Medium severity5.0NVD Advisory· Published Jun 23, 2023· Updated Jun 17, 2026
CVE-2023-35167
CVE-2023-35167
Description
Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the @Entity decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the id of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the apiPrefilter option to a filter object instead of a function.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
remultnpm | < 0.20.6 | 0.20.6 |
Affected products
3Patches
Vulnerability mechanics
References
5- github.com/remult/remult/commit/6892ae97134126d8710ef7302bb2fc37730994c5nvdPatchWEB
- github.com/advisories/GHSA-7hh3-3x64-v2g9ghsaADVISORY
- github.com/remult/remult/security/advisories/GHSA-7hh3-3x64-v2g9nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-35167ghsaADVISORY
- github.com/remult/remult/releases/tag/v0.20.6nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.