hao/websafe-kb
1
0
派生 0
代码 工单 合并请求 1 工作流 软件包 项目 发布 百科 活动

更新: 178 个文件 - 2026-03-18 07:47:37

浏览代码
这个提交包含在：
hao
2026-03-18 07:47:37 -07:00
父节点 63d89f2b0c
当前提交 91d6f4d04e
共修改 178 个文件，包含 1690 行新增和 16615 行删除
下载 Patch 文件 下载 Diff 文件 展开所有文件 折叠所有文件

98
08-threat-intel/registry/advisories/nextjs--CVE-2021-39178.json
查看文件

@@ -1,98 +0,0 @@
{
"canonical_id": "nextjs--CVE-2021-39178",
"system_id": "nextjs",
"display_name": "Next.js",
"category": "frameworks",
"advisory_mode": "core",
"title": "XSS in Image Optimization API for Next.js",
"summary": "XSS in Image Optimization API for Next.js",
"published_at": "2021-09-01T18:24:22Z",
"updated_at": "2026-03-13T22:00:20.154452Z",
"severity": "low",
"cvss_score": null,
"exploit_status": "unknown",
"source_confidence": "official",
"official_source_url": "https://github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m",
"secondary_source_urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2021-39178",
"https://github.com/vercel/next.js/pull/28620",
"https://github.com/vercel/next.js/commit/7afc97c5744b38bdf36aa7f87625f438224688aa",
"https://github.com/vercel/next.js",
"https://github.com/vercel/next.js/releases/tag/v11.1.1"
],
"aliases": [
"CVE-2021-39178",
"GHSA-9gr3-7897-pp7m"
],
"cve_ids": [
"CVE-2021-39178"
],
"ghsa_ids": [
"GHSA-9gr3-7897-pp7m"
],
"osv_ids": [],
"affected_versions": [
"introduced=10.0.0, fixed<11.1.1"
],
"fixed_versions": [
"11.1.1"
],
"package_name": "next",
"render_markdown": true,
"case_path": "07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-39178.md",
"secure_code_topics": [
"authz-server-side-recheck",
"proxy-trust-boundary",
"token-cookie-storage",
"xss-output-encoding"
],
"status": "generated",
"triage_reasons": [],
"verification_status": "verified-real",
"verification_mode": "real",
"last_verified_at": "2026-03-18T01:30:38+00:00",
"last_run_id": "nextjs-nextjs--CVE-2021-39178-20260318013032",
"evidence_bundle": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032",
"browser_evidence": {
"required": true,
"present": true,
"refs": [
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/assets/baseline.png",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/assets/baseline-dom.html",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/logs/baseline-console.json",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/logs/baseline-network.json",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/logs/baseline-page.json",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/assets/proof.png",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/assets/proof-dom.html",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/logs/proof-console.json",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/logs/proof-network.json",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/logs/proof-page.json"
],
"baseline_refs": [
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/assets/baseline.png",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/assets/baseline-dom.html",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/logs/baseline-console.json",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/logs/baseline-network.json",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/logs/baseline-page.json"
],
"proof_refs": [
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/assets/proof.png",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/assets/proof-dom.html",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/logs/proof-console.json",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/logs/proof-network.json",
"/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318013032/logs/proof-page.json"
],
"baseline_title": "Next.js XSS Fixture",
"proof_title": "Next.js XSS Fixture - proof",
"error_kind": null,
"reason": null
},
"repro_profile_id": "nextjs-authz-bypass",
"artifact_mode": "local-fixture",
"blocked_reason": null,
"metadata": {
"source_names": [],
"source_kinds": [],
"candidate_count": 1
}
}