CVE-2023-46729

sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0.

• CWE-918

• https://github.com/getsentry/sentry-javascript/commit/ddbda3c02c35aba8c5235e0cf07fc5bf656f81bePatch
• https://github.com/getsentry/sentry-javascript/pull/9415Patch
• https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-2rmr-xw8m-22q9Vendor Advisory
• https://github.com/getsentry/sentry-javascript/commit/ddbda3c02c35aba8c5235e0cf07fc5bf656f81bePatch
• https://github.com/getsentry/sentry-javascript/pull/9415Patch
• https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-2rmr-xw8m-22q9Vendor Advisory

Published

Nov 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46723lte-pic32-writer is a writer for PIC32 devices. In versions …7.5
• CVE-2023-46724Squid is a caching proxy for the Web. Due to an Improper Val…7.5
• CVE-2023-46725FoodCoopShop is open source software for food coops and loca…7.5
• CVE-2023-46726GLPI is a free asset and IT management software package. Sta…9.8
• CVE-2023-46727GLPI is a free asset and IT management software package. Sta…9.8
• CVE-2023-46728Squid is a caching proxy for the Web supporting HTTP, HTTPS,…7.5
• CVE-2023-4673Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-46730Group-Office is an enterprise CRM and groupware tool. In aff…8.8
• CVE-2023-46731XWiki Platform is a generic wiki platform offering runtime s…9.8
• CVE-2023-46732XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-46733Symfony is a PHP framework for web and console applications …6.5
• CVE-2023-46734Symfony is a PHP framework for web and console applications …6.1