CVE-2023-35167

6.3 mediumEPSS 0.5%

Medium (6.3) in remult remult. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in remult 0.20.6.

Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object instead of a function.

Severity

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2023-06-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

remult:remult

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-7hh3-3x64-v2g9	npm	remult	<0.20.6	0.20.6

References

Check your stack JSON