restrictions, file processing/encoding, remote providers like Dropbox, Google Drive, S3 and more :dog:
94%
Total Score
healthy
Healthy and actively maintained, with only minor workflow hygiene concerns.
Health Score Breakdown
All six workflows were analyzed with no untrusted checkout or script-injection findings. One release workflow has top-level write permissions, and five high-confidence low-severity findings report ad hoc package installation outside a lockfile, while 28 of 39 action references are unpinned; these are workflow hygiene concerns rather than severe risks.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2024-10443 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. uppy is vulnerable to Cross-Site Request Forgery (CSRF) in versions 0.27.0 - 4.6.0. | 0.27.0 - 4.6.0 | Low |
AIKIDO-2024-10409 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. uppy is vulnerable to Overly Permissive Cross-domain Whitelist in versions 3.5.0 - 4.5.0. | 3.5.0 - 4.5.0 | Low |
CVE-2022-0086 uppy is vulnerable to Server-Side Request Forgery (SSRF). | — | High |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 @uppy/box Version 5.0.0 | — | — |
@uppy/tus Version 6.0.0 | — | — |
@uppy/url Version 6.0.1 | — | — |
@uppy/core Version 6.2.0 | — | — |
@uppy/form Version 6.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 13 days ago
- Created
- 10 years ago
- Unpacked Size
- 5.9 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.