TerriaJS vulnerabilities

🔔 Create alert RSS

Published CVEs affecting TerriaJS products: 1 record(s), with severity, exploitation and fixes.

Terriajs-server 1

Exploited only (KEV) →

CVE-2026-27818 High · 7.5 CWE-20 Feb 25, 2026

TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist

TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration. Version 4.0.3 fixes the issue.