Threats tagged 'ghsa-mmqv-w2cj-h47f'

Zipline versions before 4.5.0 have a stored open redirect vulnerability that allows authenticated users to create short URLs redirecting to arbitrary destinations, including potentially malicious javascript: URIs. This flaw arises from missing scheme validation in the POST /api/user/urls endpoint. Exploitation could lead visitors of trusted short links to phishing or malware sites.