CVE-2024-37162

zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine username and directory paths. An attacker could exploit this vulnerability to gain unauthorized access to sensitive server information. This information could be used to plan further attacks or gain a deeper understanding of the server infrastructure. This has been patched on `0.3.3`.

• CWE-209
• CWE-209

• https://github.com/IdoPesok/zsa/commit/86b86b282bde6780963f62406cc8bc65f2c86f3aPatch
• https://github.com/IdoPesok/zsa/security/advisories/GHSA-wjmj-h3xc-hxp8Vendor Advisory
• https://github.com/IdoPesok/zsa/commit/86b86b282bde6780963f62406cc8bc65f2c86f3aPatch
• https://github.com/IdoPesok/zsa/security/advisories/GHSA-wjmj-h3xc-hxp8Vendor Advisory

Published

Jun 7, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37157Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2024-37158Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…8.1
• CVE-2024-37159Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…6.5
• CVE-2024-3716A flaw was found in foreman-installer when puppet-candlepin …6.2
• CVE-2024-37160Formwork is a flat file-based Content Management System (CMS…4.8
• CVE-2024-37161MeterSphere is an open source continuous testing platform. P…6.1
• CVE-2024-37163SkyScrape is a GUI Dashboard for AWS Infrastructure and Mana…7.5
• CVE-2024-37164Computer Vision Annotation Tool (CVAT) is an interactive vid…8.5
• CVE-2024-37165Discourse is an open source discussion platform. Prior to 3.…6.1
• CVE-2024-37166ghtml is software that uses tagged templates for template en…8.9
• CVE-2024-37167Tuleap is an Open Source Suite to improve management of soft…4.3
• CVE-2024-37168@grpc/grps-js implements the core functionality of gRPC pure…5.3