漏洞关键信息 漏洞标题 Domain validation bypass in proxy allowlist 漏洞ID GHSA-w789-49fc-v8hr 漏洞严重性 High (8.7/10) 受影响版本 <4.0.3 修复版本 4.0.3 漏洞描述 A validation bug allows an attacker to proxy domains not explicitly allowed in the proxyableDomains configuration. The validation only checks if a hostname ended with an allowed domain. 影响 If example.com is allowed in proxyableDomains: example.com is allowed (correct) api.example.com is allowed (correct) maliciousexample.com is allowed (incorrect) An attacker could register maliciousexample.com and proxy content through terriajs-server, bypassing proxy restrictions. 修复建议 Upgrade to 4.0.3 to address the vulnerability. CVSS v4 基本指标 攻击向量: Network 攻击复杂度: Low 攻击需求: None 需要的权限: None 用户交互: None 机密影响: None 完整性影响: High 可用性影响: None 子系统影响指标 机密性: None 完整性: None 可用性: None CVE ID CVE-2026-27818 弱点 No CWEs