fix(deps): update dependency firebase to v10 [security] by renovate[bot] · Pull Request #353 · NodeBB/nodebb-plugin-firebase

renovate · 2024-11-18T22:49:09Z

This PR contains the following updates:

Package	Change	Age	Confidence
firebase (source, changelog)	`^9.0.0` → `^10.0.0`

Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server

CVE-2024-11023 / GHSA-3wf4-68gx-mph8

More information

Details

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow am actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

Severity

CVSS Score: 5.2 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

firebase/firebase-js-sdk (firebase)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot changed the title ~~fix(deps): update dependency firebase to v10 [security]~~ fix(deps): update dependency firebase to v10 [security] - autoclosed Dec 8, 2024

renovate Bot closed this Dec 8, 2024

renovate Bot deleted the renovate/npm-firebase-vulnerability branch December 8, 2024 18:37

renovate Bot changed the title ~~fix(deps): update dependency firebase to v10 [security] - autoclosed~~ fix(deps): update dependency firebase to v10 [security] Dec 8, 2024

renovate Bot reopened this Dec 8, 2024

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch 2 times, most recently from b5f6f1f to 5372a2e Compare December 10, 2024 16:32

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 5372a2e to e4ab619 Compare January 23, 2025 12:23

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from e4ab619 to d5a7f20 Compare May 2, 2025 22:05

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch 2 times, most recently from b52c496 to 384bcb0 Compare May 16, 2025 23:40

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 384bcb0 to 5d82f22 Compare June 21, 2025 00:13

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 5d82f22 to 15b961d Compare August 10, 2025 12:36

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 15b961d to dc07b6a Compare August 19, 2025 14:44

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from dc07b6a to 973e478 Compare August 31, 2025 13:10

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 973e478 to 057d814 Compare September 22, 2025 10:06

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 057d814 to 1607b69 Compare October 21, 2025 14:14

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 1607b69 to 378913a Compare November 10, 2025 13:48

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 378913a to 751cd9a Compare December 3, 2025 17:14

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 751cd9a to b677c72 Compare December 31, 2025 14:31

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from b677c72 to e1cc332 Compare January 8, 2026 19:36

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from e1cc332 to e635378 Compare January 19, 2026 18:04

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch 2 times, most recently from 70cb1b0 to 786a3c3 Compare February 7, 2026 00:39

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch 2 times, most recently from 31eea10 to 197d653 Compare March 5, 2026 15:44

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch 2 times, most recently from 41f91d0 to 79eb5c5 Compare March 14, 2026 22:08

renovate Bot changed the title ~~fix(deps): update dependency firebase to v10 [security]~~ fix(deps): update dependency firebase to v10 [security] - autoclosed Mar 27, 2026

renovate Bot closed this Mar 27, 2026

renovate Bot changed the title ~~fix(deps): update dependency firebase to v10 [security] - autoclosed~~ fix(deps): update dependency firebase to v10 [security] Mar 30, 2026

renovate Bot reopened this Mar 30, 2026

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch 2 times, most recently from 79eb5c5 to 34492a0 Compare March 30, 2026 18:02

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 34492a0 to ba6b408 Compare April 8, 2026 17:36

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from ba6b408 to 08fd89e Compare April 25, 2026 09:53

renovate Bot changed the title ~~fix(deps): update dependency firebase to v10 [security]~~ fix(deps): update dependency firebase to v10 [security] - autoclosed Apr 27, 2026

renovate Bot closed this Apr 27, 2026

renovate Bot changed the title ~~fix(deps): update dependency firebase to v10 [security] - autoclosed~~ fix(deps): update dependency firebase to v10 [security] Apr 27, 2026

renovate Bot reopened this Apr 27, 2026

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch 2 times, most recently from 090130c to 4b2d82e Compare April 29, 2026 20:36

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch 2 times, most recently from 8448381 to daddc6d Compare May 12, 2026 11:26

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from daddc6d to 937bbc4 Compare May 18, 2026 17:01

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch 3 times, most recently from aaacea6 to 816b031 Compare May 31, 2026 14:09

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 816b031 to 6da885a Compare June 11, 2026 12:14

fix(deps): update dependency firebase to v10 [security]

bc85914

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 6da885a to bc85914 Compare July 12, 2026 16:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update dependency firebase to v10 [security]#353

fix(deps): update dependency firebase to v10 [security]#353
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-firebase-vulnerability

renovate Bot commented Nov 18, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Nov 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server

Details

Severity

References

Release Notes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Nov 18, 2024 •

edited

Loading