Threats affecting pkg:brew/firebase-cli

CVE-2024-4128 is a low-severity vulnerability in the Firebase CLI emulator suite that allows a potential Cross-Site Request Forgery (CSRF) attack. The issue arises from an export endpoint used to export data from running emulators. If a user runs the emulator and visits a malicious website on a browser that permits calls to localhost (notably Chrome versions before v94), the website could exfiltrate emulator data. This vulnerability affects firebase-cli versions from 3.6.1 up to but not including 13.6.0. The issue is fixed in version 13.6.0.