vulnerability report (severity is: 6)

[its-dibo]

Dependency Hierarchy

node-telegram-bot-api-0.66.0.tgz
request-promise-5.0.0.tgz
request-promise-core-1.1.3.tgz
❌ request-2.88.2.tgz (Vulnerable Library)

Vulnerability Details

The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Publish Date: 2023-03-16