{"id":"CVE-2026-27818","aliases":["GHSA-w789-49fc-v8hr"],"url":"https://o3.security/vulnerability/CVE-2026-27818","summary":"TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist","details":"### Impact\nA validation bug allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration.\n\nThe validation only checks if a hostname _ended_ with an allowed domain. This meant:\n\nIf `example.com` is allowed in `proxyableDomains`:\n\n- ✅ example.com is allowed (correct)\n- ✅ api.example.com is allowed (correct)\n- ⚠️ maliciousexample.com is allowed (incorrect)\n\nAn attacker could register maliciousexample.com and proxy content through `terriajs-server`, bypassing proxy restrictions.\n\n### Patches\nAll versions up to 4.0.2 are affected. Upgrade to 4.0.3 to address the vulnerability.","published":"2026-02-26T00:02:45.127Z","modified":"2026-10-28T02:30:49.781975038Z","cvss":null,"epss":{"score":0.00241,"percentile":0.14986,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"terriajs-server","fixedVersion":"4.0.3"}],"fix":{"url":"https://github.com/TerriaJS/terriajs-server/commit/3aaa5d9717162b245ae4569232bbe7d8673c913f","label":"TerriaJS/terriajs-server@3aaa5d9"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27818.json"},{"type":"ADVISORY","url":"https://github.com/TerriaJS/terriajs-server/security/advisories/GHSA-w789-49fc-v8hr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27818"},{"type":"FIX","url":"https://github.com/TerriaJS/terriajs-server/commit/3aaa5d9717162b245ae4569232bbe7d8673c913f"},{"type":"PACKAGE","url":"https://github.com/TerriaJS/terriajs-server"},{"type":"WEB","url":"https://github.com/TerriaJS/terriajs-server/releases/tag/4.0.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:49.781975038Z"}}