Threats affecting pkg:github/transmission

Transmission versions 4.0.0 through 4.1.2 have a permissive Cross-Origin Resource Sharing (CORS) vulnerability in the handle_request() function of rpc-server.cc. This flaw exposes the X-Transmission-Session-Id anti-CSRF token to any web origin, allowing malicious web pages to read and reuse the token to perform unauthorized RPC calls. Exploitation can lead to script-torrent-done execution, changes to the download directory, or deletion of torrents and data. The vulnerability is fixed in version 4.1.3.

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.