Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-tmbb-dn8n-tqeq
Vulnerability ID VCID-tmbb-dn8n-tqeq
Aliases CVE-2021-23495
GHSA-rc3x-jf5g-xvc5
Summary Open redirect in karma
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00255 https://api.first.org/data/v1/epss?cve=CVE-2021-23495
epss 0.00255 https://api.first.org/data/v1/epss?cve=CVE-2021-23495
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-rc3x-jf5g-xvc5
cvssv3.1 5.4 https://github.com/karma-runner/karma
generic_textual MODERATE https://github.com/karma-runner/karma
cvssv3.1 5.4 https://github.com/karma-runner/karma/commit/ff7edbb2ffbcdd69761bece86b7dc1ef0740508d
generic_textual MODERATE https://github.com/karma-runner/karma/commit/ff7edbb2ffbcdd69761bece86b7dc1ef0740508d
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2021-23495
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-23495
cvssv3.1 5.4 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2412347
generic_textual MODERATE https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2412347
cvssv3.1 5.4 https://snyk.io/vuln/SNYK-JS-KARMA-2396325
generic_textual MODERATE https://snyk.io/vuln/SNYK-JS-KARMA-2396325
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-23495
https://github.com/karma-runner/karma
https://github.com/karma-runner/karma/commit/ff7edbb2ffbcdd69761bece86b7dc1ef0740508d
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2412347
https://snyk.io/vuln/SNYK-JS-KARMA-2396325
CVE-2021-23495 https://nvd.nist.gov/vuln/detail/CVE-2021-23495
GHSA-rc3x-jf5g-xvc5 https://github.com/advisories/GHSA-rc3x-jf5g-xvc5
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/karma-runner/karma
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/karma-runner/karma/commit/ff7edbb2ffbcdd69761bece86b7dc1ef0740508d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-23495
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2412347
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://snyk.io/vuln/SNYK-JS-KARMA-2396325
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.49204
EPSS Score 0.00255
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:28:21.245451+00:00 GHSA Importer Import https://github.com/advisories/GHSA-rc3x-jf5g-xvc5 38.6.0