registry / @woodylab/payload / 0.0.216

@woodylab/payload@0.0.216

UIMS — User Interface Management System per Payload CMS 3 + Next.js: separa il contenuto dalla presentazione (ViewMode), temi/palette/stili configurabili da admin.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

A CMS-configured View block can cause server-side requests to an arbitrary endpoint with administrator-supplied request options. No package-specific malicious endpoint or install-time behavior was found.

Static reason

No blocking static signals were detected.

Trigger

A user with permission to create or edit a View config sets useInternalSource false and the view is rendered.

Impact

SSRF and possible disclosure of JSON responses through rendered content.

Mechanism

Unvalidated server-side fetch of CMS-controlled URL and options

Rationale

The package does not exhibit malware behavior, but it contains a concrete SSRF-capable server-side fetch primitive exposed through CMS configuration. This warrants a warning until URL and request-option controls are added.

Evidence

dist/uims/resolver/viewResolver.jsdist/config/fields/fieldsView.jsdist/cli/init.jspackage.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

dist/uims/resolver/viewResolver.js fetches arbitrary block.dataSource server-side.
dist/config/fields/fieldsView.js exposes dataSource and unrestricted sourceOptions headers.

@woodylab/payload@0.0.216

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code