MIT License
Copyright
All Versions
Vulnerabilities (Public)
Known vulnerabilities and security issues detected in the extension's dependencies and code.
| Vulnerability ID | Advisory | Affected Versions | |||
|---|---|---|---|---|---|
| CVE-2022-2112 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2. https://github.com/inventree/InvenTree/security/advisories/GHSA-7rq4-qcpw-74gq | High | – | – | >=0,<0.7.2 |
| CVE-2022-2111 | Inventree 0.7.2 includes a fix for CVE-2022-2111: Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2. | High | – | – | >=0,<0.7.2 |
| SFTY-20241002-14095 | Inventree Server-Side Request Forgery vulnerability exposes server port/internal IP | Medium | – | – | < 0.16.5 |
| CVE-2022-3355 | Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue. | Medium | – | – | >=0,<0.8.3 |
| CVE-2022-2134 | Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0. | Medium | – | – | <0.8.0 |
| CVE-2022-2113 | Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2. | Medium | – | – | <0.7.2 |
| SFTY-20230426-27719 | Inventree 0.7.3 and 0.8.0 include a security fix: InvenTree uses EasyMDE for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models). By default… | Unknown | – | – | <0.7.3 |
| SFTY-20220617-61361 | Formula Injection in Exported Data | Unknown | – | – | < 0.7.2 |
Safety Discovered Vulnerabilities
Additional security issues found by Safety, exclusive to our platform.