npm package report

Is @medplum/core safe?

1 known vulnerability, worst severity HIGH.

cvss

7.1

how bad it is if exploited, out of 10

epss

0.10%

chance of exploitation in the next 30 days

xyz score

3.3

CyberXYZ composite, out of 10

fig. 01 — GHSA-m44r-7c5h-m6mj, the advisory selected below

// advisories

GHSA-m44r-7c5h-m6mj

HIGHCVE-2026-53728

The external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to that attacker-supplied URL and issues a redirect.

Affected: >=0, <5.1.6, <= 5.1.5
Fixed in: 5.1.6
Weakness: CWE-345
Published: 2026-08-17
Source: osv

NVD MITRE OSV

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 02:42 UTC. The most recent advisory here was published 2026-08-17. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is @medplum/core safe? npm package security report | CyberXYZ