{"schema":"threatline.record/2","record":{"id":"CVE-2026-107718","aliases":["GHSA-2m6q-8v3h-jqww"],"summary":"AdonisJS: Unencoded route parameters can produce open redirects","details":"Route parameters are inserted into generated URLs without URI encoding.\n\nWhen an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example:\n\n```ts\nrouter.get('/:page', handler).as('pages.show')\n\nresponse.redirect().toRoute('pages.show', {\n  page: '/evil.example.com',\n})\n```\n\nThis generates the following redirect:\n\n```http\nLocation: //evil.example.com\n```\n\nBrowsers interpret this value as an external URL and redirect the user to `https://evil.example.com`.\n\n## Details\n\nThe shared `createURL()` helper is used by route URL builders, including `Router.makeUrl()` and `Response.redirect().toRoute()`.\n\nRoute parameter values were appended without encoding:\n\n```ts\nif (isDefined) {\n  uriSegments.push(`${value}${token.end}`)\n}\n```\n\nWildcard parameters had the same behavior:\n\n```ts\nuriSegments.push(`${values.join('/')}${token.end}`)\n```\n\n**The issue does not affect APIs that intentionally accept complete redirect URLs. Exploitation requires an application to pass attacker-controlled data as a route parameter and use the generated URL as a redirect destination.**\n\n## Impact\n\nAn attacker may craft a link on a trusted application domain that redirects a victim to an attacker-controlled website.\n\nThis can facilitate phishing and may be chained with authentication or OAuth flows that rely on trusted redirect destinations.\n\nApplications are affected when they:\n- define a route whose first path segment is dynamic; and\n- pass request-derived data to that segment when generating a redirect URL.\n\n## Patches\n\nRoute parameter values are now encoded using `encodeURIComponent`.\n\nWildcard values are encoded individually before being joined with `/`, preserving their intended segment separators:\n\n```ts\nif (isDefined) {\n  uriSegments.push(`${encodeURIComponent(String(value))}${token.end}`)\n}\n```\n\n```ts\nuriSegments.push(\n  `${values.map((value) => encodeURIComponent(String(value))).join('/')}${token.end}`\n)\n```\n\nWith the fix, `/evil.example.com` becomes:\n\n```\n/%2Fevil.example.com\n```\n\nFixes targeting v6 and v7 have been published below.\n- https://github.com/adonisjs/http-server/releases/tag/v8.2.3\n- https://github.com/adonisjs/http-server/releases/tag/v9.3.0","categories":["Libraries & packages"],"product":"@adonisjs/http-server","vendor":"adonisjs","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-2m6q-8v3h-jqww","source_modified_at":"2026-10-08T22:09:07Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@adonisjs/http-server"},"range":">= 9.0.0, <= 9.2.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-2m6q-8v3h-jqww","source_modified_at":"2026-10-08T22:09:07Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@adonisjs/http-server"},"range":"<= 8.2.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107718","source_modified_at":"2026-10-14T01:24:14.635Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"http-server","vendor":"adonisjs","versions":[{"status":"affected","version":"< 8.2.3"},{"status":"affected","version":">= 9.0.0, < 9.3.0"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-2m6q-8v3h-jqww","source_modified_at":"2026-10-08T22:30:09.030589206Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"@adonisjs/http-server","ecosystem":"npm","purl":"pkg:npm/%40adonisjs/http-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.3.0"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-2m6q-8v3h-jqww","source_modified_at":"2026-10-08T22:30:09.030589206Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"@adonisjs/http-server","ecosystem":"npm","purl":"pkg:npm/%40adonisjs/http-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.2.3"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-2m6q-8v3h-jqww","source_modified_at":"2026-10-08T22:09:07Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@adonisjs/http-server"},"version":"9.3.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-2m6q-8v3h-jqww","source_modified_at":"2026-10-08T22:09:07Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@adonisjs/http-server"},"version":"8.2.3"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-2m6q-8v3h-jqww","source_modified_at":"2026-10-08T22:30:09.030589206Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"@adonisjs/http-server","ecosystem":"npm","purl":"pkg:npm/%40adonisjs/http-server"},"version":"9.3.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-2m6q-8v3h-jqww","source_modified_at":"2026-10-08T22:30:09.030589206Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"@adonisjs/http-server","ecosystem":"npm","purl":"pkg:npm/%40adonisjs/http-server"},"version":"8.2.3"}],"cvss":6.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00278,"percentile":0.19227,"score_date":"2026-10-23"},"published_at":"2026-10-08T21:39:54.474Z","modified_at":"2026-10-14T01:24:14.635Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-2m6q-8v3h-jqww","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T22:09:07Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107718","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-14T01:24:14.635Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-2m6q-8v3h-jqww","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-08T22:30:09.030589206Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107718","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/adonisjs/http-server/releases/tag/v8.2.3","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/adonisjs/http-server/releases/tag/v9.3.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-2m6q-8v3h-jqww","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-14T01:24:04.422529Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-14T01:24:14.635Z","content_hash":"fb8c4ddfd2bbc49eede2590a0c86fb045cb4b8af7548c1280ccf3529ab0c2326"}}