karma (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package karma, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2022-0437 — CVSS 6.1 (medium): Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.
• CVE-2021-23495 — CVSS 5.4 (medium): The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.