CVE-2026-27818Disclosure(terria / terriajs-server)

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration. Version 4.0.3 fixes the issue.

terria CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/TerriaJS/terriajs-server/commit/3aaa5d9717162b245ae4569232bbe7d8673c913f

Vendor / third-party advisories

https://github.com/TerriaJS/terriajs-server/security/advisories/GHSA-w789-49fc-v8hr

Weakness type (CWE)

CWE-20CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

terriajs-server

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Affected systems

Vendors

terria

Products

terriajs-server

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

cvereports@_cvereports225d
Disclosure
CVE-2026-27818: Close But No Cigar: The TerriaJS SSRF Suffix Bypass A classic string validation error in the TerriaJS-Server proxy controller allowed attackers to bypass domain allowlists. By relying on a primitive `indexOf` check to validate hostname... https://cvereports.com/reports/CVE-2026-27818
Post summary
The post discloses a string validation flaw in TerriaJS‑Server that enables an SSRF suffix bypass via an `indexOf` check, but it does not provide a PoC, exploit code, patch, or evidence of active exploitation.
0000031
32 followersView on X
CVE@CVEnew225d
Disclosure
CVE-2026-27818 TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allow… https://www.cve.org/CVERecord?id=CVE-2026-27818
Post summary
The post announces CVE-2026-27818, a validation bug in TerriaJS-Server versions before 4.0.3, without providing PoC, exploit, or patch details.
00000119
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	terria	terriajs-server	-	node.js	-

Explore more

Back to dashboard terria CVEs terriajs-server vulnerabilities