{"id":"CVE-2024-4128","aliases":["GHSA-rcm2-22f3-pqv3","GO-2024-2808"],"url":"https://o3.security/vulnerability/CVE-2024-4128","summary":"CSRF in firebase-tools emulator suite","details":"This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed calls to localhost (ie Chrome before v94), the website could exfiltrate emulator data. We recommend upgrading past version 13.6.0 or commit  068a2b08dc308c7ab4b569617f5fc8821237e3a0 https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0 \n","published":"2024-05-02T13:22:50.829Z","modified":"2026-08-12T03:51:46.544977472Z","cvss":{"score":2.6,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"firebase-tools","fixedVersion":"13.6.0"}],"fix":{"url":"https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0","label":"firebase/firebase-tools@068a2b0"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4128.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4128"},{"type":"FIX","url":"https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0"},{"type":"FIX","url":"https://github.com/firebase/firebase-tools/pull/6944"},{"type":"PACKAGE","url":"https://github.com/firebase/firebase-tools"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:46.544977472Z"}}