CVE-2026-27818CWE-20CWE-918

TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist

High · published February 26, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
34.8
In the wild
Unconfirmed
What it is

TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration. Version 4.0.3 fixes the issue.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00416 · 34.8th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-02-26T00:02Z
EPSS history
Timeline
  • 26 FEB 00:02Z
    TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist
    cvelistv5