What’s Vulnerable › Vulnerabilities

CVE-2023-35167: When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-23 · updated 2026-06-17
• Weakness: CWE-284

Description

Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object instead of a function.

Affected products

• remult: before 0.20.6 — fixed in 0.20.6

How to fix

Upgrade to a fixed version: remult 0.20.6. Check the vendor advisory for mitigations.

References

• https://github.com/remult/remult/commit/6892ae97134126d8710ef7302bb2fc37730994c5
• https://github.com/remult/remult/releases/tag/v0.20.6
• https://github.com/remult/remult/security/advisories/GHSA-7hh3-3x64-v2g9
• https://github.com/remult/remult/commit/6892ae97134126d8710ef7302bb2fc37730994c5
• https://github.com/remult/remult/releases/tag/v0.20.6
• https://github.com/remult/remult/security/advisories/GHSA-7hh3-3x64-v2g9

Get alerted when CVE-2023-35167 or the next vulnerability affects your stack